samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drm:msm:dsi: Add check for max controller count

Browse Source 
Add check for max controller count while iterating through
display ctrl structure to avoid out of bounds access.

Change-Id: If4d32c648e7d34591726286226600a92a357479a
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
This commit is contained in:
Vishnuvardhan Prodduturi
2019-08-16 17:13:42 +05:30
parent dc6f198f99
commit ea1176e4f8
1 changed files with 7 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
msm/dsi/dsi_display.c
View File

@@ -3839,7 +3839,7 @@ static int dsi_display_update_dsi_bitrate(struct dsi_display *display,
display->config.bit_clk_rate_hz = bit_clk_rate; display->config.bit_clk_rate_hz = bit_clk_rate;
for (i = 0; i < display->ctrl_count; i++) { display_for_each_ctrl(i, display) {
struct dsi_display_ctrl *dsi_disp_ctrl = &display->ctrl[i]; struct dsi_display_ctrl *dsi_disp_ctrl = &display->ctrl[i];
struct dsi_ctrl *ctrl = dsi_disp_ctrl->ctrl; struct dsi_ctrl *ctrl = dsi_disp_ctrl->ctrl;
u32 num_of_lanes = 0, bpp; u32 num_of_lanes = 0, bpp;
@@ -3967,8 +3967,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display,
goto exit; goto exit;
} }
for (i = 0; (i < display->ctrl_count) && display_for_each_ctrl(i, display) {
(i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {
ctrl = &display->ctrl[i]; ctrl = &display->ctrl[i];
if (!ctrl->ctrl) if (!ctrl->ctrl)
continue; continue;
@@ -3986,8 +3985,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display,
} }
} }
for (i = 0; (i < display->ctrl_count) && display_for_each_ctrl(i, display) {
(i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {
ctrl = &display->ctrl[i]; ctrl = &display->ctrl[i];
if (ctrl == m_ctrl) if (ctrl == m_ctrl)
continue; continue;
@@ -3996,8 +3994,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display,
dsi_phy_dynamic_refresh_trigger(m_ctrl->phy, true); dsi_phy_dynamic_refresh_trigger(m_ctrl->phy, true);
/* wait for dynamic refresh done */ /* wait for dynamic refresh done */
for (i = 0; (i < display->ctrl_count) && display_for_each_ctrl(i, display) {
(i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {
ctrl = &display->ctrl[i]; ctrl = &display->ctrl[i];
rc = dsi_ctrl_wait4dynamic_refresh_done(ctrl->ctrl); rc = dsi_ctrl_wait4dynamic_refresh_done(ctrl->ctrl);
if (rc) { if (rc) {
@@ -4009,8 +4006,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display,
} }
} }
for (i = 0; (i < display->ctrl_count) && display_for_each_ctrl(i, display) {
(i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {
ctrl = &display->ctrl[i]; ctrl = &display->ctrl[i];
dsi_phy_dynamic_refresh_clear(ctrl->phy); dsi_phy_dynamic_refresh_clear(ctrl->phy);
} }
@@ -4025,8 +4021,7 @@ static int _dsi_display_dyn_update_clks(struct dsi_display *display,
return rc; return rc;
recover_pix_clk: recover_pix_clk:
for (i = 0; (i < display->ctrl_count) && display_for_each_ctrl(i, display) {
(i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {
ctrl = &display->ctrl[i]; ctrl = &display->ctrl[i];
if (!ctrl->ctrl) if (!ctrl->ctrl)
continue; continue;
@@ -4035,8 +4030,7 @@ recover_pix_clk:
} }
recover_byte_clk: recover_byte_clk:
for (i = 0; (i < display->ctrl_count) && display_for_each_ctrl(i, display) {
(i < MAX_DSI_CTRLS_PER_DISPLAY); i++) {
ctrl = &display->ctrl[i]; ctrl = &display->ctrl[i];
if (!ctrl->ctrl) if (!ctrl->ctrl)
continue; continue;