diff options
| author | Ingrid Gallardo <ingridg@codeaurora.org> | 2016-10-12 18:38:48 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-10-17 10:37:35 -0700 |
| commit | 35bfa1e56a3063e9e23fec18d5f700a4bdcddb31 (patch) | |
| tree | 2bffb5db94c10893900b64b15b8f01cd5462a0f4 /drivers/video | |
| parent | df94b216e12c0d6d6431e42c407efd243a790a65 (diff) | |
msm: mdss: fix crash when wrong params are passed on the esd config
If wrong parameters are set on the dtsi to configure the
esd, a null pointer access can happen. Fix this to make
sure we check for valid pointers and otherwise just
throw an error, but not access an invalid pointer.
Change-Id: I3df0889c1225dcb613910cb90f050a2994f5834d
Signed-off-by: Ingrid Gallardo <ingridg@codeaurora.org>
Diffstat (limited to 'drivers/video')
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_dsi_host.c | 5 | ||||
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_dsi_panel.c | 12 |
2 files changed, 16 insertions, 1 deletions
diff --git a/drivers/video/fbdev/msm/mdss_dsi_host.c b/drivers/video/fbdev/msm/mdss_dsi_host.c index 18bcdca31bf6..c9168242da60 100644 --- a/drivers/video/fbdev/msm/mdss_dsi_host.c +++ b/drivers/video/fbdev/msm/mdss_dsi_host.c @@ -1108,6 +1108,11 @@ static int mdss_dsi_read_status(struct mdss_dsi_ctrl_pdata *ctrl) rc = 1; lenp = ctrl->status_valid_params ?: ctrl->status_cmds_rlen; + if (!lenp || !ctrl->status_cmds_rlen) { + pr_err("invalid dsi read params!\n"); + return 0; + } + for (i = 0; i < ctrl->status_cmds.cmd_cnt; ++i) { memset(&cmdreq, 0, sizeof(cmdreq)); cmdreq.cmds = ctrl->status_cmds.cmds + i; diff --git a/drivers/video/fbdev/msm/mdss_dsi_panel.c b/drivers/video/fbdev/msm/mdss_dsi_panel.c index e8d68059581f..a16176915a0c 100644 --- a/drivers/video/fbdev/msm/mdss_dsi_panel.c +++ b/drivers/video/fbdev/msm/mdss_dsi_panel.c @@ -25,6 +25,7 @@ #include "mdss_dsi.h" #include "mdss_dba_utils.h" +#include "mdss_debug.h" #define DT_CMD_HDR 6 #define DEFAULT_MDP_TRANSFER_TIME 14000 @@ -1451,7 +1452,7 @@ static int mdss_dsi_parse_reset_seq(struct device_node *np, static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl) { - int i, j; + int i, j = 0; int len = 0, *lenp; int group = 0; @@ -1460,6 +1461,15 @@ static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl) for (i = 0; i < ctrl->status_cmds.cmd_cnt; i++) len += lenp[i]; + for (i = 0; i < len; i++) { + pr_debug("[%i] return:0x%x status:0x%x\n", + i, (unsigned int)ctrl->return_buf[i], + (unsigned int)ctrl->status_value[j + i]); + MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i], + ctrl->status_value[j + i]); + j += len; + } + for (j = 0; j < ctrl->groups; ++j) { for (i = 0; i < len; ++i) { if (ctrl->return_buf[i] != |