From b162aae6d2f3223e6bc971fa9fc31647b1fde08e Mon Sep 17 00:00:00 2001
From: Naseer Ahmed <naseer@codeaurora.org>
Date: Thu, 4 Aug 2016 14:25:23 -0400
Subject: [PATCH] msm: mdss: Fix to validate data copied from user space
The overlay zorder values copied from user space are used
as index in left_lm_zo_cnt and right_lm_zo_cnt. This fix
will validate the overlay zorder value copied from user
space to not go beyond MDSS_MDP_MAX_STAGE, thus preventing
any arbitrary increments in kernel memory.
Bug: 30019716
CRs-Fixed: 1049232
Change-Id: Ie8e65ce9f58cb357204bfa4c6a6e0fccec82d5ba
Signed-off-by: Shalini Krishnamoorthi <shakri@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
---
drivers/video/msm/mdss/mdss_mdp_overlay.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/video/msm/mdss/mdss_mdp_overlay.c b/drivers/video/msm/mdss/mdss_mdp_overlay.c
index 6a6b1e67ffa8..f59b94fbae6c 100644
--- a/drivers/video/msm/mdss/mdss_mdp_overlay.c
+++ b/drivers/video/msm/mdss/mdss_mdp_overlay.c
@@ -3025,16 +3025,20 @@ static int __mdss_overlay_src_split_sort(struct msm_fb_data_type *mfd,
__overlay_swap_func);
for (i = 0; i < num_ovs; i++) {
+ if (ovs[i].z_order >= MDSS_MDP_MAX_STAGE) {
+ pr_err("invalid stage:%u\n", ovs[i].z_order);
+ return -EINVAL;
+ }
if (ovs[i].dst_rect.x < left_lm_w) {
if (left_lm_zo_cnt[ovs[i].z_order] == 2) {
- pr_err("more than 2 ov @ stage%d on left lm\n",
+ pr_err("more than 2 ov @ stage%u on left lm\n",
ovs[i].z_order);
return -EINVAL;
}
left_lm_zo_cnt[ovs[i].z_order]++;
} else {
if (right_lm_zo_cnt[ovs[i].z_order] == 2) {
- pr_err("more than 2 ov @ stage%d on right lm\n",
+ pr_err("more than 2 ov @ stage%u on right lm\n",
ovs[i].z_order);
return -EINVAL;
}
--
GitLab