mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-02 15:18:19 +00:00
Code Issues Releases Wiki Activity

media: mediatek: vcodec: Coverity issues in encoder driver

Browse source 
CERT-C Characters and Strings:
check core id is in valid range:
dev->reg_base[dev->venc_pdata->core_id] evaluates to an address
that could be at negative offset of an array.

CERT-C Expression:
check buf is not NULL before used:
Dereferencing buf, which is known to be NULL.

Signed-off-by: Irui Wang <irui.wang@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
This commit is contained in:
Irui Wang 2023-04-03 10:43:42 +01:00 committed by Mauro Carvalho Chehab
parent 8fbcf730cb
commit bb02a201b6
2 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
View file

@ -943,7 +943,7 @@ static int vb2ops_venc_start_streaming(struct vb2_queue *q, unsigned int count)
* FIXME: This check is not needed as only active buffers
* can be marked as done.
*/
if (buf->state == VB2_BUF_STATE_ACTIVE) {
if (buf && buf->state == VB2_BUF_STATE_ACTIVE) {
mtk_v4l2_debug(0, "[%d] id=%d, type=%d, %d -> VB2_BUF_STATE_QUEUED",
ctx->id, i, q->type,
(int)buf->state);

16
drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c
View file

@ -89,16 +89,24 @@ static irqreturn_t mtk_vcodec_enc_irq_handler(int irq, void *priv)
struct mtk_vcodec_ctx *ctx;
unsigned long flags;
void __iomem *addr;
int core_id;
spin_lock_irqsave(&dev->irqlock, flags);
ctx = dev->curr_ctx;
spin_unlock_irqrestore(&dev->irqlock, flags);
mtk_v4l2_debug(1, "id=%d coreid:%d", ctx->id, dev->venc_pdata->core_id);
addr = dev->reg_base[dev->venc_pdata->core_id] +
MTK_VENC_IRQ_ACK_OFFSET;
core_id = dev->venc_pdata->core_id;
if (core_id < 0 || core_id >= NUM_MAX_VCODEC_REG_BASE) {
mtk_v4l2_err("Invalid core id: %d, ctx id: %d",
core_id, ctx->id);
return IRQ_HANDLED;
}
ctx->irq_status = readl(dev->reg_base[dev->venc_pdata->core_id] +
mtk_v4l2_debug(1, "id: %d, core id: %d", ctx->id, core_id);
addr = dev->reg_base[core_id] + MTK_VENC_IRQ_ACK_OFFSET;
ctx->irq_status = readl(dev->reg_base[core_id] +
(MTK_VENC_IRQ_STATUS_OFFSET));
clean_irq_status(ctx->irq_status, addr);