Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 39e5c155 authored by raghavendra ambadas's avatar raghavendra ambadas Committed by Gerrit - the friendly Code Review server
Browse files

msm: mdss: Fix NULL pointer dereferences 



Fix potential Null pointer dereference while
reading panel register in mdp3 driver.

Change-Id: I09f35b9b86f2365f8f9e02460e2cdeeb60c7f399
CRs-Fixed: 959057
Signed-off-by: default avatarRaghavendra Ambadas <rambad@codeaurora.org>
parent 3c8f3ec8

drivers/video/msm/mdss/mdp3.c

+2 −0
Original line number Diff line number Diff line
@@ -2318,6 +2318,7 @@ static int mdp3_panel_register_done(struct mdss_panel_data *pdata) 
	if (pdata->panel_info.cont_splash_enabled == false)

		mdp3_res->allow_iommu_update = true;



	mdss_res->pdata = pdata;

	return rc;

}
@@ -2403,6 +2404,7 @@ static int mdp3_debug_init(struct platform_device *pdev) 
	mdss_res->mdss_util = mdp3_res->mdss_util;



	mdata->debug_inf.debug_enable_clock = mdp3_debug_enable_clock;

	mdata->mdp_rev = mdp3_res->mdp_rev;



	rc = mdss_debugfs_init(mdata);

	if (rc)

drivers/video/msm/mdss/mdss.h

+1 −0
Original line number Diff line number Diff line
@@ -278,6 +278,7 @@ struct mdss_data_type { 
	bool en_svs_high;

	u32 max_mdp_clk_rate;

	struct mdss_util_intf *mdss_util;

	struct mdss_panel_data *pdata;



	struct platform_device *pdev;

	struct dss_io_data mdss_io;

drivers/video/msm/mdss/mdss_debug.c

+28 −7
Original line number Diff line number Diff line
@@ -38,6 +38,8 @@ 
#define PANEL_TX_MAX_BUF 256

#define PANEL_CMD_MIN_TX_COUNT 2

#define PANEL_DATA_NODE_LEN 80

/* MDP3 HW Version */

#define MDP_CORE_HW_VERSION 0x03050306



/* Hex number + whitespace */

#define NEXT_VALUE_OFFSET 3
@@ -148,8 +150,10 @@ static ssize_t panel_debug_base_reg_write(struct file *file, 
	char *bufp;



	struct mdss_data_type *mdata = mdss_res;

	struct mdss_mdp_ctl *ctl;

	struct mdss_dsi_ctrl_pdata *ctrl_pdata;

	struct mdss_mdp_ctl *ctl = mdata->ctl_off + 0;

	struct mdss_panel_data *panel_data = NULL;

	struct mdss_dsi_ctrl_pdata *ctrl_pdata = NULL;



	struct dsi_cmd_desc dsi_write_cmd = {

		{0/*data type*/, 1, 0, 0, 0, 0/* len */}, reg};

	struct dcs_cmd_req cmdreq;
@@ -164,6 +168,15 @@ static ssize_t panel_debug_base_reg_write(struct file *file, 
	if (copy_from_user(buf, user_buf, count))

		return -EFAULT;



	if ((mdata->mdp_rev <= MDSS_MDP_HW_REV_105) ||

			(mdata->mdp_rev == MDP_CORE_HW_VERSION))

		panel_data = mdss_res->pdata;

	else

		panel_data = ctl->panel_data;



	ctrl_pdata = container_of(panel_data,

		struct mdss_dsi_ctrl_pdata, panel_data);



	buf[count] = 0;	/* end of string */



	bufp = buf;
@@ -224,9 +237,8 @@ static ssize_t panel_debug_base_reg_read(struct file *file, 
	char *panel_reg_buf, *rx_buf;

	struct mdss_data_type *mdata = mdss_res;

	struct mdss_mdp_ctl *ctl = mdata->ctl_off + 0;

	struct mdss_panel_data *panel_data = ctl->panel_data;

	struct mdss_dsi_ctrl_pdata *ctrl_pdata = container_of(panel_data,

					struct mdss_dsi_ctrl_pdata, panel_data);

	struct mdss_panel_data *panel_data = NULL;

	struct mdss_dsi_ctrl_pdata *ctrl_pdata = NULL;

	int rc = -EFAULT;



	if (!dbg)
@@ -259,8 +271,17 @@ static ssize_t panel_debug_base_reg_read(struct file *file, 
		mdata->debug_inf.debug_enable_clock(1);



	panel_reg[0] = dbg->off;

	mdss_dsi_panel_cmd_read(ctrl_pdata, panel_reg[0], panel_reg[1],

				NULL, rx_buf, dbg->cnt);

	if ((mdata->mdp_rev <= MDSS_MDP_HW_REV_105) ||

			(mdata->mdp_rev == MDP_CORE_HW_VERSION))

		panel_data = mdss_res->pdata;

	else

		panel_data = ctl->panel_data;



	ctrl_pdata = container_of(panel_data,

			struct mdss_dsi_ctrl_pdata, panel_data);



	mdss_dsi_panel_cmd_read(ctrl_pdata, panel_reg[0],

		panel_reg[1], NULL, rx_buf, dbg->cnt);



	len = scnprintf(panel_reg_buf, reg_buf_len, "0x%02zx: ", dbg->off);