diff options
| author | Harsh Sahu <hsahu@codeaurora.org> | 2017-02-16 20:25:39 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-28 12:58:34 -0800 |
| commit | 722e53bcf12a832493ab7f429d398a06b86642c2 (patch) | |
| tree | 86b2a09d5b518942b9132a1246bd2d1aa584976b /drivers | |
| parent | 59a631bcacba622a294d0c9e9e54ac9161413950 (diff) | |
msm: mdss: Validating data values before passing on as operand
mdss_mdp_dfps_update_params uses data as operand. Hence the values
are validated against their max values allowed to avoid any overflow
in this change.
Change-Id: I630b9390a18446cd461154e31e08642a8ff06ed8
Signed-off-by: Harsh Sahu <hsahu@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_mdp_overlay.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/video/fbdev/msm/mdss_mdp_overlay.c b/drivers/video/fbdev/msm/mdss_mdp_overlay.c index 5d80c80ebcef..883bb042f9a2 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_overlay.c +++ b/drivers/video/fbdev/msm/mdss_mdp_overlay.c @@ -48,6 +48,12 @@ #define BUF_POOL_SIZE 32 +#define DFPS_DATA_MAX_HFP 8192 +#define DFPS_DATA_MAX_HBP 8192 +#define DFPS_DATA_MAX_HPW 8192 +#define DFPS_DATA_MAX_FPS 0x7fffffff +#define DFPS_DATA_MAX_CLK_RATE 250000 + static int mdss_mdp_overlay_free_fb_pipe(struct msm_fb_data_type *mfd); static int mdss_mdp_overlay_fb_parse_dt(struct msm_fb_data_type *mfd); static int mdss_mdp_overlay_off(struct msm_fb_data_type *mfd); @@ -3375,6 +3381,13 @@ static ssize_t dynamic_fps_sysfs_wta_dfps(struct device *dev, return count; } + if (data.hfp > DFPS_DATA_MAX_HFP || data.hbp > DFPS_DATA_MAX_HBP || + data.hpw > DFPS_DATA_MAX_HPW || data.fps > DFPS_DATA_MAX_FPS || + data.clk_rate > DFPS_DATA_MAX_CLK_RATE){ + pr_err("Data values out of bound.\n"); + return -EINVAL; + } + rc = mdss_mdp_dfps_update_params(mfd, pdata, &data); if (rc) { pr_err("failed to set dfps params\n"); |