From 35bfa1e56a3063e9e23fec18d5f700a4bdcddb31 Mon Sep 17 00:00:00 2001 From: Ingrid Gallardo Date: Wed, 12 Oct 2016 18:38:48 -0700 Subject: [PATCH] msm: mdss: fix crash when wrong params are passed on the esd config If wrong parameters are set on the dtsi to configure the esd, a null pointer access can happen. Fix this to make sure we check for valid pointers and otherwise just throw an error, but not access an invalid pointer. Change-Id: I3df0889c1225dcb613910cb90f050a2994f5834d Signed-off-by: Ingrid Gallardo --- drivers/video/fbdev/msm/mdss_dsi_host.c | 5 +++++ drivers/video/fbdev/msm/mdss_dsi_panel.c | 12 +++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/msm/mdss_dsi_host.c b/drivers/video/fbdev/msm/mdss_dsi_host.c index 18bcdca31bf6..c9168242da60 100644 --- a/drivers/video/fbdev/msm/mdss_dsi_host.c +++ b/drivers/video/fbdev/msm/mdss_dsi_host.c @@ -1108,6 +1108,11 @@ static int mdss_dsi_read_status(struct mdss_dsi_ctrl_pdata *ctrl) rc = 1; lenp = ctrl->status_valid_params ?: ctrl->status_cmds_rlen; + if (!lenp || !ctrl->status_cmds_rlen) { + pr_err("invalid dsi read params!\n"); + return 0; + } + for (i = 0; i < ctrl->status_cmds.cmd_cnt; ++i) { memset(&cmdreq, 0, sizeof(cmdreq)); cmdreq.cmds = ctrl->status_cmds.cmds + i; diff --git a/drivers/video/fbdev/msm/mdss_dsi_panel.c b/drivers/video/fbdev/msm/mdss_dsi_panel.c index e8d68059581f..a16176915a0c 100644 --- a/drivers/video/fbdev/msm/mdss_dsi_panel.c +++ b/drivers/video/fbdev/msm/mdss_dsi_panel.c @@ -25,6 +25,7 @@ #include "mdss_dsi.h" #include "mdss_dba_utils.h" +#include "mdss_debug.h" #define DT_CMD_HDR 6 #define DEFAULT_MDP_TRANSFER_TIME 14000 @@ -1451,7 +1452,7 @@ static int mdss_dsi_parse_reset_seq(struct device_node *np, static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl) { - int i, j; + int i, j = 0; int len = 0, *lenp; int group = 0; @@ -1460,6 +1461,15 @@ static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl) for (i = 0; i < ctrl->status_cmds.cmd_cnt; i++) len += lenp[i]; + for (i = 0; i < len; i++) { + pr_debug("[%i] return:0x%x status:0x%x\n", + i, (unsigned int)ctrl->return_buf[i], + (unsigned int)ctrl->status_value[j + i]); + MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i], + ctrl->status_value[j + i]); + j += len; + } + for (j = 0; j < ctrl->groups; ++j) { for (i = 0; i < len; ++i) { if (ctrl->return_buf[i] !=