Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 76a09bb3 authored by Arun Menon's avatar Arun Menon
Browse files

msm: wfd: Fix NULL pointer access issues 



Fix NULL pointer access issues in wfd driver.

Change-Id: I5b02ef6324fd18b4f836e3497cda357883199d78
Signed-off-by: default avatarArun Menon <avmenon@codeaurora.org>
parent 2049a6cf

drivers/media/platform/msm/wfd/mdp-5-subdev.c

+3 −2
Original line number Diff line number Diff line
@@ -177,11 +177,12 @@ static int mdp_dq_buffer(struct v4l2_subdev *sd, void *arg) 
static int mdp_set_prop(struct v4l2_subdev *sd, void *arg)

{

	struct mdp_prop *prop = (struct mdp_prop *)arg;

	struct mdp_instance *inst = prop->inst;

	if (!prop || !inst) {

	struct mdp_instance *inst;

	if (!prop || !prop->inst) {

		WFD_MSG_ERR("Invalid arguments\n");

		return -EINVAL;

	}

	inst = prop->inst;

	inst->height = prop->height;

	inst->width = prop->width;

	return 0;

drivers/media/platform/msm/wfd/vsg-subdev.c

+13 −3
Original line number Diff line number Diff line
@@ -135,6 +135,9 @@ static void vsg_work_func(struct work_struct *task) 
	}



	encode_work = kmalloc(sizeof(*encode_work), GFP_KERNEL);

	if (!encode_work)

		goto err_skip_encode;



	encode_work->buf = buf_info;

	encode_work->context = context;

	INIT_WORK(&encode_work->work, vsg_encode_helper_func);
@@ -298,6 +301,11 @@ static int vsg_open(struct v4l2_subdev *sd, void *arg) 
		return -EINVAL;



	context = kzalloc(sizeof(*context), GFP_KERNEL);

	if (!context) {

		WFD_MSG_ERR("ERROR, failed to allocate context %s\n", __func__);

		return -ENOMEM;

	}



	INIT_LIST_HEAD(&context->free_queue.node);

	INIT_LIST_HEAD(&context->busy_queue.node);
@@ -477,10 +485,12 @@ static long vsg_queue_buffer(struct v4l2_subdev *sd, void *arg) 
		struct vsg_work *new_work =

			kzalloc(sizeof(*new_work), GFP_KERNEL);



		if (new_work) {

			INIT_WORK(&new_work->work, vsg_work_func);

			new_work->context = context;

			queue_work(context->work_queue, &new_work->work);

		}

	}



	mutex_unlock(&context->mutex);

queue_err_bad_param:

drivers/media/platform/msm/wfd/wfd-ioctl.c

+21 −0
Original line number Diff line number Diff line
@@ -294,6 +294,11 @@ static int wfd_allocate_input_buffers(struct wfd_device *wfd_dev, 
		mpair = kzalloc(sizeof(*mpair), GFP_KERNEL);

		enc_mregion = kzalloc(sizeof(*enc_mregion), GFP_KERNEL);

		mdp_mregion = kzalloc(sizeof(*enc_mregion), GFP_KERNEL);

		if (!mpair || !enc_mregion || !mdp_mregion) {

			WFD_MSG_ERR("%s: failed to alloc memory\n", __func__);

			goto alloc_fail;

		}



		enc_mregion->size = ALIGN(inst->input_buf_size, SZ_4K);



		rc = wfd_allocate_ion_buffer(wfd_dev->ion_client,
@@ -543,6 +548,12 @@ static int wfd_vidbuf_buf_init(struct vb2_buffer *vb) 
		(struct wfd_device *)video_drvdata(priv_data);

	struct mem_info *minfo = vb2_plane_cookie(vb, 0);

	struct mem_region mregion;



	if (!minfo || !inst) {

		WFD_MSG_ERR("%s: invalid arguments\n", __func__);

		return -EINVAL;

	}



	mregion.fd = minfo->fd;

	mregion.offset = minfo->offset;

	mregion.cookie = (u32)vb;
@@ -755,6 +766,12 @@ static void wfd_vidbuf_buf_queue(struct vb2_buffer *vb) 
	struct wfd_inst *inst = file_to_inst(priv_data);

	struct mem_region mregion;

	struct mem_info *minfo = vb2_plane_cookie(vb, 0);



	if (!minfo) {

		WFD_MSG_ERR("%s: invalid minfo\n", __func__);

		return;

	}



	mregion.fd = minfo->fd;

	mregion.offset = minfo->offset;

	mregion.cookie = (u32)vb;
@@ -933,6 +950,10 @@ static int wfd_register_out_buf(struct wfd_inst *inst, 
	if (!minfo) {

		minfo_entry = kzalloc(sizeof(struct mem_info_entry),

				GFP_KERNEL);

		if (!minfo_entry) {

			WFD_MSG_ERR("%s: failed to allocate mem\n", __func__);

			return -EINVAL;

		}

		if (copy_from_user(&minfo_entry->minfo, (void *)b->reserved,

					sizeof(struct mem_info))) {

			WFD_MSG_ERR(" copy_from_user failed. Populate"