[PATCH v2, 0/2] fix coverity issues in encoder driver

[PATCH v2, 0/2] fix coverity issues in encoder driver

[Irui Wang]

two coverity issues in encoder driver, submit two changes for fix them.

changes compared with v1:
- separate into two changes.
---

Irui Wang (2):
  media: mediatek: vcodec: make sure array index is in valid range
  media: mediatek: vcodec: make sure pointer isn't NULL before used

 .../platform/mediatek/vcodec/mtk_vcodec_enc.c    |  2 +-
 .../mediatek/vcodec/mtk_vcodec_enc_drv.c         | 16 ++++++++++++----
 2 files changed, 13 insertions(+), 5 deletions(-)

-- 
2.18.0

[PATCH v2, 1/2] media: mediatek: vcodec: make sure array index is in valid range

[Irui Wang]

CERT-C Characters and Strings:
dev->reg_base[dev->venc_pdata->core_id] evaluates to an address
that could be at negative offset of an array, check core id is
in valid range.

Signed-off-by: Irui Wang <irui.wang@mediatek.com>
---
 .../mediatek/vcodec/mtk_vcodec_enc_drv.c         | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c
index 9095186d5495..125d5722d07b 100644
--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c
+++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c
@@ -89,16 +89,24 @@ static irqreturn_t mtk_vcodec_enc_irq_handler(int irq, void *priv)
 	struct mtk_vcodec_ctx *ctx;
 	unsigned long flags;
 	void __iomem *addr;
+	int core_id;
 
 	spin_lock_irqsave(&dev->irqlock, flags);
 	ctx = dev->curr_ctx;
 	spin_unlock_irqrestore(&dev->irqlock, flags);
 
-	mtk_v4l2_debug(1, "id=%d coreid:%d", ctx->id, dev->venc_pdata->core_id);
-	addr = dev->reg_base[dev->venc_pdata->core_id] +
-				MTK_VENC_IRQ_ACK_OFFSET;
+	core_id = dev->venc_pdata->core_id;
+	if (core_id < 0 || core_id >= NUM_MAX_VCODEC_REG_BASE) {
+		mtk_v4l2_err("Invalid core id: %d, ctx id: %d",
+			     core_id, ctx->id);
+		return IRQ_HANDLED;
+	}
+
+	mtk_v4l2_debug(1, "id: %d, core id: %d", ctx->id, core_id);
+
+	addr = dev->reg_base[core_id] + MTK_VENC_IRQ_ACK_OFFSET;
 
-	ctx->irq_status = readl(dev->reg_base[dev->venc_pdata->core_id] +
+	ctx->irq_status = readl(dev->reg_base[core_id] +
 				(MTK_VENC_IRQ_STATUS_OFFSET));
 
 	clean_irq_status(ctx->irq_status, addr);
-- 
2.18.0

[PATCH v2, 2/2] media: mediatek: vcodec: make sure pointer isn't NULL before used

[Irui Wang]

CERT-C Expression check:
Dereferencing buf, which is known to be NULL, check buf is not NULL
before used.

Signed-off-by: Irui Wang <irui.wang@mediatek.com>
---
 drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
index d65800a3b89d..db65e77bd373 100644
--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
+++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
@@ -943,7 +943,7 @@ static int vb2ops_venc_start_streaming(struct vb2_queue *q, unsigned int count)
 		 * FIXME: This check is not needed as only active buffers
 		 * can be marked as done.
 		 */
-		if (buf->state == VB2_BUF_STATE_ACTIVE) {
+		if (buf && buf->state == VB2_BUF_STATE_ACTIVE) {
 			mtk_v4l2_debug(0, "[%d] id=%d, type=%d, %d -> VB2_BUF_STATE_QUEUED",
 					ctx->id, i, q->type,
 					(int)buf->state);
-- 
2.18.0

Re: [PATCH v2, 0/2] fix coverity issues in encoder driver

[Yunfei Dong (董云飞)]

Hi Irui,

On Tue, 2023-04-11 at 13:54 +0800, Irui Wang wrote:
> two coverity issues in encoder driver, submit two changes for fix
> them.
> 
Maybe better:

Submit two changes to fix two kind of coverity issues in encoder
driver.

Best Regards,
Yunfei Dong
> changes compared with v1:
> - separate into two changes.
> ---
> 
> Irui Wang (2):
>   media: mediatek: vcodec: make sure array index is in valid range
>   media: mediatek: vcodec: make sure pointer isn't NULL before used
> 
>  .../platform/mediatek/vcodec/mtk_vcodec_enc.c    |  2 +-
>  .../mediatek/vcodec/mtk_vcodec_enc_drv.c         | 16 ++++++++++++
> ----
>  2 files changed, 13 insertions(+), 5 deletions(-)
> 

Re: [PATCH v2, 2/2] media: mediatek: vcodec: make sure pointer isn't NULL before used

[Yunfei Dong (董云飞)]

Hi Irui,

On Tue, 2023-04-11 at 13:54 +0800, Irui Wang wrote:
> CERT-C Expression check:
> Dereferencing buf, which is known to be NULL, check buf is not NULL
> before used.
> 
Whether 'dereferencing buf' is one kind of CERT-C Expression check?
You can re-write commit message and subject.

CERT-C Expression check (Dereferencing buf):
Making sure the pointer is not NULL before to be used.

Best Regards,
Yunfei Dong
> Signed-off-by: Irui Wang <irui.wang@mediatek.com>
> ---
>  drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
> b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
> index d65800a3b89d..db65e77bd373 100644
> --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
> +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
> @@ -943,7 +943,7 @@ static int vb2ops_venc_start_streaming(struct
> vb2_queue *q, unsigned int count)
>  		 * FIXME: This check is not needed as only active
> buffers
>  		 * can be marked as done.
>  		 */
> -		if (buf->state == VB2_BUF_STATE_ACTIVE) {
> +		if (buf && buf->state == VB2_BUF_STATE_ACTIVE) {
>  			mtk_v4l2_debug(0, "[%d] id=%d, type=%d, %d ->
> VB2_BUF_STATE_QUEUED",
>  					ctx->id, i, q->type,
>  					(int)buf->state);

Re: [PATCH v2, 2/2] media: mediatek: vcodec: make sure pointer isn't NULL before used

[Irui Wang (王瑞)]

Dear Yunfei,

Thanks for your reviewing.

On Tue, 2023-04-11 at 07:22 +0000, Yunfei Dong (董云飞) wrote:
> Hi Irui,
> 
> On Tue, 2023-04-11 at 13:54 +0800, Irui Wang wrote:
> > CERT-C Expression check:
> > Dereferencing buf, which is known to be NULL, check buf is not NULL
> > before used.
> > 
> 
> Whether 'dereferencing buf' is one kind of CERT-C Expression check?
> You can re-write commit message and subject.
> 
> CERT-C Expression check (Dereferencing buf):
no, 'buf' is the used variable name, this coverity is 'Dereference null
return value(NULL RETURNS)' .
> Making sure the pointer is not NULL before to be used.
> 
> Best Regards,
> Yunfei Dong

Thanks
Best Regards
> > Signed-off-by: Irui Wang <irui.wang@mediatek.com>
> > ---
> >  drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git
> > a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
> > b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
> > index d65800a3b89d..db65e77bd373 100644
> > --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
> > +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc.c
> > @@ -943,7 +943,7 @@ static int vb2ops_venc_start_streaming(struct
> > vb2_queue *q, unsigned int count)
> >  		 * FIXME: This check is not needed as only active
> > buffers
> >  		 * can be marked as done.
> >  		 */
> > -		if (buf->state == VB2_BUF_STATE_ACTIVE) {
> > +		if (buf && buf->state == VB2_BUF_STATE_ACTIVE) {
> >  			mtk_v4l2_debug(0, "[%d] id=%d, type=%d, %d ->
> > VB2_BUF_STATE_QUEUED",
> >  					ctx->id, i, q->type,
> >  					(int)buf->state);

Re: [PATCH v2, 1/2] media: mediatek: vcodec: make sure array index is in valid range

[Alexandre Mergnat]

On 11/04/2023 07:54, Irui Wang wrote:
> CERT-C Characters and Strings:
> dev->reg_base[dev->venc_pdata->core_id] evaluates to an address
> that could be at negative offset of an array, check core id is
> in valid range.

Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>