drm/msm/sde: fix null parameter checks in drm driver
This change adds null parameter checks prior to dereferencing
them in drm driver.
Change-Id: I0354924948bead8a4f7fa8e1201f01cecda510cb
Signed-off-by: Narendra Muppalla <NarendraM@codeaurora.org>
diff --git a/drivers/gpu/drm/msm/msm_smmu.c b/drivers/gpu/drm/msm/msm_smmu.c
index 7fbcff4..26d2953 100644
--- a/drivers/gpu/drm/msm/msm_smmu.c
+++ b/drivers/gpu/drm/msm/msm_smmu.c
@@ -229,6 +229,11 @@
unsigned long attrs = 0x0;
int ret;
+ if (!sgt || !client) {
+ DRM_ERROR("sg table is invalid\n");
+ return -ENOMEM;
+ }
+
if (flags & MSM_BO_KEEPATTRS)
attrs |= DMA_ATTR_IOMMU_USE_UPSTREAM_HINT;
@@ -256,6 +261,11 @@
struct msm_smmu *smmu = to_msm_smmu(mmu);
struct msm_smmu_client *client = msm_smmu_to_client(smmu);
+ if (!sgt || !client) {
+ DRM_ERROR("sg table is invalid\n");
+ return;
+ }
+
if (sgt && sgt->sgl) {
DRM_DEBUG("%pad/0x%x/0x%x\n", &sgt->sgl->dma_address,
sgt->sgl->dma_length, dir);
diff --git a/drivers/gpu/drm/msm/sde/sde_crtc.c b/drivers/gpu/drm/msm/sde/sde_crtc.c
index 30bb72b..e942e2d 100644
--- a/drivers/gpu/drm/msm/sde/sde_crtc.c
+++ b/drivers/gpu/drm/msm/sde/sde_crtc.c
@@ -1202,6 +1202,11 @@
state->fb ? state->fb->base.id : -1);
format = to_sde_format(msm_framebuffer_format(pstate->base.fb));
+ if (!format) {
+ SDE_ERROR("invalid format\n");
+ return;
+ }
+
if (pstate->stage == SDE_STAGE_BASE && format->alpha_enable)
bg_alpha_enable = true;
@@ -2149,6 +2154,12 @@
dev = crtc->dev;
sde_crtc = to_sde_crtc(crtc);
sde_kms = _sde_crtc_get_kms(crtc);
+
+ if (!sde_kms || !sde_kms->dev || !sde_kms->dev->dev_private) {
+ SDE_ERROR("invalid argument\n");
+ return;
+ }
+
priv = sde_kms->dev->dev_private;
cstate = to_sde_crtc_state(crtc->state);
@@ -3013,6 +3024,11 @@
dev = crtc->dev;
sde_kms = _sde_crtc_get_kms(crtc);
+ if (!sde_kms) {
+ SDE_ERROR("invalid argument\n");
+ return;
+ }
+
info = kzalloc(sizeof(struct sde_kms_info), GFP_KERNEL);
if (!info) {
SDE_ERROR("failed to allocate info memory\n");
diff --git a/drivers/gpu/drm/msm/sde/sde_hw_reg_dma_v1.c b/drivers/gpu/drm/msm/sde/sde_hw_reg_dma_v1.c
index 678c84a..0a5346e 100644
--- a/drivers/gpu/drm/msm/sde/sde_hw_reg_dma_v1.c
+++ b/drivers/gpu/drm/msm/sde/sde_hw_reg_dma_v1.c
@@ -447,6 +447,7 @@
u32 cmd1;
struct sde_hw_blk_reg_map hw;
+ memset(&hw, 0, sizeof(hw));
cmd1 = (cfg->op == REG_DMA_READ) ?
(dspp_read_sel[cfg->block_select] << 30) : 0;
cmd1 |= (cfg->last_command) ? BIT(24) : 0;
@@ -547,6 +548,7 @@
return -EINVAL;
}
+ memset(&hw, 0, sizeof(hw));
index = ctl->idx - CTL_0;
SET_UP_REG_DMA_REG(hw, reg_dma);
SDE_REG_WRITE(&hw, REG_DMA_OP_MODE_OFF, BIT(0));
diff --git a/drivers/gpu/drm/msm/sde/sde_kms.c b/drivers/gpu/drm/msm/sde/sde_kms.c
index 26125d8..dd8b31e 100644
--- a/drivers/gpu/drm/msm/sde/sde_kms.c
+++ b/drivers/gpu/drm/msm/sde/sde_kms.c
@@ -459,7 +459,7 @@
struct drm_crtc *crtc)
{
struct drm_encoder *encoder;
- struct drm_device *dev = crtc->dev;
+ struct drm_device *dev;
int ret;
if (!kms || !crtc || !crtc->state) {
@@ -467,6 +467,8 @@
return;
}
+ dev = crtc->dev;
+
if (!crtc->state->enable) {
SDE_DEBUG("[crtc:%d] not enable\n", crtc->base.id);
return;
diff --git a/drivers/gpu/drm/msm/sde/sde_plane.c b/drivers/gpu/drm/msm/sde/sde_plane.c
index 2a98af4..246e401 100644
--- a/drivers/gpu/drm/msm/sde/sde_plane.c
+++ b/drivers/gpu/drm/msm/sde/sde_plane.c
@@ -367,7 +367,7 @@
total_fl = _sde_plane_calc_fill_level(plane, fmt,
psde->pipe_cfg.src_rect.w);
- if (SDE_FORMAT_IS_LINEAR(fmt))
+ if (fmt && SDE_FORMAT_IS_LINEAR(fmt))
lut_usage = SDE_QOS_LUT_USAGE_LINEAR;
else
lut_usage = SDE_QOS_LUT_USAGE_MACROTILE;
@@ -428,7 +428,7 @@
fb->modifier,
drm_format_num_planes(fb->pixel_format));
- if (SDE_FORMAT_IS_LINEAR(fmt)) {
+ if (fmt && SDE_FORMAT_IS_LINEAR(fmt)) {
danger_lut = psde->catalog->perf.danger_lut_tbl
[SDE_QOS_LUT_USAGE_LINEAR];
safe_lut = psde->catalog->perf.safe_lut_tbl