evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: Fix potential deferencing of null pointer

Browse source 
While servicing display post processing ioctl for calib data the
driver checks if the calibration addr is valid. During this
check it deferences the base address for all pipes without
checking if the pipe pointer is NULL. This fix adds this check.

CRs-Fixed: 1082568
Change-Id: Id8164e3e9a6e5178d14dfce60eccbdb3f7a1b253
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
This commit is contained in:
Naseer Ahmed 2016-10-28 16:24:50 -04:00
parent cd316285c5
commit 434dda63fc
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
drivers/video/fbdev/msm/mdss_mdp_pp.c
View file

@ -6984,9 +6984,6 @@ static int is_valid_calib_addr(void *addr, u32 operation)
int ret = 0;
char __iomem *ptr = addr;
char __iomem *mixer_base = mdss_res->mixer_intf->base;
char __iomem *rgb_base = mdss_res->rgb_pipes->base;
char __iomem *dma_base = mdss_res->dma_pipes->base;
char __iomem *vig_base = mdss_res->vig_pipes->base;
char __iomem *ctl_base = mdss_res->ctl_off->base;
char __iomem *dspp_base = mdss_res->mixer_intf->dspp_base;
@ -7018,17 +7015,20 @@ static int is_valid_calib_addr(void *addr, u32 operation)
if (ret)
goto valid_addr;
}
if (ptr >= vig_base) {
if (mdss_res->vig_pipes &&
ptr >= mdss_res->vig_pipes->base) {
ret = is_valid_calib_vig_addr(ptr);
if (ret)
goto valid_addr;
}
if (ptr >= rgb_base) {
if (mdss_res->rgb_pipes &&
ptr >= mdss_res->rgb_pipes->base) {
ret = is_valid_calib_rgb_addr(ptr);
if (ret)
goto valid_addr;
}
if (ptr >= dma_base) {
if (mdss_res->dma_pipes &&
ptr >= mdss_res->dma_pipes->base) {
ret = is_valid_calib_dma_addr(ptr);
if (ret)
goto valid_addr;