Commit bb02a201 authored by Irui Wang's avatar Irui Wang Committed by Mauro Carvalho Chehab
Browse files

media: mediatek: vcodec: Coverity issues in encoder driver 



CERT-C Characters and Strings:
check core id is in valid range:
dev->reg_base[dev->venc_pdata->core_id] evaluates to an address
that could be at negative offset of an array.

CERT-C Expression:
check buf is not NULL before used:
Dereferencing buf, which is known to be NULL.

Signed-off-by: default avatarIrui Wang <irui.wang@mediatek.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent 8fbcf730

drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c

+1 −1
Original line number Diff line number Diff line
@@ -943,7 +943,7 @@ static int vb2ops_venc_start_streaming(struct vb2_queue *q, unsigned int count) 
		 * FIXME: This check is not needed as only active buffers

		 * can be marked as done.

		 */

		if (buf->state == VB2_BUF_STATE_ACTIVE) {

		if (buf && buf->state == VB2_BUF_STATE_ACTIVE) {

			mtk_v4l2_debug(0, "[%d] id=%d, type=%d, %d -> VB2_BUF_STATE_QUEUED",

					ctx->id, i, q->type,

					(int)buf->state);

drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c

+12 −4
Original line number Diff line number Diff line
@@ -89,16 +89,24 @@ static irqreturn_t mtk_vcodec_enc_irq_handler(int irq, void *priv) 
	struct mtk_vcodec_ctx *ctx;

	unsigned long flags;

	void __iomem *addr;

	int core_id;



	spin_lock_irqsave(&dev->irqlock, flags);

	ctx = dev->curr_ctx;

	spin_unlock_irqrestore(&dev->irqlock, flags);



	mtk_v4l2_debug(1, "id=%d coreid:%d", ctx->id, dev->venc_pdata->core_id);

	addr = dev->reg_base[dev->venc_pdata->core_id] +

				MTK_VENC_IRQ_ACK_OFFSET;

	core_id = dev->venc_pdata->core_id;

	if (core_id < 0 || core_id >= NUM_MAX_VCODEC_REG_BASE) {

		mtk_v4l2_err("Invalid core id: %d, ctx id: %d",

			     core_id, ctx->id);

		return IRQ_HANDLED;

	}



	mtk_v4l2_debug(1, "id: %d, core id: %d", ctx->id, core_id);



	addr = dev->reg_base[core_id] + MTK_VENC_IRQ_ACK_OFFSET;



	ctx->irq_status = readl(dev->reg_base[dev->venc_pdata->core_id] +

	ctx->irq_status = readl(dev->reg_base[core_id] +

				(MTK_VENC_IRQ_STATUS_OFFSET));



	clean_irq_status(ctx->irq_status, addr);