Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f8a58931 authored by Jayant Shekhar's avatar Jayant Shekhar Committed by Sandeep Panda
Browse files

msm: mdss: fix NULL pointer dereferencing issues 



This change fixes the errors reported in static analysis
of MDSS driver code. These changes include fix for various
potential NULL pointer dereferencing and array index out of
bounds issues in MDP, DSI and PP module of MDSS driver.

Change-Id: I49f65f0b4e5218f9fc90469e9d431a3aec811ee2
Signed-off-by: default avatarJayant Shekhar <jshekhar@codeaurora.org>
Signed-off-by: default avatarSandeep Panda <spanda@codeaurora.org>
parent 642ad5a9

drivers/video/msm/mdss/mdss_dsi.c

+13 −4
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -915,9 +915,16 @@ static int mdss_dsi_debugfs_setup(struct mdss_panel_data *pdata, 
static int mdss_dsi_debugfs_init(struct mdss_dsi_ctrl_pdata *ctrl_pdata)

{

	int rc;

	struct mdss_panel_data *pdata = &ctrl_pdata->panel_data;

	struct mdss_panel_info panel_info = pdata->panel_info;

	struct mdss_panel_data *pdata;

	struct mdss_panel_info panel_info;



	if (!ctrl_pdata) {

		pr_warn_once("%s: Invalid pdata!\n", __func__);

		return -EINVAL;

	}



	pdata = &ctrl_pdata->panel_data;

	panel_info = pdata->panel_info;

	rc = mdss_dsi_debugfs_setup(pdata, panel_info.debugfs_info->root);

	if (rc) {

		pr_err("%s: Error in initilizing dsi ctrl debugfs\n",
@@ -2657,6 +2664,8 @@ static struct device_node *mdss_dsi_find_panel_of_node( 
					for (i = 0; ((str2 + i) < str1) &&

					     i < MDSS_MAX_PANEL_LEN; i++)

						cfg_np_name[i] = *(str2 + i);

					if ((i >= 0)

						&& (i < MDSS_MAX_PANEL_LEN))

						cfg_np_name[i] = 0;

				} else {

					strlcpy(cfg_np_name, str2,

drivers/video/msm/mdss/mdss_dsi_clk.c

+4 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -334,6 +334,9 @@ static int dsi_update_clk_state(struct dsi_core_clks *c_clks, u32 c_state, 
		mngr = NULL;

	}



	if (!mngr)

		return -EINVAL;



	pr_debug("%s: c_state = %d, l_state = %d\n", mngr ? mngr->name : "NA",

		 c_clks ? c_state : -1, l_clks ? l_state : -1);

	/*

drivers/video/msm/mdss/mdss_mdp_ctl.c

+15 −9
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -2987,9 +2987,11 @@ void mdss_mdp_ctl_dsc_setup(struct mdss_mdp_ctl *ctl, 
		break;

	case MDP_DUAL_LM_DUAL_DISPLAY:

		sctl = mdss_mdp_get_split_ctl(ctl);

		if (sctl) {

			spinfo = &sctl->panel_data->panel_info;



		__dsc_setup_dual_lm_dual_display(ctl, pinfo, sctl, spinfo);

			__dsc_setup_dual_lm_dual_display(ctl, pinfo, sctl,

					spinfo);

		}

		break;

	default:

		/* pp_split is not supported yet */
@@ -3996,9 +3998,11 @@ void mdss_mdp_set_roi(struct mdss_mdp_ctl *ctl, 
	if (ctl->mfd->split_mode == MDP_DUAL_LM_DUAL_DISPLAY) {

		struct mdss_mdp_ctl *sctl = mdss_mdp_get_split_ctl(ctl);



		if (sctl) {

			mdss_mdp_set_mixer_roi(sctl->mixer_left, r_roi);

			sctl->roi = sctl->mixer_left->roi;

	} else if (is_dual_lm_single_display(ctl->mfd)) {

		}

	} else if (is_dual_lm_single_display(ctl->mfd) && ctl->mixer_right) {



		mdss_mdp_set_mixer_roi(ctl->mixer_right, r_roi);
@@ -4021,7 +4025,9 @@ void mdss_mdp_set_roi(struct mdss_mdp_ctl *ctl, 
	 */

	if (is_split_lm(ctl->mfd) && mdata->has_src_split &&

	    (previous_frame_pu_type != current_frame_pu_type)) {

		if (ctl->mixer_left)

			ctl->mixer_left->roi_changed = true;

		if (ctl->mixer_right)

			ctl->mixer_right->roi_changed = true;

	}

}

drivers/video/msm/mdss/mdss_mdp_pp.c

+4 −3
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.

 * Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -2071,7 +2071,7 @@ error: 


int mdss_mdp_pp_setup_locked(struct mdss_mdp_ctl *ctl)

{

	struct mdss_data_type *mdata = ctl->mdata;

	struct mdss_data_type *mdata;

	int ret = 0, i;

	u32 flags, pa_v2_flags;

	u32 max_bw_needed;
@@ -2080,9 +2080,10 @@ int mdss_mdp_pp_setup_locked(struct mdss_mdp_ctl *ctl) 
	u32 disp_num;

	bool valid_mixers = true;

	bool valid_ad_panel = true;

	if ((!ctl) || (!ctl->mfd) || (!mdss_pp_res) || (!mdata))

	if ((!ctl) || (!ctl->mfd) || (!mdss_pp_res) || (!ctl->mdata))

		return -EINVAL;



	mdata = ctl->mdata;

	/* treat fb_num the same as block logical id*/

	disp_num = ctl->mfd->index;

drivers/video/msm/mdss/mdss_mdp_wfd.c

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -301,7 +301,7 @@ static int mdss_mdp_wfd_validate_out_configuration(struct mdss_mdp_wfd *wfd, 


	if (mdss_mdp_is_wb_mdp_intf(wb_idx, ctl->num)) {

		fmt = mdss_mdp_get_format_params(layer->buffer.format);

		if (!(fmt->flag & VALID_MDP_WB_INTF_FORMAT)) {

		if (fmt && !(fmt->flag & VALID_MDP_WB_INTF_FORMAT)) {

			pr_err("wb=%d does not support dst fmt:%d\n", wb_idx,

				layer->buffer.format);

			return -EINVAL;