From f42176b6937f22fac87d55de64b415a5d6f13ce1 Mon Sep 17 00:00:00 2001 From: Guchun Chen Date: Fri, 16 Mar 2018 16:52:16 +0800 Subject: drm: msm: fix potential NULL pointer dereference Add checker before using pointers, to avoid NULL pointer dereference happens. CRs-Fixed: 2202957 Change-Id: I99930e1e9477130fcfceadad3f3a2ff5c9e89cda Signed-off-by: Guchun Chen --- drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c | 4 ++-- drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c | 6 ++++-- drivers/gpu/drm/msm/sde/sde_kms.c | 7 +++---- 3 files changed, 9 insertions(+), 8 deletions(-) (limited to 'drivers/gpu') diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c index 422a9a78f3b2..65e085fd2b6a 100644 --- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c +++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved. + * Copyright (c) 2014-2015, 2018 The Linux Foundation. All rights reserved. * Copyright (C) 2013 Red Hat * Author: Rob Clark * @@ -242,7 +242,7 @@ static void blend_setup(struct drm_crtc *crtc) /* The reset for blending */ for (i = STAGE0; i <= STAGE_MAX; i++) { - if (!pstates[i]) + if (!pstates[i] || !pstates[i]->base.fb) continue; format = to_mdp_format( diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c index 873ab11d34d2..01b6425c6e19 100644 --- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c +++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2014-2015 The Linux Foundation. All rights reserved. + * Copyright (C) 2014-2015, 2018 The Linux Foundation. All rights reserved. * Copyright (C) 2013 Red Hat * Author: Rob Clark * @@ -218,8 +218,10 @@ mdp5_plane_duplicate_state(struct drm_plane *plane) mdp5_state = kmemdup(to_mdp5_plane_state(plane->state), sizeof(*mdp5_state), GFP_KERNEL); + if (!mdp5_state) + return NULL; - if (mdp5_state && mdp5_state->base.fb) + if (mdp5_state->base.fb) drm_framebuffer_reference(mdp5_state->base.fb); mdp5_state->mode_changed = false; diff --git a/drivers/gpu/drm/msm/sde/sde_kms.c b/drivers/gpu/drm/msm/sde/sde_kms.c index 93b8a69597a5..48ee4997b92c 100644 --- a/drivers/gpu/drm/msm/sde/sde_kms.c +++ b/drivers/gpu/drm/msm/sde/sde_kms.c @@ -388,13 +388,12 @@ static void sde_kms_wait_for_commit_done(struct msm_kms *kms, struct drm_device *dev; int ret; - if (!kms || !crtc || !crtc->state) { - SDE_ERROR("invalid params\n"); + dev = crtc->dev; + if (!dev) { + SDE_ERROR("invalid dev\n"); return; } - dev = crtc->dev; - if (!crtc->state->enable) { SDE_DEBUG("[crtc:%d] not enable\n", crtc->base.id); return; -- cgit v1.2.3