Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0e2ee067 authored by Krishna Manikandan's avatar Krishna Manikandan
Browse files

msm: mdss: Fix null pointer dereference and unintialisation of variables 



Add NULL checks before accessing potential null pointers. Also, fix
uninitialised variables in MDP driver as they can be accessed with
incorrect values.

Change-Id: Id8a551fd3bc147c800ee1c98c2bc2b6f3bf6d380
Signed-off-by: default avatarKrishna Manikandan <mkrishn@codeaurora.org>
parent b832093b

drivers/video/fbdev/msm/mdss_dsi_host.c

+1 −1
Original line number Diff line number Diff line
@@ -2142,7 +2142,7 @@ static int mdss_dsi_cmd_dma_rx(struct mdss_dsi_ctrl_pdata *ctrl, 
	u32 *lp, *temp, data;

	int i, j = 0, off, cnt;

	bool ack_error = false;

	char reg[16];

	char reg[16] = {0x0};

	int repeated_bytes = 0;



	lp = (u32 *)rp->data;

drivers/video/fbdev/msm/mdss_hdmi_hdcp2p2.c

+2 −2
Original line number Diff line number Diff line
@@ -666,7 +666,7 @@ static void hdmi_hdcp2p2_link_cb(void *data) 


static void hdmi_hdcp2p2_recv_msg(struct hdmi_hdcp2p2_ctrl *ctrl)

{

	int rc = 0, timeout_hsync;

	int timeout_hsync = 0, rc = 0;

	char *recvd_msg_buf = NULL;

	struct hdmi_tx_hdcp2p2_ddc_data *ddc_data;

	struct hdmi_tx_ddc_ctrl *ddc_ctrl;
@@ -1079,7 +1079,7 @@ error: 


static bool hdmi_hdcp2p2_supported(struct hdmi_hdcp2p2_ctrl *ctrl)

{

	u8 hdcp2version;

	u8 hdcp2version = 0;



	int rc = hdmi_hdcp2p2_read_version(ctrl, &hdcp2version);

	if (rc)

drivers/video/fbdev/msm/mdss_mdp.c

+4 −2
Original line number Diff line number Diff line
@@ -823,7 +823,7 @@ void mdss_mdp_irq_clear(struct mdss_data_type *mdata, 


int mdss_mdp_irq_enable(u32 intr_type, u32 intf_num)

{

	int irq_idx, idx;

	int irq_idx = 0;

	unsigned long irq_flags;

	int ret = 0;

	struct mdss_data_type *mdata = mdss_mdp_get_mdata();
@@ -842,7 +842,7 @@ int mdss_mdp_irq_enable(u32 intr_type, u32 intf_num) 
	spin_lock_irqsave(&mdp_lock, irq_flags);

	if (mdata->mdp_irq_mask[irq.reg_idx] & irq.irq_mask) {

		pr_warn("MDSS MDP IRQ-0x%x is already set, mask=%x\n",

				irq.irq_mask, mdata->mdp_irq_mask[idx]);

				irq.irq_mask, mdata->mdp_irq_mask[irq.reg_idx]);

		ret = -EBUSY;

	} else {

		pr_debug("MDP IRQ mask old=%x new=%x\n",
@@ -2433,6 +2433,8 @@ static void __update_sspp_info(struct mdss_mdp_pipe *pipe, 
	size_t len = PAGE_SIZE;

	int num_bytes = BITS_TO_BYTES(MDP_IMGTYPE_LIMIT1);



	if (!pipe)

		return;

#define SPRINT(fmt, ...) \

		(*cnt += scnprintf(buf + *cnt, len - *cnt, fmt, ##__VA_ARGS__))

drivers/video/fbdev/msm/mdss_mdp_layer.c

+10 −4
Original line number Diff line number Diff line
@@ -855,12 +855,18 @@ static int __validate_layer_reconfig(struct mdp_input_layer *layer, 
	 */

	if (pipe->csc_coeff_set != layer->color_space) {

		src_fmt = mdss_mdp_get_format_params(layer->buffer.format);

		if (pipe->src_fmt->is_yuv && src_fmt && src_fmt->is_yuv) {

		if (!src_fmt) {

			pr_err("Invalid layer format %d\n",

						layer->buffer.format);

			status = -EINVAL;

		} else {

			if (pipe->src_fmt->is_yuv && src_fmt &&

							src_fmt->is_yuv) {

				status = -EPERM;

				pr_err("csc change is not permitted on used pipe\n");

			}

		}



	}

	return status;

}

drivers/video/fbdev/msm/mdss_mdp_pp.c

+3 −2
Original line number Diff line number Diff line
@@ -2461,7 +2461,7 @@ static int pp_dspp_setup(u32 disp_num, struct mdss_mdp_mixer *mixer) 
	}



	if (flags & PP_FLAGS_DIRTY_DITHER) {

		if (!pp_ops[DITHER].pp_set_config) {

		if (!pp_ops[DITHER].pp_set_config && addr) {

			pp_dither_config(addr, pp_sts,

				&mdss_pp_res->dither_disp_cfg[disp_num]);

		} else {
@@ -5308,6 +5308,7 @@ static int pp_hist_collect(struct mdp_histogram_data *hist, 
		else if (block == SSPP_VIG)

			v_base = ctl_base +

				MDSS_MDP_REG_VIG_HIST_CTL_BASE;

		if (v_base)

			sum = pp_hist_read(v_base, hist_info);

	}

	writel_relaxed(0, hist_info->base);