evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: fix crash when wrong params are passed on the esd config

Browse source 
If wrong parameters are set on the dtsi to configure the
esd, a null pointer access can happen. Fix this to make
sure we check for valid pointers and otherwise just
throw an error, but not access an invalid pointer.

Change-Id: I3df0889c1225dcb613910cb90f050a2994f5834d
Signed-off-by: Ingrid Gallardo <ingridg@codeaurora.org>
This commit is contained in:
Ingrid Gallardo 2016-10-12 18:38:48 -07:00 • committed by Gerrit - the friendly Code Review server
parent df94b216e1
commit 35bfa1e56a
2 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/video/fbdev/msm/mdss_dsi_host.c
View file

@ -1108,6 +1108,11 @@ static int mdss_dsi_read_status(struct mdss_dsi_ctrl_pdata *ctrl)
rc = 1;
lenp = ctrl->status_valid_params ?: ctrl->status_cmds_rlen;
if (!lenp || !ctrl->status_cmds_rlen) {
pr_err("invalid dsi read params!\n");
return 0;
}
for (i = 0; i < ctrl->status_cmds.cmd_cnt; ++i) {
memset(&cmdreq, 0, sizeof(cmdreq));
cmdreq.cmds = ctrl->status_cmds.cmds + i;

12
drivers/video/fbdev/msm/mdss_dsi_panel.c
View file

@ -25,6 +25,7 @@
#include "mdss_dsi.h"
#include "mdss_dba_utils.h"
#include "mdss_debug.h"
#define DT_CMD_HDR 6
#define DEFAULT_MDP_TRANSFER_TIME 14000
@ -1451,7 +1452,7 @@ static int mdss_dsi_parse_reset_seq(struct device_node *np,
static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl)
{
int i, j;
int i, j = 0;
int len = 0, *lenp;
int group = 0;
@ -1460,6 +1461,15 @@ static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl)
for (i = 0; i < ctrl->status_cmds.cmd_cnt; i++)
len += lenp[i];
for (i = 0; i < len; i++) {
pr_debug("[%i] return:0x%x status:0x%x\n",
i, (unsigned int)ctrl->return_buf[i],
(unsigned int)ctrl->status_value[j + i]);
MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i],
ctrl->status_value[j + i]);
j += len;
}
for (j = 0; j < ctrl->groups; ++j) {
for (i = 0; i < len; ++i) {
if (ctrl->return_buf[i] !=