From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>,
Hans Verkuil <hverkuil@xs4all.nl>,
Sasha Levin <sashal@kernel.org>,
gregkh@linuxfoundation.org, linux-media@vger.kernel.org,
devel@driverdev.osuosl.org
Subject: [PATCH AUTOSEL 5.10 36/37] media: atomisp: fix bad usage at error handling logic
Date: Wed, 30 Mar 2022 07:51:21 -0400 [thread overview]
Message-ID: <20220330115122.1671763-36-sashal@kernel.org> (raw)
In-Reply-To: <20220330115122.1671763-1-sashal@kernel.org>
From: Mauro Carvalho Chehab <mchehab@kernel.org>
[ Upstream commit fc0b582c858ed73f94c8f3375c203ea46f1f7402 ]
As warned by sparse:
atomisp: drivers/staging/media/atomisp/pci/atomisp_acc.c:508 atomisp_acc_load_extensions() warn: iterator used outside loop: 'acc_fw'
The acc_fw interactor is used outside the loop, at the error handling
logic. On most cases, this is actually safe there, but, if
atomisp_css_set_acc_parameters() has an error, an attempt to use it
will pick an invalid value for acc_fw.
Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../staging/media/atomisp/pci/atomisp_acc.c | 28 +++++++++++++------
1 file changed, 19 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_acc.c b/drivers/staging/media/atomisp/pci/atomisp_acc.c
index f638d0bd09fe..b1614cce2dfb 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_acc.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_acc.c
@@ -439,6 +439,18 @@ int atomisp_acc_s_mapped_arg(struct atomisp_sub_device *asd,
return 0;
}
+static void atomisp_acc_unload_some_extensions(struct atomisp_sub_device *asd,
+ int i,
+ struct atomisp_acc_fw *acc_fw)
+{
+ while (--i >= 0) {
+ if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
+ atomisp_css_unload_acc_extension(asd, acc_fw->fw,
+ acc_flag_to_pipe[i].pipe_id);
+ }
+ }
+}
+
/*
* Appends the loaded acceleration binary extensions to the
* current ISP mode. Must be called just before sh_css_start().
@@ -477,16 +489,20 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
acc_fw->fw,
acc_flag_to_pipe[i].pipe_id,
acc_fw->type);
- if (ret)
+ if (ret) {
+ atomisp_acc_unload_some_extensions(asd, i, acc_fw);
goto error;
+ }
ext_loaded = true;
}
}
ret = atomisp_css_set_acc_parameters(acc_fw);
- if (ret < 0)
+ if (ret < 0) {
+ atomisp_acc_unload_some_extensions(asd, i, acc_fw);
goto error;
+ }
}
if (!ext_loaded)
@@ -495,6 +511,7 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
ret = atomisp_css_update_stream(asd);
if (ret) {
dev_err(isp->dev, "%s: update stream failed.\n", __func__);
+ atomisp_acc_unload_extensions(asd);
goto error;
}
@@ -502,13 +519,6 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
return 0;
error:
- while (--i >= 0) {
- if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
- atomisp_css_unload_acc_extension(asd, acc_fw->fw,
- acc_flag_to_pipe[i].pipe_id);
- }
- }
-
list_for_each_entry_continue_reverse(acc_fw, &asd->acc.fw, list) {
if (acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_OUTPUT &&
acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_VIEWFINDER)
--
2.34.1
next prev parent reply other threads:[~2022-03-30 12:14 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-30 11:50 [PATCH AUTOSEL 5.10 01/37] media: staging: media: zoran: move videodev alloc Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 02/37] media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 03/37] media: staging: media: zoran: fix various V4L2 compliance errors Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 04/37] media: ir_toy: free before error exiting Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 05/37] ASoC: SOF: Intel: hda: Remove link assignment limitation Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 06/37] video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 07/37] video: fbdev: w100fb: Reset global state Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 08/37] video: fbdev: cirrusfb: check pixclock to avoid divide by zero Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 09/37] video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 10/37] ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 11/37] ARM: dts: bcm2837: Add the missing L1/L2 cache information Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 12/37] ASoC: madera: Add dependencies on MFD Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 13/37] media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards Sasha Levin
2022-03-30 11:50 ` [PATCH AUTOSEL 5.10 14/37] media: atomisp: fix dummy_ptr check to avoid duplicate active_bo Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 15/37] ARM: ftrace: avoid redundant loads or clobbering IP Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 16/37] ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 17/37] arm64: defconfig: build imx-sdma as a module Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 18/37] video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 19/37] video: fbdev: omapfb: panel-tpo-td043mtea1: " Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 20/37] video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 21/37] ARM: dts: bcm2711: Add the missing L1/L2 cache information Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 22/37] printk: Add panic_in_progress helper Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 23/37] ASoC: soc-core: skip zero num_dai component in searching dai name Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 24/37] printk: use atomic updates for klogd work Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 25/37] media: cx88-mpeg: clear interrupt status register before streaming video Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 26/37] uaccess: fix type mismatch warnings from access_ok() Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 27/37] lib/test_lockup: fix kernel pointer check for separate address spaces Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 28/37] ARM: tegra: tamonten: Fix I2C3 pad setting Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 29/37] ARM: mmp: Fix failure to remove sram device Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 30/37] video: fbdev: sm712fb: Fix crash in smtcfb_write() Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 31/37] media: Revert "media: em28xx: add missing em28xx_close_extension" Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 32/37] media: hdpvr: initialize dev->worker at hdpvr_register_videodev Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 33/37] tracing: Have TRACE_DEFINE_ENUM affect trace event types as well Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 34/37] mmc: host: Return an error when ->enable_sdio_irq() ops is missing Sasha Levin
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 35/37] ASoC: ak4642: Use of_device_get_match_data() Sasha Levin
2022-03-30 11:51 ` Sasha Levin [this message]
2022-03-30 11:51 ` [PATCH AUTOSEL 5.10 37/37] ALSA: hda/realtek: Add alc256-samsung-headphone fixup Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220330115122.1671763-36-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=hverkuil@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).