diff options
| author | Irui Wang <irui.wang@mediatek.com> | 2023-04-03 12:43:42 +0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@kernel.org> | 2023-04-15 10:39:22 +0300 |
| commit | bb02a201b63e6ae80a412b1673e9888d30ca5d1a (patch) | |
| tree | ec224a46aa4a629e77f22b8678df27163a131d9b | |
| parent | 8fbcf730cb89c3647f3365226fe7014118fa93c7 (diff) | |
| download | linux-bb02a201b63e6ae80a412b1673e9888d30ca5d1a.tar.xz | |
media: mediatek: vcodec: Coverity issues in encoder driver
CERT-C Characters and Strings:
check core id is in valid range:
dev->reg_base[dev->venc_pdata->core_id] evaluates to an address
that could be at negative offset of an array.
CERT-C Expression:
check buf is not NULL before used:
Dereferencing buf, which is known to be NULL.
Signed-off-by: Irui Wang <irui.wang@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
| -rw-r--r-- | drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c | 2 | ||||
| -rw-r--r-- | drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c | 16 |
2 files changed, 13 insertions, 5 deletions
diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c index d65800a3b89d..db65e77bd373 100644 --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c @@ -943,7 +943,7 @@ err_start_stream: * FIXME: This check is not needed as only active buffers * can be marked as done. */ - if (buf->state == VB2_BUF_STATE_ACTIVE) { + if (buf && buf->state == VB2_BUF_STATE_ACTIVE) { mtk_v4l2_debug(0, "[%d] id=%d, type=%d, %d -> VB2_BUF_STATE_QUEUED", ctx->id, i, q->type, (int)buf->state); diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c index 997108da687c..755f567b9e54 100644 --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c @@ -89,16 +89,24 @@ static irqreturn_t mtk_vcodec_enc_irq_handler(int irq, void *priv) struct mtk_vcodec_ctx *ctx; unsigned long flags; void __iomem *addr; + int core_id; spin_lock_irqsave(&dev->irqlock, flags); ctx = dev->curr_ctx; spin_unlock_irqrestore(&dev->irqlock, flags); - mtk_v4l2_debug(1, "id=%d coreid:%d", ctx->id, dev->venc_pdata->core_id); - addr = dev->reg_base[dev->venc_pdata->core_id] + - MTK_VENC_IRQ_ACK_OFFSET; + core_id = dev->venc_pdata->core_id; + if (core_id < 0 || core_id >= NUM_MAX_VCODEC_REG_BASE) { + mtk_v4l2_err("Invalid core id: %d, ctx id: %d", + core_id, ctx->id); + return IRQ_HANDLED; + } + + mtk_v4l2_debug(1, "id: %d, core id: %d", ctx->id, core_id); + + addr = dev->reg_base[core_id] + MTK_VENC_IRQ_ACK_OFFSET; - ctx->irq_status = readl(dev->reg_base[dev->venc_pdata->core_id] + + ctx->irq_status = readl(dev->reg_base[core_id] + (MTK_VENC_IRQ_STATUS_OFFSET)); clean_irq_status(ctx->irq_status, addr); |