From ea1176e4f8ea165b6fa2924f38493d6dedc80299 Mon Sep 17 00:00:00 2001 From: Vishnuvardhan Prodduturi Date: Fri, 16 Aug 2019 17:13:42 +0530 Subject: [PATCH] drm:msm:dsi: Add check for max controller count Add check for max controller count while iterating through display ctrl structure to avoid out of bounds access. Change-Id: If4d32c648e7d34591726286226600a92a357479a Signed-off-by: Vishnuvardhan Prodduturi --- msm/dsi/dsi_display.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) diff --git a/msm/dsi/dsi_display.c b/msm/dsi/dsi_display.c index 82ced76854..e6c6bd5a23 100644 --- a/msm/dsi/dsi_display.c +++ b/msm/dsi/dsi_display.c @@ -3839,7 +3839,7 @@ static int dsi_display_update_dsi_bitrate(struct dsi_display *display, display->config.bit_clk_rate_hz = bit_clk_rate; - for (i = 0; i < display->ctrl_count; i++) { + display_for_each_ctrl(i, display) { struct dsi_display_ctrl *dsi_disp_ctrl = &display->ctrl[i]; struct dsi_ctrl *ctrl = dsi_disp_ctrl->ctrl; u32 num_of_lanes = 0, bpp; @@ -3967,8 +3967,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, goto exit; } - for (i = 0; (i < display->ctrl_count) && - (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) { + display_for_each_ctrl(i, display) { ctrl = &display->ctrl[i]; if (!ctrl->ctrl) continue; @@ -3986,8 +3985,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, } } - for (i = 0; (i < display->ctrl_count) && - (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) { + display_for_each_ctrl(i, display) { ctrl = &display->ctrl[i]; if (ctrl == m_ctrl) continue; @@ -3996,8 +3994,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, dsi_phy_dynamic_refresh_trigger(m_ctrl->phy, true); /* wait for dynamic refresh done */ - for (i = 0; (i < display->ctrl_count) && - (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) { + display_for_each_ctrl(i, display) { ctrl = &display->ctrl[i]; rc = dsi_ctrl_wait4dynamic_refresh_done(ctrl->ctrl); if (rc) { @@ -4009,8 +4006,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, } } - for (i = 0; (i < display->ctrl_count) && - (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) { + display_for_each_ctrl(i, display) { ctrl = &display->ctrl[i]; dsi_phy_dynamic_refresh_clear(ctrl->phy); } @@ -4025,8 +4021,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display, return rc; recover_pix_clk: - for (i = 0; (i < display->ctrl_count) && - (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) { + display_for_each_ctrl(i, display) { ctrl = &display->ctrl[i]; if (!ctrl->ctrl) continue; @@ -4035,8 +4030,7 @@ recover_pix_clk: } recover_byte_clk: - for (i = 0; (i < display->ctrl_count) && - (i < MAX_DSI_CTRLS_PER_DISPLAY); i++) { + display_for_each_ctrl(i, display) { ctrl = &display->ctrl[i]; if (!ctrl->ctrl) continue;