From 6fb5af66eb7237ef4d12cf22eb1f92c09bafaf74 Mon Sep 17 00:00:00 2001 From: Junsheng Chen Date: Fri, 10 Jan 2025 05:52:48 +0000 Subject: [PATCH] linux: kmd: static analysis S01/08 part 4 Under the following path: - drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c - drivers/media/platform/tegra/camera/camera_common.c - drivers/media/platform/tegra/camera/csi/csi.c Jira CAMERASW-30848 Change-Id: If9d04481371f28d6fe962291f1f950f6b31aa635 Signed-off-by: Junsheng Chen Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3281688 GVS: buildbot_gerritrpt Reviewed-by: svcacv Reviewed-by: Zhiyuan Wang Reviewed-by: Sumeet Gupta Reviewed-by: Frank Chen Tested-by: mobile promotions Reviewed-by: mobile promotions Reviewed-by: Ankur Pawar --- drivers/media/platform/tegra/camera/csi/csi.c | 7 ++--- .../tegra/camera/fusa-capture/capture-isp.c | 26 ++++++++++++++----- 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/drivers/media/platform/tegra/camera/csi/csi.c b/drivers/media/platform/tegra/camera/csi/csi.c index f9686d3a..e444bb59 100644 --- a/drivers/media/platform/tegra/camera/csi/csi.c +++ b/drivers/media/platform/tegra/camera/csi/csi.c @@ -1,5 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only -// SPDX-FileCopyrightText: Copyright (c) 2022-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-FileCopyrightText: Copyright (c) 2022-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved. /* * NVIDIA Tegra CSI Device */ @@ -1054,8 +1054,9 @@ static int csi_parse_dt(struct tegra_csi_device *csi, if (strncmp(node->name, "nvcsi", 5)) { node = of_find_node_by_name(node, "nvcsi"); - if (sizeof(csi->devname) >= sizeof("nvcsi")) { - strncpy(csi->devname, "nvcsi", 6); + if (strscpy(csi->devname, "nvcsi", 6) < 0) { + dev_err(csi->dev, "Name too long.\n"); + return -EINVAL; } } diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c index c25fcf28..f44737ac 100644 --- a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c +++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c @@ -1907,14 +1907,28 @@ static uint32_t isp_capture_get_num_progress( { struct isp_desc_rec *capture_desc_ctx = &chan->capture_data->capture_desc_ctx; - struct isp_capture_descriptor *desc = (struct isp_capture_descriptor *) - (capture_desc_ctx->requests.va + - req->buffer_index * capture_desc_ctx->request_size); + struct isp_capture_descriptor *desc = NULL; + uint16_t sliceHeight = 0U; + uint16_t height = 0U; + uint32_t desc_offset = 0U; + uint16_t slice_hight_sub = 1U; + uint16_t adjust_slice_height = 0U; + uint16_t adjust_height = 0U; - uint16_t sliceHeight = desc->surface_configs.slice_height; - uint16_t height = desc->surface_configs.mr_height; + if (check_mul_overflow(req->buffer_index, capture_desc_ctx->request_size, &desc_offset)) + return 0; - return ((height + (sliceHeight - 1U)) / sliceHeight); + desc = (struct isp_capture_descriptor *)(capture_desc_ctx->requests.va + desc_offset); + sliceHeight = desc->surface_configs.slice_height; + height = desc->surface_configs.mr_height; + + if (check_sub_overflow(sliceHeight, slice_hight_sub, &adjust_slice_height)) + return 0; + + if (check_add_overflow(height, adjust_slice_height, &adjust_height)) + return 0; + + return (adjust_height / sliceHeight); } int isp_capture_request(