xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: atomisp: fix bad usage at error handling logic

Browse Source 
[ Upstream commit fc0b582c858ed73f94c8f3375c203ea46f1f7402 ]

As warned by sparse:
	atomisp: drivers/staging/media/atomisp/pci/atomisp_acc.c:508 atomisp_acc_load_extensions() warn: iterator used outside loop: 'acc_fw'

The acc_fw interactor is used outside the loop, at the error handling
logic. On most cases, this is actually safe there, but, if
atomisp_css_set_acc_parameters() has an error, an attempt to use it
will pick an invalid value for acc_fw.

Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Mauro Carvalho Chehab
2022-03-14 18:11:38 +01:00
committed by Greg Kroah-Hartman
parent 2412a5d294
commit aa2ad067cd
1 changed files with 19 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/staging/media/atomisp/pci/atomisp_acc.c
View File

@@ -439,6 +439,18 @@ int atomisp_acc_s_mapped_arg(struct atomisp_sub_device *asd,
return 0; return 0;
} }
static void atomisp_acc_unload_some_extensions(struct atomisp_sub_device *asd,
int i,
struct atomisp_acc_fw *acc_fw)
{
while (--i >= 0) {
if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
atomisp_css_unload_acc_extension(asd, acc_fw->fw,
acc_flag_to_pipe[i].pipe_id);
}
}
}
/* /*
* Appends the loaded acceleration binary extensions to the * Appends the loaded acceleration binary extensions to the
* current ISP mode. Must be called just before sh_css_start(). * current ISP mode. Must be called just before sh_css_start().
@@ -477,16 +489,20 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
acc_fw->fw, acc_fw->fw,
acc_flag_to_pipe[i].pipe_id, acc_flag_to_pipe[i].pipe_id,
acc_fw->type); acc_fw->type);
if (ret) if (ret) {
atomisp_acc_unload_some_extensions(asd, i, acc_fw);
goto error; goto error;
}
ext_loaded = true; ext_loaded = true;
} }
} }
ret = atomisp_css_set_acc_parameters(acc_fw); ret = atomisp_css_set_acc_parameters(acc_fw);
if (ret < 0) if (ret < 0) {
atomisp_acc_unload_some_extensions(asd, i, acc_fw);
goto error; goto error;
}
} }
if (!ext_loaded) if (!ext_loaded)
@@ -495,6 +511,7 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
ret = atomisp_css_update_stream(asd); ret = atomisp_css_update_stream(asd);
if (ret) { if (ret) {
dev_err(isp->dev, "%s: update stream failed.\n", __func__); dev_err(isp->dev, "%s: update stream failed.\n", __func__);
atomisp_acc_unload_extensions(asd);
goto error; goto error;
} }
@@ -502,13 +519,6 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
return 0; return 0;
error: error:
while (--i >= 0) {
if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
atomisp_css_unload_acc_extension(asd, acc_fw->fw,
acc_flag_to_pipe[i].pipe_id);
}
}
list_for_each_entry_continue_reverse(acc_fw, &asd->acc.fw, list) { list_for_each_entry_continue_reverse(acc_fw, &asd->acc.fw, list) {
if (acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_OUTPUT && if (acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_OUTPUT &&
acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_VIEWFINDER) acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_VIEWFINDER)