aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAntonino A. Daplas <adaplas@gmail.com>2005-09-14 17:19:15 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2005-09-14 17:34:17 -0400
commit0ed8e048c9e11e69ec951f94066105e80cdc59fd (patch)
treeaaebd53676e1629c57cbbb90f24d1a4d6ad598d6
parent8fd9808aec0198b25ff9f8bb19508d9492f86920 (diff)
[PATCH] nv_i2c oops fix
The call to fb_firmware_edid may return NULL but this is not checked before trying to memcpy using this pointer. Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--drivers/video/nvidia/nv_i2c.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/video/nvidia/nv_i2c.c b/drivers/video/nvidia/nv_i2c.c
index ace484fa61ce..12f2884d3f0b 100644
--- a/drivers/video/nvidia/nv_i2c.c
+++ b/drivers/video/nvidia/nv_i2c.c
@@ -209,10 +209,13 @@ int nvidia_probe_i2c_connector(struct fb_info *info, int conn, u8 **out_edid)
209 209
210 if (!edid && conn == 1) { 210 if (!edid && conn == 1) {
211 /* try to get from firmware */ 211 /* try to get from firmware */
212 edid = kmalloc(EDID_LENGTH, GFP_KERNEL); 212 const u8 *e = fb_firmware_edid(info->device);
213 if (edid) 213
214 memcpy(edid, fb_firmware_edid(info->device), 214 if (e != NULL) {
215 EDID_LENGTH); 215 edid = kmalloc(EDID_LENGTH, GFP_KERNEL);
216 if (edid)
217 memcpy(edid, e, EDID_LENGTH);
218 }
216 } 219 }
217 220
218 if (out_edid) 221 if (out_edid)