drm/msm/sde: Fix NULL pointer dereferencing

Plane count maybe passed to sort function as argument without being checked against NULL value in crtc atomic check and blend setup mixer. Add check to use plane count as argument only when it has a valid value. Change-Id: Ibddd9a630fd5afe55c861975d5fce6985daf1401 Signed-off-by: Shubhashree Dhar <[email protected]>
sonyxperiadev · Aug 5, 2019 · 20c5e69 · 20c5e69 · stefanhh0 · Aug 1, 2020
1 parent a09e96a
commit 20c5e69
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/drivers/gpu/drm/msm/sde/sde_crtc.c b/drivers/gpu/drm/msm/sde/sde_crtc.c
@@ -2016,7 +2016,8 @@ static void _sde_crtc_blend_setup_mixer(struct drm_crtc *crtc,
 		cnt++;
 	}
 
-	sort(pstates, cnt, sizeof(pstates[0]), pstate_cmp, NULL);
+	if (cnt)
+		sort(pstates, cnt, sizeof(pstates[0]), pstate_cmp, NULL);
 	_sde_crtc_set_src_split_order(crtc, pstates, cnt);
 
 	if (lm && lm->ops.setup_dim_layer) {
@@ -5278,7 +5279,8 @@ static int sde_crtc_atomic_check(struct drm_crtc *crtc,
 	}
 
 	/* assign mixer stages based on sorted zpos property */
-	sort(pstates, cnt, sizeof(pstates[0]), pstate_cmp, NULL);
+	if (cnt)
+		sort(pstates, cnt, sizeof(pstates[0]), pstate_cmp, NULL);
 
 	rc = _sde_crtc_excl_dim_layer_check(state, pstates, cnt);
 	if (rc)