diff options
| author | James Bates <james.h.bates@gmail.com> | 2013-10-02 16:43:39 (GMT) |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2014-03-12 12:25:34 (GMT) |
| commit | 2a352e27de04e0329fa408eb256b8440ff4b4b23 (patch) | |
| tree | 89292666bb89d23c437f2124b1bf0a0794853f8d /drivers/video | |
| parent | d4ea1c7ffc46aafe15eff8ed559016c0fa317dec (diff) | |
| download | linux-fsl-qoriq-2a352e27de04e0329fa408eb256b8440ff4b4b23.tar.xz | |
efifb: prevent null-deref when iterating dmi_list
commit 55aa42f2e690157e254a6a6989f5f4ac928b35c8 upstream.
The dmi_list array is initialized using gnu designated initializers, and
therefore may contain fewer explicitly defined entries as there are
elements in it. This is because the enum above with M_xyz constants
contains more items than the designated initializer. Those elements not
explicitly initialized are implicitly set to 0.
Now efifb_setup() loops through all these array elements, and performs
a strcmp on each item. For non explicitly initialized elements this will
be a null pointer:
This patch swaps the check order in the if statement, thus checks first
whether dmi_list[i].base is null.
Signed-off-by: James Bates <james.h.bates@gmail.com>
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'drivers/video')
| -rw-r--r-- | drivers/video/efifb.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c index 7f9ff75..fcb9500 100644 --- a/drivers/video/efifb.c +++ b/drivers/video/efifb.c @@ -108,8 +108,8 @@ static int efifb_setup(char *options) if (!*this_opt) continue; for (i = 0; i < M_UNKNOWN; i++) { - if (!strcmp(this_opt, efifb_dmi_list[i].optname) && - efifb_dmi_list[i].base != 0) { + if (efifb_dmi_list[i].base != 0 && + !strcmp(this_opt, efifb_dmi_list[i].optname)) { screen_info.lfb_base = efifb_dmi_list[i].base; screen_info.lfb_linelength = efifb_dmi_list[i].stride; screen_info.lfb_width = efifb_dmi_list[i].width; |