From 6bbef66ce393adf4515b9ce14f0c63568d54526c Mon Sep 17 00:00:00 2001 From: yadwan Date: Tue, 29 Jul 2025 11:04:00 +0800 Subject: [PATCH] disp: msm: sde: Add change to fix slab out of bounds Non null terminated string from user space can cause out of bound access issue. Hence added a NULL character explicitly in name when received from user space. Change-Id: I6d498f16a59ec2832ddc0951952101859666eacf Signed-off-by: yadwan (cherry picked from commit 7eb70ce3648b8eb8e5340b0bf3c5bb3a7605d811) --- msm/sde/sde_wb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/msm/sde/sde_wb.c b/msm/sde/sde_wb.c index dcb308fabf84..d6648ad7e2fc 100644 --- a/msm/sde/sde_wb.c +++ b/msm/sde/sde_wb.c @@ -204,6 +204,8 @@ int sde_wb_connector_set_modes(struct sde_wb_device *wb_dev, memset(&dispmode, 0, sizeof(dispmode)); ret = drm_mode_convert_umode(wb_dev->drm_dev, &dispmode, &modeinfo[i]); + /* null terminate the string */ + modeinfo[i].name[DRM_DISPLAY_MODE_LEN - 1] = '\0'; if (ret) { SDE_ERROR( "failed to convert mode %d:\"%s\" %d %d %d %d %d %d %d %d %d %d 0x%x 0x%x status:%d rc:%d\n",