evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: Fix null pointer dereference and unintialisation of variables

Browse source 
Add NULL checks before accessing potential null pointers. Also, fix
uninitialised variables in MDP driver as they can be accessed with
incorrect values.

Change-Id: Id8a551fd3bc147c800ee1c98c2bc2b6f3bf6d380
Signed-off-by: Krishna Manikandan <mkrishn@codeaurora.org>
This commit is contained in:
Krishna Manikandan 2016-11-28 17:52:45 +05:30
parent b832093be4
commit 0e2ee06748
5 changed files with 20 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/video/fbdev/msm/mdss_dsi_host.c
View file

@ -2142,7 +2142,7 @@ static int mdss_dsi_cmd_dma_rx(struct mdss_dsi_ctrl_pdata *ctrl,
u32 *lp, *temp, data; u32 *lp, *temp, data;
int i, j = 0, off, cnt; int i, j = 0, off, cnt;
bool ack_error = false; bool ack_error = false;
char reg[16]; char reg[16] = {0x0};
int repeated_bytes = 0; int repeated_bytes = 0;
lp = (u32 *)rp->data; lp = (u32 *)rp->data;

4
drivers/video/fbdev/msm/mdss_hdmi_hdcp2p2.c
View file

@ -666,7 +666,7 @@ static void hdmi_hdcp2p2_link_cb(void *data)
static void hdmi_hdcp2p2_recv_msg(struct hdmi_hdcp2p2_ctrl *ctrl) static void hdmi_hdcp2p2_recv_msg(struct hdmi_hdcp2p2_ctrl *ctrl)
{ {
int rc = 0, timeout_hsync; int timeout_hsync = 0, rc = 0;
char *recvd_msg_buf = NULL; char *recvd_msg_buf = NULL;
struct hdmi_tx_hdcp2p2_ddc_data *ddc_data; struct hdmi_tx_hdcp2p2_ddc_data *ddc_data;
struct hdmi_tx_ddc_ctrl *ddc_ctrl; struct hdmi_tx_ddc_ctrl *ddc_ctrl;
@ -1079,7 +1079,7 @@ error:
static bool hdmi_hdcp2p2_supported(struct hdmi_hdcp2p2_ctrl *ctrl) static bool hdmi_hdcp2p2_supported(struct hdmi_hdcp2p2_ctrl *ctrl)
{ {
u8 hdcp2version; u8 hdcp2version = 0;
int rc = hdmi_hdcp2p2_read_version(ctrl, &hdcp2version); int rc = hdmi_hdcp2p2_read_version(ctrl, &hdcp2version);
if (rc) if (rc)

6
drivers/video/fbdev/msm/mdss_mdp.c
View file

@ -823,7 +823,7 @@ void mdss_mdp_irq_clear(struct mdss_data_type *mdata,
int mdss_mdp_irq_enable(u32 intr_type, u32 intf_num) int mdss_mdp_irq_enable(u32 intr_type, u32 intf_num)
{ {
int irq_idx, idx; int irq_idx = 0;
unsigned long irq_flags; unsigned long irq_flags;
int ret = 0; int ret = 0;
struct mdss_data_type *mdata = mdss_mdp_get_mdata(); struct mdss_data_type *mdata = mdss_mdp_get_mdata();
@ -842,7 +842,7 @@ int mdss_mdp_irq_enable(u32 intr_type, u32 intf_num)
spin_lock_irqsave(&mdp_lock, irq_flags); spin_lock_irqsave(&mdp_lock, irq_flags);
if (mdata->mdp_irq_mask[irq.reg_idx] & irq.irq_mask) { if (mdata->mdp_irq_mask[irq.reg_idx] & irq.irq_mask) {
pr_warn("MDSS MDP IRQ-0x%x is already set, mask=%x\n", pr_warn("MDSS MDP IRQ-0x%x is already set, mask=%x\n",
irq.irq_mask, mdata->mdp_irq_mask[idx]); irq.irq_mask, mdata->mdp_irq_mask[irq.reg_idx]);
ret = -EBUSY; ret = -EBUSY;
} else { } else {
pr_debug("MDP IRQ mask old=%x new=%x\n", pr_debug("MDP IRQ mask old=%x new=%x\n",
@ -2433,6 +2433,8 @@ static void __update_sspp_info(struct mdss_mdp_pipe *pipe,
size_t len = PAGE_SIZE; size_t len = PAGE_SIZE;
int num_bytes = BITS_TO_BYTES(MDP_IMGTYPE_LIMIT1); int num_bytes = BITS_TO_BYTES(MDP_IMGTYPE_LIMIT1);
if (!pipe)
return;
#define SPRINT(fmt, ...) \ #define SPRINT(fmt, ...) \
(*cnt += scnprintf(buf + *cnt, len - *cnt, fmt, ##__VA_ARGS__)) (*cnt += scnprintf(buf + *cnt, len - *cnt, fmt, ##__VA_ARGS__))

14
drivers/video/fbdev/msm/mdss_mdp_layer.c
View file

@ -855,12 +855,18 @@ static int __validate_layer_reconfig(struct mdp_input_layer *layer,
*/ */
if (pipe->csc_coeff_set != layer->color_space) { if (pipe->csc_coeff_set != layer->color_space) {
src_fmt = mdss_mdp_get_format_params(layer->buffer.format); src_fmt = mdss_mdp_get_format_params(layer->buffer.format);
if (pipe->src_fmt->is_yuv && src_fmt && src_fmt->is_yuv) { if (!src_fmt) {
status = -EPERM; pr_err("Invalid layer format %d\n",
pr_err("csc change is not permitted on used pipe\n"); layer->buffer.format);
status = -EINVAL;
} else {
if (pipe->src_fmt->is_yuv && src_fmt &&
src_fmt->is_yuv) {
status = -EPERM;
pr_err("csc change is not permitted on used pipe\n");
}
} }
} }
return status; return status;
} }

5
drivers/video/fbdev/msm/mdss_mdp_pp.c
View file

@ -2461,7 +2461,7 @@ static int pp_dspp_setup(u32 disp_num, struct mdss_mdp_mixer *mixer)
} }
if (flags & PP_FLAGS_DIRTY_DITHER) { if (flags & PP_FLAGS_DIRTY_DITHER) {
if (!pp_ops[DITHER].pp_set_config) { if (!pp_ops[DITHER].pp_set_config && addr) {
pp_dither_config(addr, pp_sts, pp_dither_config(addr, pp_sts,
&mdss_pp_res->dither_disp_cfg[disp_num]); &mdss_pp_res->dither_disp_cfg[disp_num]);
} else { } else {
@ -5308,7 +5308,8 @@ static int pp_hist_collect(struct mdp_histogram_data *hist,
else if (block == SSPP_VIG) else if (block == SSPP_VIG)
v_base = ctl_base + v_base = ctl_base +
MDSS_MDP_REG_VIG_HIST_CTL_BASE; MDSS_MDP_REG_VIG_HIST_CTL_BASE;
sum = pp_hist_read(v_base, hist_info); if (v_base)
sum = pp_hist_read(v_base, hist_info);
} }
writel_relaxed(0, hist_info->base); writel_relaxed(0, hist_info->base);
mdss_mdp_clk_ctrl(MDP_BLOCK_POWER_OFF); mdss_mdp_clk_ctrl(MDP_BLOCK_POWER_OFF);