From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thierry Reding Subject: Re: [GIT PULL] drm/panel: Changes for v3.20-rc1 Date: Mon, 26 Jan 2015 10:53:44 +0100 Message-ID: <20150126095343.GA3508@ulmo> References: <1422021366-4137-1-git-send-email-thierry.reding@gmail.com> <87a915hpuf.fsf@intel.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0566931029==" Return-path: Received: from mail-wg0-f48.google.com (mail-wg0-f48.google.com [74.125.82.48]) by gabe.freedesktop.org (Postfix) with ESMTP id BBB726E229 for ; Mon, 26 Jan 2015 01:53:47 -0800 (PST) Received: by mail-wg0-f48.google.com with SMTP id x12so7953410wgg.7 for ; Mon, 26 Jan 2015 01:53:46 -0800 (PST) In-Reply-To: <87a915hpuf.fsf@intel.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Jani Nikula Cc: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============0566931029== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="nVMJ2NtxeReIH9PS" Content-Disposition: inline --nVMJ2NtxeReIH9PS Content-Type: multipart/mixed; boundary="SUOF0GtieIMvvwua" Content-Disposition: inline --SUOF0GtieIMvvwua Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jan 26, 2015 at 11:07:52AM +0200, Jani Nikula wrote: > On Fri, 23 Jan 2015, Thierry Reding wrote: > > Thierry Reding (4): > > drm/mipi-dsi: Avoid potential NULL pointer dereference >=20 > I can't find this one, has it been posted on the list? I thought it had, but I can't find any record of that. It certainly was reported on-list: Subject: re: drm/dsi: Add message to packet translator Message-ID: <20141216235305.GC31467@mwanda> I've attached the patch for convenience. Thierry --SUOF0GtieIMvvwua Content-Type: text/x-diff; charset=us-ascii Content-Disposition: inline; filename="0001-drm-mipi-dsi-Avoid-potential-NULL-pointer-dereferenc.patch" Content-Transfer-Encoding: quoted-printable =46rom 903c75cb0da218e3849fff3c2c17a9f2ab5705ba Mon Sep 17 00:00:00 2001 =46rom: Thierry Reding Date: Fri, 5 Dec 2014 11:46:56 +0100 Subject: [PATCH] drm/mipi-dsi: Avoid potential NULL pointer dereference The mipi_dsi_packet_create() function dereferences the msg pointer before checking that it's valid. Move the dereference down to where it is required to avoid potentially dereferencing a NULL pointer. Reported-by: Dan Carpenter Signed-off-by: Thierry Reding --- drivers/gpu/drm/drm_mipi_dsi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c index c0644bb865f2..2d5ca8eec13a 100644 --- a/drivers/gpu/drm/drm_mipi_dsi.c +++ b/drivers/gpu/drm/drm_mipi_dsi.c @@ -323,8 +323,6 @@ EXPORT_SYMBOL(mipi_dsi_packet_format_is_long); int mipi_dsi_create_packet(struct mipi_dsi_packet *packet, const struct mipi_dsi_msg *msg) { - const u8 *tx =3D msg->tx_buf; - if (!packet || !msg) return -EINVAL; =20 @@ -353,8 +351,10 @@ int mipi_dsi_create_packet(struct mipi_dsi_packet *pac= ket, packet->header[2] =3D (msg->tx_len >> 8) & 0xff; =20 packet->payload_length =3D msg->tx_len; - packet->payload =3D tx; + packet->payload =3D msg->tx_buf; } else { + const u8 *tx =3D msg->tx_buf; + packet->header[1] =3D (msg->tx_len > 0) ? tx[0] : 0; packet->header[2] =3D (msg->tx_len > 1) ? tx[1] : 0; } --=20 2.1.3 --SUOF0GtieIMvvwua-- --nVMJ2NtxeReIH9PS Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBAgAGBQJUxg6nAAoJEN0jrNd/PrOhpI4P/0QVYud1fpcaVRXwMa4IAaHB pU99ygR7Dqp3EdnZfpWscIY9xxPfoUF1KBa9nf15dNQvL0UmmUVQQq9cCpx9Xq/5 Pt5sKeqlv7jO1EPDe99tZCaJP9y3ul7HJz9A7Ym/W7gISWmkFeF4KpUIQfhzDdwq 0OiGU9i2OT2FjgtTCckgS9NRfdL0EzbblyNsaMyEYFDYM8ph0M9fbs3k4pr5A+Y5 AKotvu0hbekWLjfGeCsMID+71bhRg++7eahIvJ09WuroGKJkysuCujP1IqAeRYsR chXqX/Zt8/xb/9YGpFKaKg5Sas+POtCnKR7tzCbTDFb30C6neKKBaFvPYM7gvv5x aHDsv0zfPoWnio/YIN0b7DEQNtZlQ36TXeYWXcHI+unm5amqDhUN3CIEmCO0HtFk XT599ym8uAIiu3b1rntK+kO2z7F8xOc8LQdHiWW9bSxTgR9MH/abCmmEeQrx0gmp TLgc0JkprJzMS1gyvGro9jUlfWgrqtLxO9zd5dPSJ99thLCofscM5//yBpUieD88 OnKotRzeR2SXnQwduAWzAC+OMPIN1dMxL4cEdCEwzjM73a6vU7MTZrpDtU2sLu4X BKmk6gH6+Yjz06XUHRyyK9zkcIJgslrRo95k5hNNYWn4RcTVKHZz5RP3yYsMfdDL m/kibrc8jZ2/ZwF4xIfg =I2BG -----END PGP SIGNATURE----- --nVMJ2NtxeReIH9PS-- --===============0566931029== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHA6Ly9saXN0 cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwK --===============0566931029==--