From be08b4e4510978766bd14f74eaf38e52058785b6 Mon Sep 17 00:00:00 2001 From: Satya Rama Aditya Pinapala Date: Mon, 21 Oct 2019 13:47:52 -0700 Subject: [PATCH] disp: msm: add check for buffer length before copy Length of the buffer to be copied is checked against both source and destination buffer lengths before copying. This ensures that there is no buffer overflow while reading as well as writing. Change-Id: I4bd1a5892b47771aef4c23a4d1594fc1c8361577 Signed-off-by: Satya Rama Aditya Pinapala --- msm/dsi/dsi_ctrl.c | 5 +++++ msm/sde/sde_connector.c | 5 ++++- msm/sde_rsc.c | 10 ++++++++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/msm/dsi/dsi_ctrl.c b/msm/dsi/dsi_ctrl.c index 599e8a9f5e90..b922bb259d2f 100644 --- a/msm/dsi/dsi_ctrl.c +++ b/msm/dsi/dsi_ctrl.c @@ -116,6 +116,9 @@ static ssize_t debugfs_state_info_read(struct file *file, dsi_ctrl->clk_freq.pix_clk_rate, dsi_ctrl->clk_freq.esc_clk_rate); + if (len > count) + len = count; + len = min_t(size_t, len, SZ_4K); if (copy_to_user(buff, buf, len)) { kfree(buf); @@ -171,6 +174,8 @@ static ssize_t debugfs_reg_dump_read(struct file *file, return rc; } + if (len > count) + len = count; len = min_t(size_t, len, SZ_4K); if (copy_to_user(buff, buf, len)) { diff --git a/msm/sde/sde_connector.c b/msm/sde/sde_connector.c index c45dc8ca521e..7681aa031109 100644 --- a/msm/sde/sde_connector.c +++ b/msm/sde/sde_connector.c @@ -1731,7 +1731,10 @@ static ssize_t _sde_debugfs_conn_cmd_tx_sts_read(struct file *file, return 0; } - blen = min_t(size_t, MAX_CMD_PAYLOAD_SIZE, count); + if (blen > count) + blen = count; + + blen = min_t(size_t, blen, MAX_CMD_PAYLOAD_SIZE); if (copy_to_user(buf, buffer, blen)) { SDE_ERROR("copy to user buffer failed\n"); return -EFAULT; diff --git a/msm/sde_rsc.c b/msm/sde_rsc.c index ed380bcbf9b6..10b17372d124 100644 --- a/msm/sde_rsc.c +++ b/msm/sde_rsc.c @@ -1105,7 +1105,10 @@ end: if (blen <= 0) return 0; - blen = min_t(size_t, MAX_BUFFER_SIZE, count); + if (blen > count) + blen = count; + + blen = min_t(size_t, blen, MAX_BUFFER_SIZE); if (copy_to_user(buf, buffer, blen)) return -EFAULT; @@ -1199,7 +1202,10 @@ end: if (blen <= 0) return 0; - blen = min_t(size_t, MAX_BUFFER_SIZE, count); + if (blen > count) + blen = count; + + blen = min_t(size_t, blen, MAX_BUFFER_SIZE); if (copy_to_user(buf, buffer, blen)) return -EFAULT;