Merge "msm: mdss: Check null-pointer dereferencing and buffer overflows" (ca6129fc) · Commits · e / devices / android_kernel_sony_msm8994

drivers/video/msm/mdss/dsi_v2.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -304,7 +304,7 @@ static int dsi_parse_vreg(struct device dev, struct dss_module_power mp)
		if (!dev \|\| !mp) {
		pr_err("%s: invalid input\n", __func__);
		rc = -EINVAL;
		goto error;
		return rc;
		}

		np = dev->of_node;

drivers/video/msm/mdss/mdp3.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2262,7 +2262,7 @@ int mdp3_panel_get_boot_cfg(void)

		if (!mdp3_res \|\| !mdp3_res->pan_cfg.init_done)
		rc = -EPROBE_DEFER;
		if (mdp3_res->pan_cfg.lk_cfg)
		else if (mdp3_res->pan_cfg.lk_cfg)
		rc = 1;
		else
		rc = 0;

drivers/video/msm/mdss/mdp3_ctrl.c

+7 −4

Original line number	Diff line number	Diff line
		@@ -50,7 +50,7 @@ static void mdp3_bufq_deinit(struct mdp3_buffer_queue *bufq)
		if (!count)
		return;

		while (count--) {
		while (count-- && (bufq->pop_idx >= 0)) {
		struct mdp3_img_data *data = &bufq->img_data[bufq->pop_idx];
		bufq->pop_idx = (bufq->pop_idx + 1) % MDP3_MAX_BUF_QUEUE;
		mdp3_put_img(data, MDP3_CLIENT_DMA_P);
		@@ -937,7 +937,7 @@ static int mdp3_ctrl_display_commit_kickoff(struct msm_fb_data_type *mfd,
		{
		struct mdp3_session_data *mdp3_session;
		struct mdp3_img_data *data;
		struct mdss_panel_info *panel_info = mfd->panel_info;
		struct mdss_panel_info *panel_info;
		int rc = 0;
		bool reset_done = false;
		struct mdss_panel_data *panel;
		@@ -945,6 +945,7 @@ static int mdp3_ctrl_display_commit_kickoff(struct msm_fb_data_type *mfd,
		if (!mfd \|\| !mfd->mdp.private1)
		return -EINVAL;

		panel_info = mfd->panel_info;
		mdp3_session = mfd->mdp.private1;
		if (!mdp3_session \|\| !mdp3_session->dma)
		return -EINVAL;
		@@ -982,6 +983,7 @@ static int mdp3_ctrl_display_commit_kickoff(struct msm_fb_data_type *mfd,

		if (mdp3_bufq_count(&mdp3_session->bufq_out) > 2) {
		data = mdp3_bufq_pop(&mdp3_session->bufq_out);
		if (data)
		mdp3_put_img(data, MDP3_CLIENT_DMA_P);
		}

		@@ -1008,12 +1010,13 @@ static void mdp3_ctrl_pan_display(struct msm_fb_data_type *mfd)
		struct mdp3_session_data *mdp3_session;
		u32 offset;
		int bpp;
		struct mdss_panel_info *panel_info = mfd->panel_info;
		struct mdss_panel_info *panel_info;

		pr_debug("mdp3_ctrl_pan_display\n");
		if (!mfd \|\| !mfd->mdp.private1)
		return;

		panel_info = mfd->panel_info;
		mdp3_session = (struct mdp3_session_data *)mfd->mdp.private1;
		if (!mdp3_session \|\| !mdp3_session->dma)
		return;

drivers/video/msm/mdss/mdss_dsi.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -118,7 +118,7 @@ static int mdss_dsi_get_dt_vreg_data(struct device *dev,
		if (!dev \|\| !mp) {
		pr_err("%s: invalid input\n", __func__);
		rc = -EINVAL;
		goto error;
		return rc;
		}

		of_node = dev->of_node;

drivers/video/msm/mdss/mdss_dsi_host.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -1419,9 +1419,11 @@ irqreturn_t mdss_dsi_isr(int irq, void *ptr)
		struct mdss_dsi_ctrl_pdata *ctrl =
		(struct mdss_dsi_ctrl_pdata *)ptr;

		if (!ctrl->ctrl_base)
		if (!ctrl->ctrl_base) {
		pr_err("%s:%d DSI base adr no Initialized",
		__func__, __LINE__);
		return IRQ_HANDLED;
		}

		isr = MIPI_INP(ctrl->ctrl_base + 0x0110);/* DSI_INTR_CTRL */
		MIPI_OUTP(ctrl->ctrl_base + 0x0110, isr);