From d8417e7fc2a94a20e538e7ef4b0964e128520ee8 Mon Sep 17 00:00:00 2001 From: Ping Li Date: Thu, 3 Oct 2013 20:01:52 -0400 Subject: [PATCH] msm: mdss: Replace the size check for gamut LUTs Add more reliable size check for gamut LUTs to prevent potential security issues such as information leak. Change-Id: I32be41a2612a100b9ba6167737c2f8778f720fa2 Signed-off-by: Ping Li --- drivers/video/msm/mdss/mdss_mdp_pp.c | 32 ++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/drivers/video/msm/mdss/mdss_mdp_pp.c b/drivers/video/msm/mdss/mdss_mdp_pp.c index 64d0bca72ddd..8e8790dcfa74 100644 --- a/drivers/video/msm/mdss/mdss_mdp_pp.c +++ b/drivers/video/msm/mdss/mdss_mdp_pp.c @@ -295,6 +295,9 @@ static void pp_update_argc_lut(u32 offset, struct mdp_pgc_lut_data *config); static void pp_update_hist_lut(char __iomem *base, struct mdp_hist_lut_data *cfg); +static int pp_gm_has_invalid_lut_size(struct mdp_gamut_cfg_data *config); +static void pp_gamut_config(struct mdp_gamut_cfg_data *gamut_cfg, + u32 base, struct pp_sts_type *pp_sts); static void pp_pa_config(unsigned long flags, u32 base, struct pp_sts_type *pp_sts, struct mdp_pa_cfg *pa_config); @@ -2038,10 +2041,32 @@ int mdss_mdp_dither_config(struct mdp_dither_cfg_data *config, return 0; } +static int pp_gm_has_invalid_lut_size(struct mdp_gamut_cfg_data *config) +{ + if (config->tbl_size[0] != GAMUT_T0_SIZE) + return -EINVAL; + if (config->tbl_size[1] != GAMUT_T1_SIZE) + return -EINVAL; + if (config->tbl_size[2] != GAMUT_T2_SIZE) + return -EINVAL; + if (config->tbl_size[3] != GAMUT_T3_SIZE) + return -EINVAL; + if (config->tbl_size[4] != GAMUT_T4_SIZE) + return -EINVAL; + if (config->tbl_size[5] != GAMUT_T5_SIZE) + return -EINVAL; + if (config->tbl_size[6] != GAMUT_T6_SIZE) + return -EINVAL; + if (config->tbl_size[7] != GAMUT_T7_SIZE) + return -EINVAL; + + return 0; +} + int mdss_mdp_gamut_config(struct mdp_gamut_cfg_data *config, u32 *copyback) { - int i, j, size_total = 0, ret = 0; + int i, j, ret = 0; u32 offset, disp_num, dspp_num = 0; uint16_t *tbl_off; struct mdp_gamut_cfg_data local_cfg; @@ -2053,9 +2078,8 @@ int mdss_mdp_gamut_config(struct mdp_gamut_cfg_data *config, if ((config->block < MDP_LOGICAL_BLOCK_DISP_0) || (config->block >= MDP_BLOCK_MAX)) return -EINVAL; - for (i = 0; i < MDP_GAMUT_TABLE_NUM; i++) - size_total += config->tbl_size[i]; - if (size_total != GAMUT_TOTAL_TABLE_SIZE) + + if (pp_gm_has_invalid_lut_size(config)) return -EINVAL; mutex_lock(&mdss_pp_mutex);