A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-05 19:31:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

disp: msm: Avoid UB in VBIF register shift calculation

Browse source 
Left-shifting a 32-bit integer by 32 bits or more results in UB. The
common values for vbif_xin_id[] are {10, 11} which means reg_shift
becomes 40/44. For IDs >= 8, the shift is meant to be relative to the
second 32-bit register, not to the first. Fix this issue by masking the
ID so that it will properly describe the intended shift.

Change-Id: Icd530a3bb7cfd9d087e2aecc763d24f775e20466
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
This commit is contained in:
Alexander Winkowski 2026-05-14 19:56:04 +00:00
commit c404d8ddf7
No known key found for this signature in database
GPG key ID: 72762A66704CDE44
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
techpack/display/rotator/sde_rotator_r3.c
View file

@ -1419,14 +1419,14 @@ static void sde_hw_rotator_vbif_rt_setting(void)
for (j = 0; j < MAX_XIN; j++) {
reg_high = ((mdata->vbif_xin_id[j]
& 0x8) >> 3) * 4 + (i * 8);
reg_shift = mdata->vbif_xin_id[j] * 4;
reg_shift = (mdata->vbif_xin_id[j] & 0x7) * 4;
reg_val = SDE_VBIF_READ(mdata,
MMSS_VBIF_NRT_VBIF_QOS_RP_REMAP_000 + reg_high);
reg_val_lvl = SDE_VBIF_READ(mdata,
MMSS_VBIF_NRT_VBIF_QOS_LVL_REMAP_000 + reg_high);
mask = 0x7 << (mdata->vbif_xin_id[j] * 4);
mask = 0x7 << reg_shift;
vbif_qos = mdata->vbif_nrt_qos[i];