From 57b11d7a16b4c349e4caf55403204a02b3dd9101 Mon Sep 17 00:00:00 2001 From: Oliver Brown Date: Wed, 3 Oct 2018 14:30:53 -0500 Subject: [PATCH] MLK-19807 drm: imx: dp: Fix NULL pointer dereference if EDID read fails Added a check to see if the EDID read fails before copying the EDID. Added a check to see if buf parameter is NULL. Signed-off-by: Oliver Brown --- drivers/gpu/drm/imx/hdp/imx-dp.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/imx/hdp/imx-dp.c b/drivers/gpu/drm/imx/hdp/imx-dp.c index d2a2ed285d49..279cee01c600 100644 --- a/drivers/gpu/drm/imx/hdp/imx-dp.c +++ b/drivers/gpu/drm/imx/hdp/imx-dp.c @@ -534,7 +534,11 @@ int dp_get_edid_block(void *data, u8 *buf, unsigned int block, size_t len) { DPTX_Read_EDID_response edidResp; state_struct *state = data; - CDN_API_STATUS ret = 0; + CDN_API_STATUS ret = CDN_ERROR_NOT_SUPPORTED; + + if (buf == NULL) { + return -EINVAL; + } memset(&edidResp, 0, sizeof(edidResp)); switch (block) { @@ -555,10 +559,13 @@ int dp_get_edid_block(void *data, u8 *buf, unsigned int block, size_t len) } DRM_INFO("dp_get_edid_block (ret = %d) block %d\n", ret, block); + if (ret == CDN_OK) { + memcpy(buf, edidResp.buff, 128); + return 0; + } - memcpy(buf, edidResp.buff, 128); - - return ret; + memset(buf, 0, 128); + return -EIO; } int dp_get_hpd_state(state_struct *state, u8 *hpd) -- 2.17.1