Merge "msm: mdss: Fix memleak in framebuffer register and remove" (dceddf23) · Commits · e / devices / android_kernel_sony_msm8998

drivers/video/fbdev/msm/mdss_debug.c

+22 −10

Original line number	Diff line number	Diff line
		@@ -39,6 +39,9 @@
		#define PANEL_CMD_MIN_TX_COUNT 2
		#define PANEL_DATA_NODE_LEN 80

		/* Hex number + whitespace */
		#define NEXT_VALUE_OFFSET 3

		#define INVALID_XIN_ID 0xFF

		static char panel_reg[2] = {DEFAULT_READ_PANEL_POWER_MODE_REG, 0x00};
		@@ -81,7 +84,7 @@ static ssize_t panel_debug_base_offset_write(struct file *file,

		buf[count] = 0; /* end of string */

		if (sscanf(buf, "%x %d", &off, &cnt) != 2)
		if (sscanf(buf, "%x %u", &off, &cnt) != 2)
		return -EFAULT;

		if (off > dbg->max_offset)
		@@ -129,7 +132,7 @@ static ssize_t panel_debug_base_reg_write(struct file *file,
		struct mdss_debug_base *dbg = file->private_data;
		char buf[PANEL_TX_MAX_BUF] = {0x0};
		char reg[PANEL_TX_MAX_BUF] = {0x0};
		u32 len = 0, step = 0, value = 0;
		u32 len = 0, value = 0;
		char *bufp;

		struct mdss_data_type *mdata = mdss_res;
		@@ -152,13 +155,21 @@ static ssize_t panel_debug_base_reg_write(struct file *file,
		buf[count] = 0; /* end of string */

		bufp = buf;
		while (sscanf(bufp, "%x%n", &value, &step) > 0) {
		/* End of a hex value in given string */
		bufp[NEXT_VALUE_OFFSET - 1] = 0;
		while (kstrtouint(bufp, 16, &value) == 0) {
		reg[len++] = value;
		if (len >= PANEL_TX_MAX_BUF) {
		pr_err("wrong input reg len\n");
		return -EFAULT;
		}
		bufp += step;
		bufp += NEXT_VALUE_OFFSET;
		if ((bufp >= (buf + count)) \|\| (bufp < buf)) {
		pr_warn("%s,buffer out-of-bounds\n", __func__);
		break;
		}
		/* End of a hex value in given string */
		bufp[NEXT_VALUE_OFFSET - 1] = 0;
		}
		if (len < PANEL_CMD_MIN_TX_COUNT) {
		pr_err("wrong input reg len\n");
		@@ -203,6 +214,7 @@ static ssize_t panel_debug_base_reg_read(struct file *file,
		struct mdss_panel_data *panel_data = ctl->panel_data;
		struct mdss_dsi_ctrl_pdata *ctrl_pdata = container_of(panel_data,
		struct mdss_dsi_ctrl_pdata, panel_data);
		int rc = -EFAULT;

		if (!dbg)
		return -ENODEV;
		@@ -221,7 +233,8 @@ static ssize_t panel_debug_base_reg_read(struct file *file,

		if (!rx_buf \|\| !panel_reg_buf) {
		pr_err("not enough memory to hold panel reg dump\n");
		return -ENOMEM;
		rc = -ENOMEM;
		goto read_reg_fail;
		}

		if (mdata->debug_inf.debug_enable_clock)
		@@ -260,8 +273,7 @@ static ssize_t panel_debug_base_reg_read(struct file *file,
		read_reg_fail:
		kfree(rx_buf);
		kfree(panel_reg_buf);
		return -EFAULT;

		return rc;
		}

		static const struct file_operations panel_off_fops = {
		@@ -739,11 +751,11 @@ static ssize_t mdss_debug_factor_write(struct file *file,

		if (strnchr(buf, count, '/')) {
		/* Parsing buf as fraction */
		if (sscanf(buf, "%d/%d", &numer, &denom) != 2)
		if (sscanf(buf, "%u/%u", &numer, &denom) != 2)
		return -EFAULT;
		} else {
		/* Parsing buf as percentage */
		if (sscanf(buf, "%d", &numer) != 1)
		if (kstrtouint(buf, 0, &numer))
		return -EFAULT;
		denom = 100;
		}
		@@ -1051,7 +1063,7 @@ static ssize_t mdss_debug_perf_bw_limit_write(struct file *file,

		if (strnchr(buf, count, ' ')) {
		/* Parsing buf */
		if (sscanf(buf, "%d %d", &mode, &val) != 2)
		if (sscanf(buf, "%u %u", &mode, &val) != 2)
		return -EFAULT;
		}

drivers/video/fbdev/msm/mdss_dsi.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -995,6 +995,7 @@ static void mdss_dsi_debugfs_cleanup(struct mdss_dsi_ctrl_pdata *ctrl_pdata)
		struct mdss_dsi_debugfs_info *dfs = ctrl->debugfs_info;
		if (dfs && dfs->root)
		debugfs_remove_recursive(dfs->root);
		kfree(dfs);
		pdata = pdata->next;
		} while (pdata);
		pr_debug("%s: Cleaned up mdss_dsi_debugfs_info\n", __func__);

drivers/video/fbdev/msm/mdss_fb.c

+5 −4

Original line number	Diff line number	Diff line
		@@ -615,8 +615,8 @@ static ssize_t mdss_fb_force_panel_dead(struct device *dev,
		return len;
		}

		if (sscanf(buf, "%d", &pdata->panel_info.panel_force_dead) != 1)
		pr_err("sccanf buf error!\n");
		if (kstrtouint(buf, 0, &pdata->panel_info.panel_force_dead))
		pr_err("kstrtouint buf error!\n");

		return len;
		}
		@@ -729,8 +729,8 @@ static ssize_t mdss_fb_change_dfps_mode(struct device *dev,
		}
		pinfo = &pdata->panel_info;

		if (sscanf(buf, "%d", &dfps_mode) != 1) {
		pr_err("sccanf buf error!\n");
		if (kstrtouint(buf, 0, &dfps_mode)) {
		pr_err("kstrtouint buf error!\n");
		return len;
		}

		@@ -1280,6 +1280,7 @@ static int mdss_fb_remove(struct platform_device *pdev)
		return -EINVAL;

		mdss_fb_unregister_input_handler(mfd);
		mdss_panel_debugfs_cleanup(mfd->panel_info);

		if (mdss_fb_suspend_sub(mfd))
		pr_err("msm_fb_remove: can't stop the device %d\n",

drivers/video/fbdev/msm/mdss_mdp.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2605,7 +2605,7 @@ static ssize_t mdss_mdp_store_max_limit_bw(struct device *dev,
		struct mdss_data_type *mdata = dev_get_drvdata(dev);
		u32 data = 0;

		if (1 != sscanf(buf, "%d", &data)) {
		if (kstrtouint(buf, 0, &data)) {
		pr_info("Not able scan to bw_mode_bitmap\n");
		} else {
		mdata->bw_mode_bitmap = data;

drivers/video/fbdev/msm/mdss_mdp_overlay.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2958,7 +2958,7 @@ static ssize_t dynamic_fps_sysfs_wta_dfps(struct device *dev,

		if (pdata->panel_info.dfps_update ==
		DFPS_IMMEDIATE_MULTI_UPDATE_MODE_CLK_HFP) {
		if (sscanf(buf, "%d %d %d %d %d",
		if (sscanf(buf, "%u %u %u %u %u",
		&data.hfp, &data.hbp, &data.hpw,
		&data.clk_rate, &data.fps) != 5) {
		pr_err("could not read input\n");