media: mtk-mdp: use IS_ERR to check return value of of_clk_get
Function of_clk_get() returns an ERR_PTR on failures. In file
mtk_mdp_commp.c, its return value is checked against NULL. Such checks
cannot prevent from accessing bad memory. This patch replaces the NULL
checks with IS_ERR checks.
Signed-off-by: Pan Bian <bianpan2...@163.com>
---
drivers/media/platform/mtk-mdp/mtk_mdp_comp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_comp.c
b/drivers/media/platform/mtk-mdp/mtk_mdp_comp.c
index aa8f9fd..54bb716 100644
--- a/drivers/media/platform/mtk-mdp/mtk_mdp_comp.c
+++ b/drivers/media/platform/mtk-mdp/mtk_mdp_comp.c
@@ -75,7 +75,7 @@ void mtk_mdp_comp_clock_on(struct device *dev, struct
mtk_mdp_comp *comp)
}
for (i = 0; i < ARRAY_SIZE(comp->clk); i++) {
- if (!comp->clk[i])
+ if (IS_ERR(comp->clk[i]))
continue;
err = clk_prepare_enable(comp->clk[i]);
if (err)
@@ -90,7 +90,7 @@ void mtk_mdp_comp_clock_off(struct device *dev, struct
mtk_mdp_comp *comp)
int i;
for (i = 0; i < ARRAY_SIZE(comp->clk); i++) {
- if (!comp->clk[i])
+ if (IS_ERR(comp->clk[i]))
continue;
clk_disable_unprepare(comp->clk[i]);
}
--
1.9.1
[PATCH 1/1] [media] cx25840: fix unchecked return values
From: Pan Bian <bianpan2...@163.com>
In functions cx25840_initialize(), cx231xx_initialize(), and
cx23885_initialize(), the return value of create_singlethread_workqueue()
is used without validation. This may result in NULL dereference and cause
kernel crash. This patch fixes it.
Signed-off-by: Pan Bian <bianpan2...@163.com>
---
drivers/media/i2c/cx25840/cx25840-core.c | 36 +++-
1 file changed, 21 insertions(+), 15 deletions(-)
diff --git a/drivers/media/i2c/cx25840/cx25840-core.c
b/drivers/media/i2c/cx25840/cx25840-core.c
index b8d3c070..39f51da 100644
--- a/drivers/media/i2c/cx25840/cx25840-core.c
+++ b/drivers/media/i2c/cx25840/cx25840-core.c
@@ -416,11 +416,13 @@ static void cx25840_initialize(struct i2c_client *client)
INIT_WORK(>fw_work, cx25840_work_handler);
init_waitqueue_head(>fw_wait);
q = create_singlethread_workqueue("cx25840_fw");
- prepare_to_wait(>fw_wait, , TASK_UNINTERRUPTIBLE);
- queue_work(q, >fw_work);
- schedule();
- finish_wait(>fw_wait, );
- destroy_workqueue(q);
+ if (q) {
+ prepare_to_wait(>fw_wait, , TASK_UNINTERRUPTIBLE);
+ queue_work(q, >fw_work);
+ schedule();
+ finish_wait(>fw_wait, );
+ destroy_workqueue(q);
+ }
/* 6. */
cx25840_write(client, 0x115, 0x8c);
@@ -630,11 +632,13 @@ static void cx23885_initialize(struct i2c_client *client)
INIT_WORK(>fw_work, cx25840_work_handler);
init_waitqueue_head(>fw_wait);
q = create_singlethread_workqueue("cx25840_fw");
- prepare_to_wait(>fw_wait, , TASK_UNINTERRUPTIBLE);
- queue_work(q, >fw_work);
- schedule();
- finish_wait(>fw_wait, );
- destroy_workqueue(q);
+ if (q) {
+ prepare_to_wait(>fw_wait, , TASK_UNINTERRUPTIBLE);
+ queue_work(q, >fw_work);
+ schedule();
+ finish_wait(>fw_wait, );
+ destroy_workqueue(q);
+ }
/* Call the cx23888 specific std setup func, we no longer rely on
* the generic cx24840 func.
@@ -748,11 +752,13 @@ static void cx231xx_initialize(struct i2c_client *client)
INIT_WORK(>fw_work, cx25840_work_handler);
init_waitqueue_head(>fw_wait);
q = create_singlethread_workqueue("cx25840_fw");
- prepare_to_wait(>fw_wait, , TASK_UNINTERRUPTIBLE);
- queue_work(q, >fw_work);
- schedule();
- finish_wait(>fw_wait, );
- destroy_workqueue(q);
+ if (q) {
+ prepare_to_wait(>fw_wait, , TASK_UNINTERRUPTIBLE);
+ queue_work(q, >fw_work);
+ schedule();
+ finish_wait(>fw_wait, );
+ destroy_workqueue(q);
+ }
cx25840_std_setup(client);
--
1.9.1
[PATCH 1/1] [media] cobalt: fix unchecked return values
From: Pan Bian <bianpan2...@163.com> Function pci_find_ext_capability() may return 0, which is an invalid address. In function cobalt_pcie_status_show(), its return value is used without validation. This patch adds checks to validate the return address. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/media/pci/cobalt/cobalt-driver.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/pci/cobalt/cobalt-driver.c b/drivers/media/pci/cobalt/cobalt-driver.c index d5c911c..f8e173f 100644 --- a/drivers/media/pci/cobalt/cobalt-driver.c +++ b/drivers/media/pci/cobalt/cobalt-driver.c @@ -205,6 +205,8 @@ void cobalt_pcie_status_show(struct cobalt *cobalt) offset = pci_find_capability(pci_dev, PCI_CAP_ID_EXP); bus_offset = pci_find_capability(pci_bus_dev, PCI_CAP_ID_EXP); + if (!offset || !bus_offset) + return; /* Device */ pci_read_config_dword(pci_dev, offset + PCI_EXP_DEVCAP, ); -- 1.9.1
[PATCH 1/1] m5602_s5k83a: check return value of kthread_create
From: Pan Bian <bianpan2...@163.com>
Function kthread_create() returns an ERR_PTR on error. However, in
function s5k83a_start(), its return value is used without validation.
This may result in a bad memory access bug. This patch fixes the bug.
Signed-off-by: Pan Bian <bianpan2...@163.com>
---
drivers/media/usb/gspca/m5602/m5602_s5k83a.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/drivers/media/usb/gspca/m5602/m5602_s5k83a.c
b/drivers/media/usb/gspca/m5602/m5602_s5k83a.c
index be5e25d1..6ad8d48 100644
--- a/drivers/media/usb/gspca/m5602/m5602_s5k83a.c
+++ b/drivers/media/usb/gspca/m5602/m5602_s5k83a.c
@@ -345,6 +345,11 @@ int s5k83a_start(struct sd *sd)
to assume that there is no better way of accomplishing this */
sd->rotation_thread = kthread_create(rotation_thread_function,
sd, "rotation thread");
+ if (IS_ERR(sd->rotation_thread)) {
+ err = PTR_ERR(sd->rotation_thread);
+ sd->rotation_thread = NULL;
+ return err;
+ }
wake_up_process(sd->rotation_thread);
/* Preinit the sensor */
--
1.9.1
[PATCH 1/1] media: pci: meye: set error code on failures
From: Pan Bian <bianpan2...@163.com>
The value of return variable ret is 0 on some error paths, for example,
when pci_resource_start() returns a NULL pointer. 0 means no error in
this context, which is contrary to the fact. This patch fixes the bug.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=189011
Signed-off-by: Pan Bian <bianpan2...@163.com>
---
drivers/media/pci/meye/meye.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c
index ba887e8..115e141 100644
--- a/drivers/media/pci/meye/meye.c
+++ b/drivers/media/pci/meye/meye.c
@@ -1669,6 +1669,7 @@ static int meye_probe(struct pci_dev *pcidev, const
struct pci_device_id *ent)
goto outenabledev;
}
+ ret = -EIO;
mchip_adr = pci_resource_start(meye.mchip_dev,0);
if (!mchip_adr) {
v4l2_err(v4l2_dev, "meye: mchip has no device base address\n");
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH 1/1] media: pci: meye: set error code on failures
From: Pan Bian <bianpan2...@163.com>
The value of return variable ret is 0 on some error paths, for example,
when pci_resource_start() returns a NULL pointer. 0 means no error in
this context, which is contrary to the fact. This patch fixes the bug.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=189011
Signed-off-by: Pan Bian <bianpan2...@163.com>
---
drivers/media/pci/meye/meye.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c
index ba887e8..115e141 100644
--- a/drivers/media/pci/meye/meye.c
+++ b/drivers/media/pci/meye/meye.c
@@ -1669,6 +1669,7 @@ static int meye_probe(struct pci_dev *pcidev, const
struct pci_device_id *ent)
goto outenabledev;
}
+ ret = -EIO;
mchip_adr = pci_resource_start(meye.mchip_dev,0);
if (!mchip_adr) {
v4l2_err(v4l2_dev, "meye: mchip has no device base address\n");
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH 1/1] media: platform: sti: return -ENOMEM on errors
From: Pan Bian <bianpan2...@163.com> Function bdisp_debugfs_create() returns 0 even on errors. So its caller cannot detect the errors. It may be better to return "-ENOMEM" on the exception paths. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188801 Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/media/platform/sti/bdisp/bdisp-debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/sti/bdisp/bdisp-debug.c b/drivers/media/platform/sti/bdisp/bdisp-debug.c index 79c5635..7af6686 100644 --- a/drivers/media/platform/sti/bdisp/bdisp-debug.c +++ b/drivers/media/platform/sti/bdisp/bdisp-debug.c @@ -677,7 +677,7 @@ int bdisp_debugfs_create(struct bdisp_dev *bdisp) err: bdisp_debugfs_remove(bdisp); - return 0; + return -ENOMEM; } void bdisp_debugfs_remove(struct bdisp_dev *bdisp) -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
