dc: check user-supplied arguments before use

CID 27937
Bug 200741055

Change-Id: I3aaf094bf616f9cc56accece0f1818b9b6ba7c8a
Signed-off-by: dmitry pervushin <dpervushin@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2592115
Reviewed-by: Rahul Jain (SW-TEGRA) <rahuljain@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2592167
Tested-by: Achal Verma <achalv@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
Reviewed-by: Achal Verma <achalv@nvidia.com>
Reviewed-by: Phoenix Jung <pjung@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/drivers/video/tegra/dc/ext/dev.c b/drivers/video/tegra/dc/ext/dev.c
index 2b54a6fbe..47f25e9ba 100644
--- a/drivers/video/tegra/dc/ext/dev.c
+++ b/drivers/video/tegra/dc/ext/dev.c
@@ -2338,6 +2338,11 @@ static int tegra_dc_ext_set_nvdisp_cmu(struct tegra_dc_ext_user *user,
         if (!nvdisp_cmu)
                 return -ENOMEM;
 
+        if (args->lut_size < 0)
+                return -ERANGE;
+        if (args->lut_size > nvdisp_cmu->size / sizeof(u64))
+                return -E2BIG;
+
         tegra_dc_scrncapt_disp_pause_lock(dc);
         dc->pdata->cmu_enable = args->cmu_enable;
         lut_size = args->lut_size;