aboutsummaryrefslogtreecommitdiff
path: root/drivers/video
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/video')
-rw-r--r--drivers/video/msm/mdss/mdss_debug.c10
-rw-r--r--drivers/video/msm/mdss/mdss_dsi.c21
-rw-r--r--drivers/video/msm/mdss/mdss_fb.c18
-rw-r--r--drivers/video/msm/mdss/mdss_mdp.c2
-rw-r--r--drivers/video/msm/mdss/mdss_mdp_overlay.c5
5 files changed, 40 insertions, 16 deletions
diff --git a/drivers/video/msm/mdss/mdss_debug.c b/drivers/video/msm/mdss/mdss_debug.c
index 4cc7a97cff5..049873ca32f 100644
--- a/drivers/video/msm/mdss/mdss_debug.c
+++ b/drivers/video/msm/mdss/mdss_debug.c
@@ -79,7 +79,7 @@ static ssize_t panel_debug_base_offset_write(struct file *file,
buf[count] = 0; /* end of string */
- if (sscanf(buf, "%x %d", &off, &cnt) != 2)
+ if (sscanf(buf, "%x %u", &off, &cnt) != 2)
return -EFAULT;
if (off > dbg->max_offset)
@@ -171,6 +171,8 @@ static ssize_t panel_debug_base_reg_write(struct file *file,
p[2] = 0;
pr_debug("p[%d] = %pK:%s\n", i, p, p);
cnt = sscanf(p, "%x", &tmp);
+ if (cnt != 1)
+ return -EFAULT;
reg[i] = tmp;
pr_debug("reg[%d] = %x\n", i, (int)reg[i]);
}
@@ -693,11 +695,11 @@ static ssize_t mdss_debug_factor_write(struct file *file,
if (strnchr(buf, count, '/')) {
/* Parsing buf as fraction */
- if (sscanf(buf, "%d/%d", &numer, &denom) != 2)
+ if (sscanf(buf, "%u/%u", &numer, &denom) != 2)
return -EFAULT;
} else {
/* Parsing buf as percentage */
- if (sscanf(buf, "%d", &numer) != 1)
+ if (kstrtouint(buf, 0, &numer))
return -EFAULT;
denom = 100;
}
@@ -1004,7 +1006,7 @@ static ssize_t mdss_debug_perf_bw_limit_write(struct file *file,
if (strnchr(buf, count, ' ')) {
/* Parsing buf */
- if (sscanf(buf, "%d %d", &mode, &val) != 2)
+ if (sscanf(buf, "%u %u", &mode, &val) != 2)
return -EFAULT;
}
diff --git a/drivers/video/msm/mdss/mdss_dsi.c b/drivers/video/msm/mdss/mdss_dsi.c
index 63cc27ab6ad..1fcbd290380 100644
--- a/drivers/video/msm/mdss/mdss_dsi.c
+++ b/drivers/video/msm/mdss/mdss_dsi.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -651,6 +651,7 @@ struct buf_data {
char *string_buf; /* cmd buf as string, 3 bytes per number */
int sblen; /* string buffer length */
int sync_flag;
+ struct mutex dbg_mutex; /* mutex to synchronize read/write/flush */
};
struct mdss_dsi_debugfs_info {
@@ -738,6 +739,7 @@ static ssize_t mdss_dsi_cmd_read(struct file *file, char __user *buf,
char *bp;
ssize_t ret = 0;
+ mutex_lock(&pcmds->dbg_mutex);
if (*ppos == 0) {
kfree(pcmds->string_buf);
pcmds->string_buf = NULL;
@@ -756,6 +758,7 @@ static ssize_t mdss_dsi_cmd_read(struct file *file, char __user *buf,
buffer = kmalloc(bsize, GFP_KERNEL);
if (!buffer) {
pr_err("%s: Failed to allocate memory\n", __func__);
+ mutex_unlock(&pcmds->dbg_mutex);
return -ENOMEM;
}
@@ -791,10 +794,12 @@ static ssize_t mdss_dsi_cmd_read(struct file *file, char __user *buf,
kfree(pcmds->string_buf);
pcmds->string_buf = NULL;
pcmds->sblen = 0;
+ mutex_unlock(&pcmds->dbg_mutex);
return 0; /* the end */
}
ret = simple_read_from_buffer(buf, count, ppos, pcmds->string_buf,
pcmds->sblen);
+ mutex_unlock(&pcmds->dbg_mutex);
return ret;
}
@@ -806,6 +811,7 @@ static ssize_t mdss_dsi_cmd_write(struct file *file, const char __user *p,
int blen = 0;
char *string_buf;
+ mutex_lock(&pcmds->dbg_mutex);
if (*ppos == 0) {
kfree(pcmds->string_buf);
pcmds->string_buf = NULL;
@@ -817,6 +823,7 @@ static ssize_t mdss_dsi_cmd_write(struct file *file, const char __user *p,
string_buf = krealloc(pcmds->string_buf, blen + 1, GFP_KERNEL);
if (!string_buf) {
pr_err("%s: Failed to allocate memory\n", __func__);
+ mutex_unlock(&pcmds->dbg_mutex);
return -ENOMEM;
}
@@ -826,6 +833,7 @@ static ssize_t mdss_dsi_cmd_write(struct file *file, const char __user *p,
string_buf[blen] = '\0';
pcmds->string_buf = string_buf;
pcmds->sblen = blen;
+ mutex_unlock(&pcmds->dbg_mutex);
return ret;
}
@@ -836,8 +844,12 @@ static int mdss_dsi_cmd_flush(struct file *file, fl_owner_t id)
char *buf, *bufp, *bp;
struct dsi_ctrl_hdr *dchdr;
- if (!pcmds->string_buf)
+ mutex_lock(&pcmds->dbg_mutex);
+
+ if (!pcmds->string_buf) {
+ mutex_unlock(&pcmds->dbg_mutex);
return 0;
+ }
/*
* Allocate memory for command buffer
@@ -850,6 +862,7 @@ static int mdss_dsi_cmd_flush(struct file *file, fl_owner_t id)
kfree(pcmds->string_buf);
pcmds->string_buf = NULL;
pcmds->sblen = 0;
+ mutex_unlock(&pcmds->dbg_mutex);
return -ENOMEM;
}
@@ -874,6 +887,7 @@ static int mdss_dsi_cmd_flush(struct file *file, fl_owner_t id)
pr_err("%s: dtsi cmd=%x error, len=%d\n",
__func__, dchdr->dtype, dchdr->dlen);
kfree(buf);
+ mutex_unlock(&pcmds->dbg_mutex);
return -EINVAL;
}
bp += sizeof(*dchdr);
@@ -885,6 +899,7 @@ static int mdss_dsi_cmd_flush(struct file *file, fl_owner_t id)
pr_err("%s: dcs_cmd=%x len=%d error!\n", __func__,
bp[0], len);
kfree(buf);
+ mutex_unlock(&pcmds->dbg_mutex);
return -EINVAL;
}
@@ -897,6 +912,7 @@ static int mdss_dsi_cmd_flush(struct file *file, fl_owner_t id)
pcmds->buf = buf;
pcmds->blen = blen;
}
+ mutex_unlock(&pcmds->dbg_mutex);
return 0;
}
@@ -911,6 +927,7 @@ struct dentry *dsi_debugfs_create_dcs_cmd(const char *name, umode_t mode,
struct dentry *parent, struct buf_data *cmd,
struct dsi_panel_cmds ctrl_cmds)
{
+ mutex_init(&cmd->dbg_mutex);
cmd->buf = ctrl_cmds.buf;
cmd->blen = ctrl_cmds.blen;
cmd->string_buf = NULL;
diff --git a/drivers/video/msm/mdss/mdss_fb.c b/drivers/video/msm/mdss/mdss_fb.c
index bc593eed7e6..81f217fcce3 100644
--- a/drivers/video/msm/mdss/mdss_fb.c
+++ b/drivers/video/msm/mdss/mdss_fb.c
@@ -2,7 +2,7 @@
* Core MDSS framebuffer driver.
*
* Copyright (C) 2007 Google Incorporated
- * Copyright (c) 2008-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2008-2017, The Linux Foundation. All rights reserved.
*
* This software is licensed under the terms of the GNU General Public
* License version 2, as published by the Free Software Foundation, and
@@ -623,8 +623,8 @@ static ssize_t mdss_fb_force_panel_dead(struct device *dev,
return len;
}
- if (sscanf(buf, "%d", &pdata->panel_info.panel_force_dead) != 1)
- pr_err("sccanf buf error!\n");
+ if (kstrtouint(buf, 0, &pdata->panel_info.panel_force_dead))
+ pr_err("kstrtouint buf error\n");
return len;
}
@@ -737,8 +737,8 @@ static ssize_t mdss_fb_change_dfps_mode(struct device *dev,
}
pinfo = &pdata->panel_info;
- if (sscanf(buf, "%d", &dfps_mode) != 1) {
- pr_err("sccanf buf error!\n");
+ if (kstrtouint(buf, 0, &dfps_mode)) {
+ pr_err("kstrtouint buf error\n");
return len;
}
@@ -3511,8 +3511,6 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data,
goto buf_sync_err_2;
}
- sync_fence_install(rel_fence, rel_fen_fd);
-
ret = copy_to_user(buf_sync->rel_fen_fd, &rel_fen_fd, sizeof(int));
if (ret) {
pr_err("%s: copy_to_user failed\n", sync_pt_data->fence_name);
@@ -3549,8 +3547,6 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data,
goto buf_sync_err_3;
}
- sync_fence_install(retire_fence, retire_fen_fd);
-
ret = copy_to_user(buf_sync->retire_fen_fd, &retire_fen_fd,
sizeof(int));
if (ret) {
@@ -3561,7 +3557,11 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data,
goto buf_sync_err_3;
}
+ sync_fence_install(retire_fence, retire_fen_fd);
+
skip_retire_fence:
+ sync_fence_install(rel_fence, rel_fen_fd);
+
mutex_unlock(&sync_pt_data->sync_mutex);
if (buf_sync->flags & MDP_BUF_SYNC_FLAG_WAIT)
diff --git a/drivers/video/msm/mdss/mdss_mdp.c b/drivers/video/msm/mdss/mdss_mdp.c
index 5d8deddd8da..3cf0f5f4ea9 100644
--- a/drivers/video/msm/mdss/mdss_mdp.c
+++ b/drivers/video/msm/mdss/mdss_mdp.c
@@ -1673,7 +1673,7 @@ static ssize_t mdss_mdp_store_max_limit_bw(struct device *dev,
struct mdss_data_type *mdata = dev_get_drvdata(dev);
u32 data = 0;
- if (1 != sscanf(buf, "%d", &data)) {
+ if (kstrtouint(buf, 0, &data)) {
pr_info("Not able scan to bw_mode_bitmap\n");
} else {
mdata->bw_mode_bitmap = data;
diff --git a/drivers/video/msm/mdss/mdss_mdp_overlay.c b/drivers/video/msm/mdss/mdss_mdp_overlay.c
index d81bf44515e..ee9bfdd605c 100644
--- a/drivers/video/msm/mdss/mdss_mdp_overlay.c
+++ b/drivers/video/msm/mdss/mdss_mdp_overlay.c
@@ -3677,6 +3677,11 @@ static int mdss_mdp_hw_cursor_update(struct msm_fb_data_type *mfd,
if (cursor->set & FB_CUR_SETIMAGE) {
u32 cursor_addr;
+ if (img->width * img->height * 4 > cursor_frame_size) {
+ pr_err("cursor image size is too large\n");
+ ret = -EINVAL;
+ goto done;
+ }
ret = copy_from_user(mfd->cursor_buf, img->data,
cursor_frame_size);
if (ret) {
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-20 17:11:55 +0000