Instead of exiting the loop as expected when an entry is found, the list_for_each_entry() continues until the traversal is complete. It could lead to a invalid reference to 'lane_count/bpp' after the loop.
The invalid reference to 'lane_count/bpp' is here: cdv_intel_dp_compute_m_n(bpp, lane_count,
To fix this, when found the entry, add a break after the switch statement.
Fixes: 8695b61294356 ("gma500: Add the support of display port on CDV") Signed-off-by: Xiaomeng Tong xiam0nd.tong@gmail.com --- drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c index ba6ad1466374..e6473b8da296 100644 --- a/drivers/gpu/drm/gma500/cdv_intel_dp.c +++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c @@ -1016,6 +1016,8 @@ cdv_intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode, bpp = dev_priv->edp.bpp; break; } + + break; }
/*