video: driver: fix faulty msm_vidc_vmem_alloc() failures

Sometimes uninitialized local pointer variables were passed to
msm_vidc_vmem_alloc() call for allocating memory. Uninitialized
variables might garbage value, so msm_vidc_vmem_alloc() is
treating that double alloc request and returning error. So i.e
leading to undefined behaviour.

For e.x, msm_vidc_update_input_cr() call will never add any
entries into &inst->enc_input_crs(due to above mentioned issue),
So i.e leading to populate invalid input compression ratio in
encoder usecase.

Change-Id: I4507b343bee8eec7252cf946ad8d3120efd7bacb
Signed-off-by: Govindaraj Rajagopal <quic_grajagop@quicinc.com>
Цей коміт міститься в:
Govindaraj Rajagopal
2022-06-16 19:27:20 +05:30
джерело a753289adb
коміт e433d223a6
7 змінених файлів з 9 додано та 9 видалено

Переглянути файл

@@ -349,7 +349,7 @@ int msm_vidc_deinit_platform(struct platform_device *pdev)
int msm_vidc_init_platform(struct platform_device *pdev)
{
int rc = 0;
struct msm_vidc_platform *platform;
struct msm_vidc_platform *platform = NULL;
struct msm_vidc_core *core;
if (!pdev) {

Переглянути файл

@@ -855,7 +855,7 @@ EXPORT_SYMBOL(msm_vidc_dqevent);
void *msm_vidc_open(void *vidc_core, u32 session_type)
{
int rc = 0;
struct msm_vidc_inst *inst;
struct msm_vidc_inst *inst = NULL;
struct msm_vidc_core *core;
int i = 0;

Переглянути файл

@@ -257,7 +257,7 @@ static inline bool is_all_parents_visited(
static int add_node_list(struct list_head *list, enum msm_vidc_inst_capability_type cap_id)
{
int rc = 0;
struct msm_vidc_inst_cap_entry *entry;
struct msm_vidc_inst_cap_entry *entry = NULL;
rc = msm_vidc_vmem_alloc(sizeof(struct msm_vidc_inst_cap_entry),
(void **)&entry, __func__);

Переглянути файл

@@ -165,7 +165,7 @@ static ssize_t core_info_read(struct file* file, char __user* buf,
size_t count, loff_t* ppos)
{
struct msm_vidc_core *core = file->private_data;
char* dbuf, * cur, * end;
char *cur, *end, *dbuf = NULL;
ssize_t len = 0;
int rc = 0;
@@ -432,7 +432,7 @@ static ssize_t inst_info_read(struct file *file, char __user *buf,
struct core_inst_pair *idata = file->private_data;
struct msm_vidc_core *core;
struct msm_vidc_inst *inst;
char *dbuf, *cur, *end;
char *cur, *end, *dbuf = NULL;
int i, j;
ssize_t len = 0;
struct v4l2_format *f;
@@ -452,7 +452,7 @@ static ssize_t inst_info_read(struct file *file, char __user *buf,
return 0;
}
if (msm_vidc_vmem_alloc(MAX_DBG_BUF_SIZE, (void **) &dbuf, __func__)) {
if (msm_vidc_vmem_alloc(MAX_DBG_BUF_SIZE, (void **)&dbuf, __func__)) {
len = -ENOMEM;
goto failed_alloc;
}

Переглянути файл

@@ -52,7 +52,7 @@ static const struct dma_fence_ops msm_vidc_dma_fence_ops = {
struct msm_vidc_fence *msm_vidc_fence_create(struct msm_vidc_inst *inst)
{
struct msm_vidc_fence *fence;
struct msm_vidc_fence *fence = NULL;
int rc = 0;
if (!inst) {

Переглянути файл

@@ -473,7 +473,7 @@ int msm_vidc_memory_free(struct msm_vidc_core *core, struct msm_vidc_alloc *mem)
void *msm_memory_pool_alloc(struct msm_vidc_inst *inst, enum msm_memory_pool_type type)
{
struct msm_memory_alloc_header *hdr;
struct msm_memory_alloc_header *hdr = NULL;
struct msm_memory_pool *pool;
if (!inst || type < 0 || type >= MSM_MEM_POOL_MAX) {

Переглянути файл

@@ -1882,7 +1882,7 @@ void handle_session_response_work_handler(struct work_struct *work)
static int queue_response_work(struct msm_vidc_inst *inst,
enum response_work_type type, void *hdr, u32 hdr_size)
{
struct response_work *work;
struct response_work *work = NULL;
if (msm_vidc_vmem_alloc(sizeof(struct response_work), (void **)&work, __func__))
return -ENOMEM;