coda: update CODA7541 to firmware 1.4.50

media Dan Carpenter 2 participants 3 messages Nov 6, 2013 – Apr 11, 2014 Media (V4L/DVB)

lore

Share & tools

lore

Dan Carpenter

author

2013-11-06 16:14 UTC #0 lore raw

Hello Philipp Zabel,

This is a semi-automatic email about new static checker warnings.

The patch 5677e3b04d3b: "[media] coda: update CODA7541 to firmware 1.4.50" from Jun 21, 2013, leads to the following Smatch complaint:

drivers/media/platform/coda.c:1530 coda_alloc_framebuffers()

	 error: we previously assumed 'ctx->codec' could be null (see line 1521)

drivers/media/platform/coda.c
1520
1521 if (ctx->codec && ctx->codec->src_fourcc == V4L2_PIX_FMT_H264)

                    ^^^^^^^^^^

Patch introduces a new NULL check.

1522 height = round_up(height, 16);
1523 ysize = round_up(q_data->width, 8) * height;
1524
1525 /* Allocate frame buffers */
1526 for (i = 0; i < ctx->num_internal_frames; i++) {
1527 size_t size;
1528
1529 size = q_data->sizeimage;
1530 if (ctx->codec->src_fourcc == V4L2_PIX_FMT_H264 &&

                            ^^^^^^^^^^^^^^^^^^^^^^

Patch introduces a new unchecked dereference.

  1531			    dev->devtype->product != CODA_DX6)
  1532				ctx->internal_frames[i].size += ysize/4;

regards,
dan carpenter

Dan Carpenter

author

2014-04-11 11:08 UTC #1 lore raw

What ever happened with this?

regards,
dan carpenter

Quoted 33 lines · Dan Carpenter

Hello Philipp Zabel,
This is a semi-automatic email about new static checker warnings.
The patch 5677e3b04d3b: "[media] coda: update CODA7541 to firmware 1.4.50" from Jun 21, 2013, leads to the following Smatch complaint:
drivers/media/platform/coda.c:1530 coda_alloc_framebuffers()
	 error: we previously assumed 'ctx->codec' could be null (see line 1521)
drivers/media/platform/coda.c
1520
1521 if (ctx->codec && ctx->codec->src_fourcc == V4L2_PIX_FMT_H264)
                    ^^^^^^^^^^
Patch introduces a new NULL check.
1522 height = round_up(height, 16);
1523 ysize = round_up(q_data->width, 8) * height;
1524
1525 /* Allocate frame buffers */
1526 for (i = 0; i < ctx->num_internal_frames; i++) {
1527 size_t size;
1528
1529 size = q_data->sizeimage;
1530 if (ctx->codec->src_fourcc == V4L2_PIX_FMT_H264 &&
                            ^^^^^^^^^^^^^^^^^^^^^^
Patch introduces a new unchecked dereference.
  1531			    dev->devtype->product != CODA_DX6)
  1532				ctx->internal_frames[i].size += ysize/4;
regards,
dan carpenter

Fabio Estevam

2014-04-11 13:04 UTC #2 lore raw

Hi Dan/Philipp,

Quoted 36 lines · Dan Carpenter

What ever happened with this?
regards,
dan carpenter
Quoted 30 lines · Dan Carpenter
Hello Philipp Zabel,
This is a semi-automatic email about new static checker warnings.
The patch 5677e3b04d3b: "[media] coda: update CODA7541 to firmware 1.4.50" from Jun 21, 2013, leads to the following Smatch complaint:
drivers/media/platform/coda.c:1530 coda_alloc_framebuffers()
       error: we previously assumed 'ctx->codec' could be null (see line 1521)
drivers/media/platform/coda.c
1520
1521 if (ctx->codec && ctx->codec->src_fourcc == V4L2_PIX_FMT_H264)
                    ^^^^^^^^^^
Patch introduces a new NULL check.
1522 height = round_up(height, 16);
1523 ysize = round_up(q_data->width, 8) * height;
1524
1525 /* Allocate frame buffers */
1526 for (i = 0; i < ctx->num_internal_frames; i++) {
1527 size_t size;
1528
1529 size = q_data->sizeimage;
1530 if (ctx->codec->src_fourcc == V4L2_PIX_FMT_H264 &&
                            ^^^^^^^^^^^^^^^^^^^^^^
Patch introduces a new unchecked dereference.
  1531                            dev->devtype->product != CODA_DX6)
  1532                                ctx->internal_frames[i].size += ysize/4;

Would the fix below address this issue?

drivers/media/platform/coda.c +4 -1

@@ -1518,7 +1518,10 @@ static int coda_alloc_framebuffers(struct coda_ctx *ctx,
        int ret;
        int i;
 
-       if (ctx->codec && ctx->codec->src_fourcc == V4L2_PIX_FMT_H264)
+       if (!ctx->codec)
+               return -EINVAL;
+
+       if (ctx->codec->src_fourcc == V4L2_PIX_FMT_H264)
                height = round_up(height, 16);
        ysize = round_up(q_data->width, 8) * height;