Commit 9b97383b authored by Thierry Reding's avatar Thierry Reding

drm/mipi-dsi: Avoid potential NULL pointer dereference

The mipi_dsi_packet_create() function dereferences the msg pointer
before checking that it's valid. Move the dereference down to where it
is required to avoid potentially dereferencing a NULL pointer.
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarThierry Reding <treding@nvidia.com>
parent 21773f16
...@@ -323,8 +323,6 @@ EXPORT_SYMBOL(mipi_dsi_packet_format_is_long); ...@@ -323,8 +323,6 @@ EXPORT_SYMBOL(mipi_dsi_packet_format_is_long);
int mipi_dsi_create_packet(struct mipi_dsi_packet *packet, int mipi_dsi_create_packet(struct mipi_dsi_packet *packet,
const struct mipi_dsi_msg *msg) const struct mipi_dsi_msg *msg)
{ {
const u8 *tx = msg->tx_buf;
if (!packet || !msg) if (!packet || !msg)
return -EINVAL; return -EINVAL;
...@@ -353,8 +351,10 @@ int mipi_dsi_create_packet(struct mipi_dsi_packet *packet, ...@@ -353,8 +351,10 @@ int mipi_dsi_create_packet(struct mipi_dsi_packet *packet,
packet->header[2] = (msg->tx_len >> 8) & 0xff; packet->header[2] = (msg->tx_len >> 8) & 0xff;
packet->payload_length = msg->tx_len; packet->payload_length = msg->tx_len;
packet->payload = tx; packet->payload = msg->tx_buf;
} else { } else {
const u8 *tx = msg->tx_buf;
packet->header[1] = (msg->tx_len > 0) ? tx[0] : 0; packet->header[1] = (msg->tx_len > 0) ? tx[0] : 0;
packet->header[2] = (msg->tx_len > 1) ? tx[1] : 0; packet->header[2] = (msg->tx_len > 1) ? tx[1] : 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment