mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-15 07:04:44 +00:00
Code Issues Releases Wiki Activity

media: atomisp: fix bad usage at error handling logic

Browse source 
[ Upstream commit fc0b582c85 ]

As warned by sparse:
	atomisp: drivers/staging/media/atomisp/pci/atomisp_acc.c:508 atomisp_acc_load_extensions() warn: iterator used outside loop: 'acc_fw'

The acc_fw interactor is used outside the loop, at the error handling
logic. On most cases, this is actually safe there, but, if
atomisp_css_set_acc_parameters() has an error, an attempt to use it
will pick an invalid value for acc_fw.

Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Mauro Carvalho Chehab 2022-03-14 18:11:38 +01:00 committed by Greg Kroah-Hartman
parent 251a11699f
commit fe440221ca
1 changed files with 19 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
drivers/staging/media/atomisp/pci/atomisp_acc.c
View file

@ -439,6 +439,18 @@ int atomisp_acc_s_mapped_arg(struct atomisp_sub_device *asd,
return 0;
}
static void atomisp_acc_unload_some_extensions(struct atomisp_sub_device *asd,
int i,
struct atomisp_acc_fw *acc_fw)
{
while (--i >= 0) {
if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
atomisp_css_unload_acc_extension(asd, acc_fw->fw,
acc_flag_to_pipe[i].pipe_id);
}
}
}
/*
* Appends the loaded acceleration binary extensions to the
* current ISP mode. Must be called just before sh_css_start().
@ -479,16 +491,20 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
acc_fw->fw,
acc_flag_to_pipe[i].pipe_id,
acc_fw->type);
if (ret)
if (ret) {
atomisp_acc_unload_some_extensions(asd, i, acc_fw);
goto error;
}
ext_loaded = true;
}
}
ret = atomisp_css_set_acc_parameters(acc_fw);
if (ret < 0)
if (ret < 0) {
atomisp_acc_unload_some_extensions(asd, i, acc_fw);
goto error;
}
}
if (!ext_loaded)
@ -497,6 +513,7 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
ret = atomisp_css_update_stream(asd);
if (ret) {
dev_err(isp->dev, "%s: update stream failed.\n", __func__);
atomisp_acc_unload_extensions(asd);
goto error;
}
@ -504,13 +521,6 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
return 0;
error:
while (--i >= 0) {
if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
atomisp_css_unload_acc_extension(asd, acc_fw->fw,
acc_flag_to_pipe[i].pipe_id);
}
}
list_for_each_entry_continue_reverse(acc_fw, &asd->acc.fw, list) {
if (acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_OUTPUT &&
acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_VIEWFINDER)