Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 35bfa1e5 authored by Ingrid Gallardo's avatar Ingrid Gallardo Committed by Gerrit - the friendly Code Review server
Browse files

msm: mdss: fix crash when wrong params are passed on the esd config 



If wrong parameters are set on the dtsi to configure the
esd, a null pointer access can happen. Fix this to make
sure we check for valid pointers and otherwise just
throw an error, but not access an invalid pointer.

Change-Id: I3df0889c1225dcb613910cb90f050a2994f5834d
Signed-off-by: default avatarIngrid Gallardo <ingridg@codeaurora.org>
parent df94b216

drivers/video/fbdev/msm/mdss_dsi_host.c

+5 −0
Original line number Diff line number Diff line
@@ -1108,6 +1108,11 @@ static int mdss_dsi_read_status(struct mdss_dsi_ctrl_pdata *ctrl) 
	rc = 1;

	lenp = ctrl->status_valid_params ?: ctrl->status_cmds_rlen;



	if (!lenp || !ctrl->status_cmds_rlen) {

		pr_err("invalid dsi read params!\n");

		return 0;

	}



	for (i = 0; i < ctrl->status_cmds.cmd_cnt; ++i) {

		memset(&cmdreq, 0, sizeof(cmdreq));

		cmdreq.cmds = ctrl->status_cmds.cmds + i;

drivers/video/fbdev/msm/mdss_dsi_panel.c

+11 −1
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 


#include "mdss_dsi.h"

#include "mdss_dba_utils.h"

#include "mdss_debug.h"



#define DT_CMD_HDR 6

#define DEFAULT_MDP_TRANSFER_TIME 14000
@@ -1451,7 +1452,7 @@ static int mdss_dsi_parse_reset_seq(struct device_node *np, 


static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl)

{

	int i, j;

	int i, j = 0;

	int len = 0, *lenp;

	int group = 0;
@@ -1460,6 +1461,15 @@ static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl) 
	for (i = 0; i < ctrl->status_cmds.cmd_cnt; i++)

		len += lenp[i];



	for (i = 0; i < len; i++) {

		pr_debug("[%i] return:0x%x status:0x%x\n",

			i, (unsigned int)ctrl->return_buf[i],

			(unsigned int)ctrl->status_value[j + i]);

		MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i],

			ctrl->status_value[j + i]);

		j += len;

	}



	for (j = 0; j < ctrl->groups; ++j) {

		for (i = 0; i < len; ++i) {

			if (ctrl->return_buf[i] !=