Commit e17c120f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'array-bounds-fixes-5.14-rc1' of... 

Merge tag 'array-bounds-fixes-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux

Pull array-bounds fixes from Gustavo Silva:
 "Fix an out-of-bounds warning in the media subsystem.

  This is part of the ongoing efforts to globally enable -Warray-bounds"

* tag 'array-bounds-fixes-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux:
  media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2()
parents 8ec035ac 13dfead4

drivers/media/common/siano/smscoreapi.c

+9 −13
Original line number Diff line number Diff line
@@ -908,7 +908,7 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev, 
					 void *buffer, size_t size)

{

	struct sms_firmware *firmware = (struct sms_firmware *) buffer;

	struct sms_msg_data4 *msg;

	struct sms_msg_data5 *msg;

	u32 mem_address,  calc_checksum = 0;

	u32 i, *ptr;

	u8 *payload = firmware->payload;
@@ -989,24 +989,20 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev, 
		goto exit_fw_download;



	if (coredev->mode == DEVICE_MODE_NONE) {

		struct sms_msg_data *trigger_msg =

			(struct sms_msg_data *) msg;



		pr_debug("sending MSG_SMS_SWDOWNLOAD_TRIGGER_REQ\n");

		SMS_INIT_MSG(&msg->x_msg_header,

				MSG_SMS_SWDOWNLOAD_TRIGGER_REQ,

				sizeof(struct sms_msg_hdr) +

				sizeof(u32) * 5);

				sizeof(*msg));



		trigger_msg->msg_data[0] = firmware->start_address;

		msg->msg_data[0] = firmware->start_address;

					/* Entry point */

		trigger_msg->msg_data[1] = 6; /* Priority */

		trigger_msg->msg_data[2] = 0x200; /* Stack size */

		trigger_msg->msg_data[3] = 0; /* Parameter */

		trigger_msg->msg_data[4] = 4; /* Task ID */

		msg->msg_data[1] = 6; /* Priority */

		msg->msg_data[2] = 0x200; /* Stack size */

		msg->msg_data[3] = 0; /* Parameter */

		msg->msg_data[4] = 4; /* Task ID */



		rc = smscore_sendrequest_and_wait(coredev, trigger_msg,

					trigger_msg->x_msg_header.msg_length,

		rc = smscore_sendrequest_and_wait(coredev, msg,

					msg->x_msg_header.msg_length,

					&coredev->trigger_done);

	} else {

		SMS_INIT_MSG(&msg->x_msg_header, MSG_SW_RELOAD_EXEC_REQ,

drivers/media/common/siano/smscoreapi.h

+2 −2
Original line number Diff line number Diff line
@@ -624,9 +624,9 @@ struct sms_msg_data2 { 
	u32 msg_data[2];

};



struct sms_msg_data4 {

struct sms_msg_data5 {

	struct sms_msg_hdr x_msg_header;

	u32 msg_data[4];

	u32 msg_data[5];

};



struct sms_data_download {