nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-22 17:25:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

linux: kmd: static analysis TOP25 03/05 Part 9

Browse Source 
Under the following path:
- drivers/platform/tegra/rtcpu/ivc-bus.c

Jira CAMERASW-32533

Change-Id: Iba0a529218a9aaf82f70bc4ff05b4658bbfe6fc3
Signed-off-by: Zhiyuan Wang <zhiwang@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3318779
GVS: buildbot_gerritrpt <buildbot_gerritrpt@nvidia.com>
Reviewed-by: Semi Malinen <smalinen@nvidia.com>
Reviewed-by: svcacv <svcacv@nvidia.com>
Reviewed-by: Frank Chen <frankc@nvidia.com>
Reviewed-by: Ajith Kumar <ajithk@nvidia.com>
This commit is contained in:
Zhiyuan Wang
2025-03-13 00:24:18 -07:00
committed by Jon Hunter
parent ecfef7f862
commit 578e8f6700
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/platform/tegra/rtcpu/ivc-bus.c
View File

@@ -98,6 +98,7 @@ static struct tegra_ivc_channel *tegra_ivc_channel_create(
const char *service; const char *service;
int ret; int ret;
u32 mul = 0U, sum = 0U; u32 mul = 0U, sum = 0U;
dma_addr_t rx_phys = 0U, tx_phys = 0U;
struct tegra_ivc_channel *chan = kzalloc(sizeof(*chan), GFP_KERNEL); struct tegra_ivc_channel *chan = kzalloc(sizeof(*chan), GFP_KERNEL);
if (unlikely(chan == NULL)) if (unlikely(chan == NULL))
@@ -197,6 +198,18 @@ static struct tegra_ivc_channel *tegra_ivc_channel_create(
region->ivc_size += queue_size; region->ivc_size += queue_size;
end.tx = region->ivc_size; end.tx = region->ivc_size;
if (__builtin_add_overflow(region->iova, start.rx, &rx_phys)) {
dev_err(&chan->dev, "rx phys overflow\n");
ret = -EOVERFLOW;
goto error;
}
if (__builtin_add_overflow(region->iova, start.tx, &tx_phys)) {
dev_err(&chan->dev, "tx phys overflow\n");
ret = -EOVERFLOW;
goto error;
}
#if defined(NV_TEGRA_IVC_STRUCT_HAS_IOSYS_MAP) #if defined(NV_TEGRA_IVC_STRUCT_HAS_IOSYS_MAP)
iosys_map_set_vaddr(&rx_map, (void *)(region->base + start.rx)); iosys_map_set_vaddr(&rx_map, (void *)(region->base + start.rx));
iosys_map_set_vaddr(&tx_map, (void *)(region->base + start.tx)); iosys_map_set_vaddr(&tx_map, (void *)(region->base + start.tx));
@@ -205,9 +218,9 @@ static struct tegra_ivc_channel *tegra_ivc_channel_create(
ret = tegra_ivc_init(&chan->ivc, ret = tegra_ivc_init(&chan->ivc,
NULL, NULL,
&rx_map, &rx_map,
region->iova + start.rx, rx_phys,
&tx_map, &tx_map,
region->iova + start.tx, tx_phys,
nframes, frame_size, nframes, frame_size,
tegra_ivc_channel_ring, tegra_ivc_channel_ring,
(void *)camhsp); (void *)camhsp);
@@ -216,9 +229,9 @@ static struct tegra_ivc_channel *tegra_ivc_channel_create(
ret = tegra_ivc_init(&chan->ivc, ret = tegra_ivc_init(&chan->ivc,
NULL, NULL,
(void *)(region->base + start.rx), (void *)(region->base + start.rx),
region->iova + start.rx, rx_phys,
(void *)(region->base + start.tx), (void *)(region->base + start.tx),
region->iova + start.tx, tx_phys,
nframes, frame_size, nframes, frame_size,
tegra_ivc_channel_ring, tegra_ivc_channel_ring,
(void *)camhsp); (void *)camhsp);