From c00bf1076844219d6d8d586a15442a2e66eb2807 Mon Sep 17 00:00:00 2001 From: Samantha Tran Date: Tue, 6 Aug 2019 13:46:48 -0700 Subject: [PATCH] disp: msm: add proper null checks and propagate error Fix possible null pointer dereferencing and propagate error code during early return. Signed-off-by: Samantha Tran --- msm/dp/dp_drm.c | 9 +++++++-- msm/msm_fb.c | 4 +++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/msm/dp/dp_drm.c b/msm/dp/dp_drm.c index ca0f60ab4122..08e61dc8398e 100644 --- a/msm/dp/dp_drm.c +++ b/msm/dp/dp_drm.c @@ -493,12 +493,17 @@ int dp_connector_atomic_check(struct drm_connector *connector, struct drm_connector_state *c_state) { struct sde_connector *sde_conn; - struct drm_connector_state *old_state = - drm_atomic_get_old_connector_state(c_state->state, connector); + struct drm_connector_state *old_state; if (!connector || !display) return -EINVAL; + old_state = + drm_atomic_get_old_connector_state(c_state->state, connector); + + if (!old_state) + return -EINVAL; + sde_conn = to_sde_connector(connector); /* diff --git a/msm/msm_fb.c b/msm/msm_fb.c index ddc699e5e864..bc51e01df336 100644 --- a/msm/msm_fb.c +++ b/msm/msm_fb.c @@ -378,8 +378,10 @@ struct drm_framebuffer *msm_framebuffer_init(struct drm_device *dev, const struct drm_format_info *info; info = drm_format_info(mode_cmd->pixel_format); - if (!info || num_planes > ARRAY_SIZE(info->cpp)) + if (!info || num_planes > ARRAY_SIZE(info->cpp)) { + ret = -EINVAL; goto fail; + } for (i = 0; i < num_planes; i++) { unsigned int width = mode_cmd->width / (i ? hsub : 1);