Commit 2e6c86be authored by Xiaomeng Tong's avatar Xiaomeng Tong Committed by Philippe Cornu
Browse files

stm: ltdc: fix two incorrect NULL checks on list iterator 



The two bugs are here:
	if (encoder) {
	if (bridge && bridge->timings)

The list iterator value 'encoder/bridge' will *always* be set and
non-NULL by drm_for_each_encoder()/list_for_each_entry(), so it is
incorrect to assume that the iterator value will be NULL if the
list is empty or no element is found.

To fix the bug, use a new variable '*_iter' as the list iterator,
while use the old variable 'encoder/bridge' as a dedicated pointer
to point to the found element.

Cc: stable@vger.kernel.org
Fixes: 99e36044 ("drm/stm: Fix bus_flags handling")
Signed-off-by: default avatarXiaomeng Tong <xiam0nd.tong@gmail.com>
Acked-by: default avatarRaphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
Signed-off-by: default avatarPhilippe Cornu <philippe.cornu@foss.st.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220327055355.3808-1-xiam0nd.tong@gmail.com
parent c8d4c18b

drivers/gpu/drm/stm/ltdc.c

+10 −6
Original line number Diff line number Diff line
@@ -869,8 +869,8 @@ static void ltdc_crtc_mode_set_nofb(struct drm_crtc *crtc) 
	struct drm_device *ddev = crtc->dev;

	struct drm_connector_list_iter iter;

	struct drm_connector *connector = NULL;

	struct drm_encoder *encoder = NULL;

	struct drm_bridge *bridge = NULL;

	struct drm_encoder *encoder = NULL, *en_iter;

	struct drm_bridge *bridge = NULL, *br_iter;

	struct drm_display_mode *mode = &crtc->state->adjusted_mode;

	u32 hsync, vsync, accum_hbp, accum_vbp, accum_act_w, accum_act_h;

	u32 total_width, total_height;
@@ -880,15 +880,19 @@ static void ltdc_crtc_mode_set_nofb(struct drm_crtc *crtc) 
	int ret;



	/* get encoder from crtc */

	drm_for_each_encoder(encoder, ddev)

		if (encoder->crtc == crtc)

	drm_for_each_encoder(en_iter, ddev)

		if (en_iter->crtc == crtc) {

			encoder = en_iter;

			break;

		}



	if (encoder) {

		/* get bridge from encoder */

		list_for_each_entry(bridge, &encoder->bridge_chain, chain_node)

			if (bridge->encoder == encoder)

		list_for_each_entry(br_iter, &encoder->bridge_chain, chain_node)

			if (br_iter->encoder == encoder) {

				bridge = br_iter;

				break;

			}



		/* Get the connector from encoder */

		drm_connector_list_iter_begin(ddev, &iter);