From 9b14f40e90d400d41effb13403919b89d5917183 Mon Sep 17 00:00:00 2001
From: Xu Yang <yangxu@codeaurora.org>
Date: Wed, 12 Jun 2019 16:18:42 +0800
Subject: [PATCH] disp: msm: sde: Add DSPP NULL pointer check in reg dma

Add DSPP NULL pointer check in reg dma when get dspp block.
Change fixes the possibility of kernel NULL pointer dereference
issue in stress test.

Change-Id: I9aa5514f7508cd7e316daf9e73fef313e6d1c9d4
---
 msm/sde/sde_hw_reg_dma_v1_color_proc.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/msm/sde/sde_hw_reg_dma_v1_color_proc.c b/msm/sde/sde_hw_reg_dma_v1_color_proc.c
index c6c3b7f1c91c..ca0e7becc94a 100644
--- a/msm/sde/sde_hw_reg_dma_v1_color_proc.c
+++ b/msm/sde/sde_hw_reg_dma_v1_color_proc.c
@@ -379,6 +379,11 @@ static int reg_dmav1_get_dspp_blk(struct sde_hw_cp_cfg *hw_cfg,
 
 	/* Treat first dspp as master to simplify setup */
 	dspp = hw_cfg->dspp[0];
+	if(!dspp) {
+		DRM_ERROR("Invalid dspp NULL");
+		return -EINVAL;
+	}
+
 	if (hw_cfg->broadcast_disabled) {
 		*blk = dspp_mapping[curr_dspp];
 		(*num_of_mixers)++;
@@ -390,6 +395,11 @@ static int reg_dmav1_get_dspp_blk(struct sde_hw_cp_cfg *hw_cfg,
 
 		for (i = 0 ; i < hw_cfg->num_of_mixers; i++) {
 			dspp = hw_cfg->dspp[i];
+			if (!dspp) {
+				DRM_ERROR("Invalid dspp NULL");
+				rc = -EINVAL;
+				break;
+			}
 			if (dspp->idx >= DSPP_MAX) {
 				DRM_ERROR("Invalid dspp idx %d", dspp->idx);
 				rc = -EINVAL;