From bacf198b8676adcb49b7b1e7fc98ceb0e7e33830 Mon Sep 17 00:00:00 2001 From: dmitry pervushin Date: Thu, 9 Sep 2021 16:05:17 +0200 Subject: dc: check user-supplied arguments before use CID 27937 Bug 200741055 Change-Id: I3aaf094bf616f9cc56accece0f1818b9b6ba7c8a Signed-off-by: dmitry pervushin Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2592115 Reviewed-by: Rahul Jain (SW-TEGRA) GVS: Gerrit_Virtual_Submit Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2592167 Tested-by: Achal Verma Tested-by: mobile promotions Reviewed-by: Achal Verma Reviewed-by: Phoenix Jung Reviewed-by: mobile promotions --- drivers/video/tegra/dc/ext/dev.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/video/tegra/dc/ext/dev.c b/drivers/video/tegra/dc/ext/dev.c index 2b54a6fbe..47f25e9ba 100644 --- a/drivers/video/tegra/dc/ext/dev.c +++ b/drivers/video/tegra/dc/ext/dev.c @@ -2338,6 +2338,11 @@ static int tegra_dc_ext_set_nvdisp_cmu(struct tegra_dc_ext_user *user, if (!nvdisp_cmu) return -ENOMEM; + if (args->lut_size < 0) + return -ERANGE; + if (args->lut_size > nvdisp_cmu->size / sizeof(u64)) + return -E2BIG; + tegra_dc_scrncapt_disp_pause_lock(dc); dc->pdata->cmu_enable = args->cmu_enable; lut_size = args->lut_size; -- cgit v1.2.2