From b48dd8e3f6c73f53a0d7ef3cb70f23b8455c4887 Mon Sep 17 00:00:00 2001 From: Ray Zhang Date: Mon, 9 Jan 2017 13:07:52 +0800 Subject: msm: mdss: fix potential null pointer dereference in HDMI driver There are some cases in HDMI driver where NULL pointers might be dereferenced. Fix them by validating pointers before access. CRs-Fixed: 1091211 Change-Id: I229b9a9b0979de74bb09d04737742c71eb05bd69 Signed-off-by: Ray Zhang --- drivers/video/fbdev/msm/mdss_hdmi_edid.c | 7 ++++++- drivers/video/fbdev/msm/mdss_hdmi_tx.c | 23 ++++++++++++++--------- 2 files changed, 20 insertions(+), 10 deletions(-) diff --git a/drivers/video/fbdev/msm/mdss_hdmi_edid.c b/drivers/video/fbdev/msm/mdss_hdmi_edid.c index 3adf04214d87..a7ac78ed0b02 100644 --- a/drivers/video/fbdev/msm/mdss_hdmi_edid.c +++ b/drivers/video/fbdev/msm/mdss_hdmi_edid.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2010-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -2498,6 +2498,11 @@ bool hdmi_edid_is_s3d_mode_supported(void *input, u32 video_mode, u32 s3d_mode) struct hdmi_edid_ctrl *edid_ctrl = (struct hdmi_edid_ctrl *)input; struct hdmi_edid_sink_data *sink_data; + if (!edid_ctrl) { + DEV_ERR("%s: invalid input\n", __func__); + return false; + } + sink_data = &edid_ctrl->sink_data; for (i = 0; i < sink_data->num_of_elements; ++i) { if (sink_data->disp_mode_list[i].video_format != video_mode) diff --git a/drivers/video/fbdev/msm/mdss_hdmi_tx.c b/drivers/video/fbdev/msm/mdss_hdmi_tx.c index 67813ca9cd37..d139d9ed5ec9 100644 --- a/drivers/video/fbdev/msm/mdss_hdmi_tx.c +++ b/drivers/video/fbdev/msm/mdss_hdmi_tx.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2010-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1608,14 +1608,18 @@ static void hdmi_tx_hdcp_cb_work(struct work_struct *work) } if (hdmi_tx_is_panel_on(hdmi_ctrl)) { - DEV_DBG("%s: Reauthenticating\n", __func__); - rc = hdmi_ctrl->hdcp_ops->reauthenticate( - hdmi_ctrl->hdcp_data); - if (rc) - DEV_ERR("%s: HDCP reauth failed. rc=%d\n", - __func__, rc); + pr_debug("%s: Reauthenticating\n", __func__); + if (hdmi_ctrl->hdcp_ops && hdmi_ctrl->hdcp_data) { + rc = hdmi_ctrl->hdcp_ops->reauthenticate( + hdmi_ctrl->hdcp_data); + if (rc) + pr_err("%s: HDCP reauth failed. rc=%d\n", + __func__, rc); + } else + pr_err("%s: NULL HDCP Ops and Data\n", + __func__); } else { - DEV_DBG("%s: Not reauthenticating. Cable not conn\n", + pr_debug("%s: Not reauthenticating. Cable not conn\n", __func__); } @@ -2282,7 +2286,8 @@ static void hdmi_tx_update_hdcp_info(struct hdmi_tx_ctrl *hdmi_ctrl) if (hdmi_ctrl->hdcp14_present) { fd = hdmi_tx_get_fd(HDMI_TX_FEAT_HDCP); - ops = hdcp_1x_start(fd); + if (fd) + ops = hdcp_1x_start(fd); } } -- cgit v1.2.3