From 188b622e75cc9e16ba944f190ec4cb009e6aade2 Mon Sep 17 00:00:00 2001 From: Yuyuan Chen Date: Mon, 6 Jan 2025 02:18:45 +0000 Subject: [PATCH] kernel: nvidia-oot: Fix Static issues S11/27 Fix TAINTED_SCALAR and Directive 4.14 Jira CAMERASW-29899 Change-Id: I1712d392b8271be0db912d536027d960f343e3fe Signed-off-by: Yuyuan Chen Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3273387 Reviewed-by: Sumeet Gupta GVS: buildbot_gerritrpt Reviewed-by: Frank Chen Reviewed-by: Ankur Pawar Tested-by: mobile promotions Reviewed-by: mobile promotions Reviewed-by: Ryan Li --- .../camera/fusa-capture/capture-isp-channel.c | 10 +++++----- .../tegra/camera/fusa-capture/capture-isp.c | 18 +++++++++++++++++- .../camera/fusa-capture/capture-vi-channel.c | 6 +++--- .../tegra/camera/fusa-capture/capture-vi.c | 8 +++++++- 4 files changed, 32 insertions(+), 10 deletions(-) diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c index 102e9904..e698ea94 100644 --- a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c +++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c @@ -1,5 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only -// SPDX-FileCopyrightText: Copyright (c) 2017-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved. /** * @file drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c @@ -335,7 +335,7 @@ static long isp_channel_ioctl( switch (_IOC_NR(cmd)) { case _IOC_NR(ISP_CAPTURE_SETUP): { - struct isp_capture_setup setup; + struct isp_capture_setup setup = {}; if (copy_from_user(&setup, ptr, sizeof(setup))) break; @@ -389,7 +389,7 @@ static long isp_channel_ioctl( } case _IOC_NR(ISP_CAPTURE_REQUEST): { - struct isp_capture_req req; + struct isp_capture_req req = {}; if (copy_from_user(&req, ptr, sizeof(req))) break; @@ -413,7 +413,7 @@ static long isp_channel_ioctl( } case _IOC_NR(ISP_CAPTURE_PROGRAM_REQUEST): { - struct isp_program_req program_req; + struct isp_program_req program_req = {}; if (copy_from_user(&program_req, ptr, sizeof(program_req))) break; @@ -434,7 +434,7 @@ static long isp_channel_ioctl( } case _IOC_NR(ISP_CAPTURE_REQUEST_EX): { - struct isp_capture_req_ex req; + struct isp_capture_req_ex req = {}; if (copy_from_user(&req, ptr, sizeof(req))) break; diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c index 8c3f659d..6365e63f 100644 --- a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c +++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c @@ -1,5 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only -// SPDX-FileCopyrightText: Copyright (c) 2017-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved. /** * @file drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c @@ -578,6 +578,11 @@ static void isp_capture_request_unpin( } mutex_lock(&capture->capture_desc_ctx.unpins_list_lock); + if (buffer_index >= capture->program_desc_ctx.queue_depth) { + dev_err(chan->isp_dev, + "%s: buffer index is out of bound\n", __func__); + return; + } unpins = &capture->capture_desc_ctx.unpins_list[buffer_index]; if (unpins->num_unpins != 0U) { for (i = 0; i < unpins->num_unpins; i++) @@ -609,6 +614,11 @@ static void isp_capture_program_request_unpin( } mutex_lock(&capture->program_desc_ctx.unpins_list_lock); + if (buffer_index >= capture->program_desc_ctx.queue_depth) { + dev_err(chan->isp_dev, + "%s: buffer index is out of bound\n", __func__); + return; + } unpins = &capture->program_desc_ctx.unpins_list[buffer_index]; if (unpins->num_unpins != 0U) { for (i = 0; i < unpins->num_unpins; i++) @@ -1115,6 +1125,12 @@ void isp_get_nvhost_device( struct tegra_capture_isp_data *info = platform_get_drvdata(chan->isp_capture_pdev); + if (isp_inst >= MAX_ISP_UNITS) { + dev_err(chan->isp_dev, + "%s: ISP unit index is out of bound\n", __func__); + return; + } + chan->isp_dev = &info->isp_pdevices[isp_inst]->dev; chan->ndev = info->isp_pdevices[isp_inst]; } diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-vi-channel.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-vi-channel.c index 4049b6fa..be9a9707 100644 --- a/drivers/media/platform/tegra/camera/fusa-capture/capture-vi-channel.c +++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-vi-channel.c @@ -1,5 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only -// SPDX-FileCopyrightText: Copyright (c) 2017-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved. /** * @file drivers/media/platform/tegra/camera/fusa-capture/capture-vi-channel.c @@ -403,7 +403,7 @@ static long vi_channel_ioctl( switch (_IOC_NR(cmd)) { case _IOC_NR(VI_CAPTURE_SETUP): { - struct vi_capture_setup setup; + struct vi_capture_setup setup = {}; if (copy_from_user(&setup, ptr, sizeof(setup))) break; @@ -524,7 +524,7 @@ static long vi_channel_ioctl( } case _IOC_NR(VI_CAPTURE_SET_CONFIG): { - struct vi_capture_control_msg msg; + struct vi_capture_control_msg msg = {}; if (copy_from_user(&msg, ptr, sizeof(msg))) break; diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c index 59846b5b..997047f7 100644 --- a/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c +++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c @@ -1,5 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only -/* SPDX-FileCopyrightText: Copyright (c) 2017-2024 NVIDIA CORPORATION & AFFILIATES. +/* SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES. * All rights reserved. * * @@ -580,6 +580,12 @@ void vi_get_nvhost_device( struct tegra_capture_vi_data *info = platform_get_drvdata(chan->vi_capture_pdev); + if (setup->csi_stream_id >= MAX_NVCSI_STREAM_IDS) { + dev_err(chan->dev, + "%s: csi stream id is out of bound\n", __func__); + return; + } + vi_inst = info->vi_instance_table[setup->csi_stream_id]; if (vi_inst >= MAX_VI_UNITS) {