From 75c3748493eefee24b30ce2683dbe8864a9b74b6 Mon Sep 17 00:00:00 2001 From: Terence Hampson Date: Fri, 22 May 2015 19:23:24 -0400 Subject: [PATCH] msm: mdss: prevent crash in null commit use case Prevent client from crashing system when wfd_pre_commit is called without calling validate before. Change-Id: I83a2b878b300fb835908e57037da8a4d83d114ed Signed-off-by: Terence Hampson [cip@codeaurora.org: Resolved merge conflict] Signed-off-by: Clarence Ip --- drivers/video/fbdev/msm/mdss_mdp_layer.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/msm/mdss_mdp_layer.c b/drivers/video/fbdev/msm/mdss_mdp_layer.c index 434d10e996df..d696d3d3463e 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_layer.c +++ b/drivers/video/fbdev/msm/mdss_mdp_layer.c @@ -236,8 +236,8 @@ static int __layer_param_check(struct msm_fb_data_type *mfd, } if (CHECK_LAYER_BOUNDS(layer->dst_rect.y, layer->dst_rect.h, yres)) { - pr_err("invalid vertical destination: y=%d, h=%d\n", - layer->dst_rect.y, layer->dst_rect.h); + pr_err("invalid vertical destination: y=%d, h=%d, yres=%d\n", + layer->dst_rect.y, layer->dst_rect.h, yres); return -EOVERFLOW; } @@ -1446,6 +1446,12 @@ int mdss_mdp_layer_pre_commit_wfd(struct msm_fb_data_type *mfd, goto fence_get_err; } } + } else { + wfd = mdp5_data->wfd; + if (!wfd->ctl || !wfd->ctl->wb) { + pr_err("wfd commit with null out layer and no validate\n"); + return -EINVAL; + } } rc = mdss_mdp_layer_pre_commit(mfd, file, commit);