Commit 2a18d765 authored by Gen Zhang's avatar Gen Zhang Committed by Greg Kroah-Hartman

drm/edid: Fix a missing-check bug in drm_load_edid_firmware()

[ Upstream commit 9f1f1a2d ]

In drm_load_edid_firmware(), fwstr is allocated by kstrdup(). And fwstr
is dereferenced in the following codes. However, memory allocation
functions such as kstrdup() may fail and returns NULL. Dereferencing
this null pointer may cause the kernel go wrong. Thus we should check
this kstrdup() operation.
Further, if kstrdup() returns NULL, we should return ERR_PTR(-ENOMEM) to
the caller site.
Signed-off-by: default avatarGen Zhang <blackgod016574@gmail.com>
Reviewed-by: default avatarJani Nikula <jani.nikula@intel.com>
Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190524023222.GA5302@zhanggen-UX430UQSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 210dfe63
...@@ -290,6 +290,8 @@ struct edid *drm_load_edid_firmware(struct drm_connector *connector) ...@@ -290,6 +290,8 @@ struct edid *drm_load_edid_firmware(struct drm_connector *connector)
* the last one found one as a fallback. * the last one found one as a fallback.
*/ */
fwstr = kstrdup(edid_firmware, GFP_KERNEL); fwstr = kstrdup(edid_firmware, GFP_KERNEL);
if (!fwstr)
return ERR_PTR(-ENOMEM);
edidstr = fwstr; edidstr = fwstr;
while ((edidname = strsep(&edidstr, ","))) { while ((edidname = strsep(&edidstr, ","))) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment