diff options
| author | James Bates <james.h.bates@gmail.com> | 2013-10-02 18:43:39 +0200 |
|---|---|---|
| committer | Tomi Valkeinen <tomi.valkeinen@ti.com> | 2013-10-29 11:41:46 +0100 |
| commit | 55aa42f2e690157e254a6a6989f5f4ac928b35c8 (patch) | |
| tree | d3fcbcc20f2a6e167335dab8ceaeb5bdc23fa41b /drivers | |
| parent | fbdev: fix error return code in metronomefb_probe() (diff) | |
| download | linux-55aa42f2e690157e254a6a6989f5f4ac928b35c8.tar.xz linux-55aa42f2e690157e254a6a6989f5f4ac928b35c8.zip | |
efifb: prevent null-deref when iterating dmi_list
The dmi_list array is initialized using gnu designated initializers, and
therefore may contain fewer explicitly defined entries as there are
elements in it. This is because the enum above with M_xyz constants
contains more items than the designated initializer. Those elements not
explicitly initialized are implicitly set to 0.
Now efifb_setup() loops through all these array elements, and performs
a strcmp on each item. For non explicitly initialized elements this will
be a null pointer:
This patch swaps the check order in the if statement, thus checks first
whether dmi_list[i].base is null.
Signed-off-by: James Bates <james.h.bates@gmail.com>
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/efifb.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c index 7f9ff75d0db2..fcb950031246 100644 --- a/drivers/video/efifb.c +++ b/drivers/video/efifb.c @@ -108,8 +108,8 @@ static int efifb_setup(char *options) if (!*this_opt) continue; for (i = 0; i < M_UNKNOWN; i++) { - if (!strcmp(this_opt, efifb_dmi_list[i].optname) && - efifb_dmi_list[i].base != 0) { + if (efifb_dmi_list[i].base != 0 && + !strcmp(this_opt, efifb_dmi_list[i].optname)) { screen_info.lfb_base = efifb_dmi_list[i].base; screen_info.lfb_linelength = efifb_dmi_list[i].stride; screen_info.lfb_width = efifb_dmi_list[i].width; |