diff options
| author | Krishna Manikandan <mkrishn@codeaurora.org> | 2016-12-02 11:34:13 +0530 |
|---|---|---|
| committer | Krishna Manikandan <mkrishn@codeaurora.org> | 2016-12-02 15:51:43 +0530 |
| commit | 15bc0fa660e9951e6eb5a5e272c01bc91ad29fb8 (patch) | |
| tree | 0a179206542890a7792f0cede612f19b2afd08d9 | |
| parent | c2cbb11bf972db542cbd637ea4c4215b82aa1df5 (diff) | |
msm: mdss: Fix out of bound access of array indexes
Add checks before accessing the array to fix potential
issues such as array index out of bounds error.
Change-Id: I42d0f8e72f8848de6ca2f143f115f39256144ec0
Signed-off-by: Krishna Manikandan <mkrishn@codeaurora.org>
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_hdmi_tx.c | 6 | ||||
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_mdp_pipe.c | 23 |
2 files changed, 16 insertions, 13 deletions
diff --git a/drivers/video/fbdev/msm/mdss_hdmi_tx.c b/drivers/video/fbdev/msm/mdss_hdmi_tx.c index e9ae30bb6914..92d2ffdd41cd 100644 --- a/drivers/video/fbdev/msm/mdss_hdmi_tx.c +++ b/drivers/video/fbdev/msm/mdss_hdmi_tx.c @@ -64,8 +64,10 @@ #define HDMI_TX_3_MAX_PCLK_RATE 297000 #define HDMI_TX_4_MAX_PCLK_RATE 600000 -#define hdmi_tx_get_fd(x) (x ? hdmi_ctrl->feature_data[ffs(x) - 1] : 0) -#define hdmi_tx_set_fd(x, y) {if (x) hdmi_ctrl->feature_data[ffs(x) - 1] = y; } +#define hdmi_tx_get_fd(x) ((x && (ffs(x) > 0)) ? \ + hdmi_ctrl->feature_data[ffs(x) - 1] : 0) +#define hdmi_tx_set_fd(x, y) {if (x && (ffs(x) > 0)) \ + hdmi_ctrl->feature_data[ffs(x) - 1] = y; } #define MAX_EDID_READ_RETRY 5 diff --git a/drivers/video/fbdev/msm/mdss_mdp_pipe.c b/drivers/video/fbdev/msm/mdss_mdp_pipe.c index 94e64dd396d5..6241c89493f4 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_pipe.c +++ b/drivers/video/fbdev/msm/mdss_mdp_pipe.c @@ -933,17 +933,18 @@ int mdss_mdp_smp_handoff(struct mdss_data_type *mdata) data = readl_relaxed(mdata->mdp_base + MDSS_MDP_REG_SMP_ALLOC_W0 + off); client_id = (data >> s) & 0xFF; - if (test_bit(i, mdata->mmb_alloc_map)) { - /* - * Certain pipes may have a dedicated set of - * SMP MMBs statically allocated to them. In - * such cases, we do not need to do anything - * here. - */ - pr_debug("smp mmb %d already assigned to pipe %d (client_id %d)\n" - , i, pipe ? pipe->num : -1, client_id); - continue; - } + if (i < ARRAY_SIZE(mdata->mmb_alloc_map)) + if (test_bit(i, mdata->mmb_alloc_map)) { + /* + * Certain pipes may have a dedicated set of + * SMP MMBs statically allocated to them. In + * such cases, we do not need to do anything + * here. + */ + pr_debug("smp mmb %d already assigned to pipe %d (client_id %d)\n" + , i, pipe ? pipe->num : -1, client_id); + continue; + } if (client_id) { if (client_id != prev_id) { |