From 722e53bcf12a832493ab7f429d398a06b86642c2 Mon Sep 17 00:00:00 2001 From: Harsh Sahu Date: Thu, 16 Feb 2017 20:25:39 -0800 Subject: msm: mdss: Validating data values before passing on as operand mdss_mdp_dfps_update_params uses data as operand. Hence the values are validated against their max values allowed to avoid any overflow in this change. Change-Id: I630b9390a18446cd461154e31e08642a8ff06ed8 Signed-off-by: Harsh Sahu --- drivers/video/fbdev/msm/mdss_mdp_overlay.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/video/fbdev/msm/mdss_mdp_overlay.c b/drivers/video/fbdev/msm/mdss_mdp_overlay.c index 5d80c80ebcef..883bb042f9a2 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_overlay.c +++ b/drivers/video/fbdev/msm/mdss_mdp_overlay.c @@ -48,6 +48,12 @@ #define BUF_POOL_SIZE 32 +#define DFPS_DATA_MAX_HFP 8192 +#define DFPS_DATA_MAX_HBP 8192 +#define DFPS_DATA_MAX_HPW 8192 +#define DFPS_DATA_MAX_FPS 0x7fffffff +#define DFPS_DATA_MAX_CLK_RATE 250000 + static int mdss_mdp_overlay_free_fb_pipe(struct msm_fb_data_type *mfd); static int mdss_mdp_overlay_fb_parse_dt(struct msm_fb_data_type *mfd); static int mdss_mdp_overlay_off(struct msm_fb_data_type *mfd); @@ -3375,6 +3381,13 @@ static ssize_t dynamic_fps_sysfs_wta_dfps(struct device *dev, return count; } + if (data.hfp > DFPS_DATA_MAX_HFP || data.hbp > DFPS_DATA_MAX_HBP || + data.hpw > DFPS_DATA_MAX_HPW || data.fps > DFPS_DATA_MAX_FPS || + data.clk_rate > DFPS_DATA_MAX_CLK_RATE){ + pr_err("Data values out of bound.\n"); + return -EINVAL; + } + rc = mdss_mdp_dfps_update_params(mfd, pdata, &data); if (rc) { pr_err("failed to set dfps params\n"); -- cgit v1.2.3