drm: msm: fix potential NULL pointer dereference

Add checker before using pointers, to avoid NULL pointer
dereference happens.

CRs-Fixed: 2202957
Change-Id: I99930e1e9477130fcfceadad3f3a2ff5c9e89cda
Signed-off-by: Guchun Chen <guchunc@codeaurora.org>

diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index 422a9a7..65e085f 100644 (file)
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2015, 2018 The Linux Foundation. All rights reserved.
  * Copyright (C) 2013 Red Hat
  * Author: Rob Clark <robdclark@gmail.com>
  *
@@ -242,7 +242,7 @@ static void blend_setup(struct drm_crtc *crtc)
 
        /* The reset for blending */
        for (i = STAGE0; i <= STAGE_MAX; i++) {
-               if (!pstates[i])
+               if (!pstates[i] || !pstates[i]->base.fb)
                        continue;
 
                format = to_mdp_format(

diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index 873ab11..01b6425 100644 (file)
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (C) 2014-2015, 2018 The Linux Foundation. All rights reserved.
  * Copyright (C) 2013 Red Hat
  * Author: Rob Clark <robdclark@gmail.com>
  *
@@ -218,8 +218,10 @@ mdp5_plane_duplicate_state(struct drm_plane *plane)
 
        mdp5_state = kmemdup(to_mdp5_plane_state(plane->state),
                        sizeof(*mdp5_state), GFP_KERNEL);
+       if (!mdp5_state)
+               return NULL;
 
-       if (mdp5_state && mdp5_state->base.fb)
+       if (mdp5_state->base.fb)
                drm_framebuffer_reference(mdp5_state->base.fb);
 
        mdp5_state->mode_changed = false;

diff --git a/drivers/gpu/drm/msm/sde/sde_kms.c b/drivers/gpu/drm/msm/sde/sde_kms.c
index 93b8a69..48ee499 100644 (file)
--- a/drivers/gpu/drm/msm/sde/sde_kms.c
+++ b/drivers/gpu/drm/msm/sde/sde_kms.c
@@ -388,13 +388,12 @@ static void sde_kms_wait_for_commit_done(struct msm_kms *kms,
        struct drm_device *dev;
        int ret;
 
-       if (!kms || !crtc || !crtc->state) {
-               SDE_ERROR("invalid params\n");
+       dev = crtc->dev;
+       if (!dev) {
+               SDE_ERROR("invalid dev\n");
                return;
        }
 
-       dev = crtc->dev;
-
        if (!crtc->state->enable) {
                SDE_DEBUG("[crtc:%d] not enable\n", crtc->base.id);
                return;