diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2019-10-17 22:09:58 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-10-17 22:09:58 -0700 |
| commit | 0e2237f53cccb22e54c9855e1aafa7df086b8805 (patch) | |
| tree | 4fa2c5bebb1ce9c691a49e612e936a5ac46f5a1b | |
| parent | 2ef98aa392474e7e48863f0925b448ff383705e3 (diff) | |
| parent | f63e92dffe080220ebcf59a49ef0c7ca60583a9c (diff) | |
Merge "disp: msm: sde: add check before buffer copy"LE.UM.2.3.7-16400-sda845.0
| -rw-r--r-- | drivers/gpu/drm/msm/sde/sde_connector.c | 3 | ||||
| -rw-r--r-- | drivers/gpu/drm/msm/sde_rsc.c | 8 |
2 files changed, 10 insertions, 1 deletions
diff --git a/drivers/gpu/drm/msm/sde/sde_connector.c b/drivers/gpu/drm/msm/sde/sde_connector.c index ab1d86b8ede6..414e088492d5 100644 --- a/drivers/gpu/drm/msm/sde/sde_connector.c +++ b/drivers/gpu/drm/msm/sde/sde_connector.c @@ -1501,6 +1501,9 @@ static ssize_t _sde_debugfs_conn_cmd_tx_sts_read(struct file *file, return 0; } + if (blen > count) + blen = count; + if (copy_to_user(buf, buffer, blen)) { SDE_ERROR("copy to user buffer failed\n"); return -EFAULT; diff --git a/drivers/gpu/drm/msm/sde_rsc.c b/drivers/gpu/drm/msm/sde_rsc.c index 6626cb334d42..f5bafa4fd3e6 100644 --- a/drivers/gpu/drm/msm/sde_rsc.c +++ b/drivers/gpu/drm/msm/sde_rsc.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. +/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1044,6 +1044,9 @@ end: if (blen <= 0) return 0; + if (blen > count) + blen = count; + if (copy_to_user(buf, buffer, blen)) return -EFAULT; @@ -1136,6 +1139,9 @@ end: if (blen <= 0) return 0; + if (blen > count) + blen = count; + if (copy_to_user(buf, buffer, blen)) return -EFAULT; |