Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9054046d authored by Ritesh Kumar's avatar Ritesh Kumar
Browse files

drm/msm/dsi-staging: avoid out of bounds access of ctrl array 



To avoid out of bounds access of ctrl array, an extra check
against maximum possible value is required. This is implemented
using macro display_for_each_ctrl.

Change-Id: I0e74fbf5d4229027ac9f001181992d898ef0c0c7
Signed-off-by: default avatarRitesh Kumar <riteshk@codeaurora.org>
parent 44123858

drivers/gpu/drm/msm/dsi-staging/dsi_display.c

+11 −17
Original line number Diff line number Diff line
@@ -3791,7 +3791,7 @@ static int dsi_display_update_dsi_bitrate(struct dsi_display *display, 


	display->config.bit_clk_rate_hz = bit_clk_rate;



	for (i = 0; i < display->ctrl_count; i++) {

	display_for_each_ctrl(i, display) {

		struct dsi_display_ctrl *dsi_disp_ctrl = &display->ctrl[i];

		struct dsi_ctrl *ctrl = dsi_disp_ctrl->ctrl;

		u32 num_of_lanes = 0, bpp;
@@ -3919,8 +3919,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, 
		goto exit;

	}



	for (i = 0; (i < display->ctrl_count) &&

	     (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {

	display_for_each_ctrl(i, display) {

		ctrl = &display->ctrl[i];

		if (!ctrl->ctrl)

			continue;
@@ -3938,8 +3937,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, 
		}

	}



	for (i = 0; (i < display->ctrl_count) &&

	     (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {

	display_for_each_ctrl(i, display) {

		ctrl = &display->ctrl[i];

		if (ctrl == m_ctrl)

			continue;
@@ -3948,8 +3946,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, 
	dsi_phy_dynamic_refresh_trigger(m_ctrl->phy, true);



	/* wait for dynamic refresh done */

	for (i = 0; (i < display->ctrl_count) &&

	     (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {

	display_for_each_ctrl(i, display) {

		ctrl = &display->ctrl[i];

		rc = dsi_ctrl_wait4dynamic_refresh_done(ctrl->ctrl);

		if (rc) {
@@ -3961,8 +3958,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, 
		}

	}



	for (i = 0; (i < display->ctrl_count) &&

	     (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {

	display_for_each_ctrl(i, display) {

		ctrl = &display->ctrl[i];

		dsi_phy_dynamic_refresh_clear(ctrl->phy);

	}
@@ -3977,8 +3973,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, 
	return rc;



recover_pix_clk:

	for (i = 0; (i < display->ctrl_count) &&

	     (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {

	display_for_each_ctrl(i, display) {

		ctrl = &display->ctrl[i];

		if (!ctrl->ctrl)

			continue;
@@ -3987,8 +3982,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, 
	}



recover_byte_clk:

	for (i = 0; (i < display->ctrl_count) &&

	     (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {

	display_for_each_ctrl(i, display) {

		ctrl = &display->ctrl[i];

		if (!ctrl->ctrl)

			continue;
@@ -4022,7 +4016,7 @@ static int dsi_display_dynamic_clk_switch(struct dsi_display *display, 
	dsi_display_mask_ctrl_error_interrupts(display, mask, true);



	/* update the phy timings based on new mode */

	for (i = 0; i < display->ctrl_count; i++) {

	display_for_each_ctrl(i, display) {

		ctrl = &display->ctrl[i];

		dsi_phy_update_phy_timings(ctrl->phy, &display->config);

	}
@@ -4042,7 +4036,7 @@ static int dsi_display_dynamic_clk_switch(struct dsi_display *display, 
	_dsi_display_calc_pipe_delay(display, &delay, mode);



	/* configure dynamic refresh ctrl registers */

	for (i = 0; i < display->ctrl_count; i++) {

	display_for_each_ctrl(i, display) {

		ctrl = &display->ctrl[i];

		if (!ctrl->phy)

			continue;
@@ -5472,7 +5466,7 @@ static struct dsi_display_ext_bridge *dsi_display_ext_get_bridge( 
		sde_conn = to_sde_connector(conn_iter);

		if (sde_conn->encoder == bridge->encoder) {

			display = sde_conn->display;

			for (i = 0; i < display->ctrl_count; i++) {

			display_for_each_ctrl(i, display) {

				if (display->ext_bridge[i].bridge == bridge)

					return &display->ext_bridge[i];

			}
@@ -6920,7 +6914,7 @@ static int dsi_display_qsync(struct dsi_display *display, bool enable) 


	mutex_lock(&display->display_lock);



	for (i = 0; i < display->ctrl_count; i++) {

	display_for_each_ctrl(i, display) {



		if (enable) {

			/* send the commands to enable qsync */