From 90b244eb03e1acdf1a7d5b5af55c7eb30789e613 Mon Sep 17 00:00:00 2001 From: Junsheng Chen Date: Wed, 5 Mar 2025 11:00:05 +0000 Subject: [PATCH] linux: kmd: static analysis TOP25 S03/05 Part 4 Under the following path: - drivers/media/platform/tegra/camera/camera_common.c - drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c - drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c - drivers/media/platform/tegra/camera/sensor_common.c - drivers/media/platform/tegra/camera/tegracam_core.c - drivers/media/platform/tegra/camera/tegracam_utils.c - drivers/media/platform/tegra/camera/vi/graph.c Jira CAMERASW-32528 Change-Id: I8f3bb839dfe6e61928642f0ca32bcaf972d6c84a Signed-off-by: Junsheng Chen Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3314084 Reviewed-by: Shan Neng Chen Reviewed-by: Sumeet Gupta Reviewed-by: svcacv Reviewed-by: Ankur Pawar GVS: buildbot_gerritrpt Reviewed-by: Zhiyuan Wang --- .../media/platform/tegra/camera/camera_common.c | 8 ++++++-- .../tegra/camera/fusa-capture/capture-isp.c | 5 +++-- .../tegra/camera/fusa-capture/capture-vi.c | 5 +++-- .../media/platform/tegra/camera/sensor_common.c | 16 +++++++++++++--- .../media/platform/tegra/camera/tegracam_core.c | 12 +++++++++--- .../media/platform/tegra/camera/tegracam_utils.c | 5 ++++- drivers/media/platform/tegra/camera/vi/graph.c | 9 ++++++--- 7 files changed, 44 insertions(+), 16 deletions(-) diff --git a/drivers/media/platform/tegra/camera/camera_common.c b/drivers/media/platform/tegra/camera/camera_common.c index 7e80a045..1a149b1d 100644 --- a/drivers/media/platform/tegra/camera/camera_common.c +++ b/drivers/media/platform/tegra/camera/camera_common.c @@ -259,8 +259,12 @@ int camera_common_parse_clocks(struct device *dev, /* find length of clock-names string array */ for (i = 0; i < proplen; i++) { - if (prop[i] == '\0') - numclocks++; + if (prop[i] == '\0') { + if (check_add_overflow(numclocks, 1, &numclocks)) { + dev_err(dev, "%s: numclocks overflow\n", __func__); + return -EINVAL; + } + } } if (numclocks > 1) { diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c index 6dcba37e..88002886 100644 --- a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c +++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c @@ -2496,7 +2496,8 @@ static int capture_isp_probe(struct platform_device *pdev) } } - for (i = 0; ; i++) { + i = 0U; + do { struct device_node *node; struct platform_device *ispdev; @@ -2521,7 +2522,7 @@ static int capture_isp_probe(struct platform_device *pdev) info->isp_pdevices[i] = ispdev; info->num_isp_devices++; - } + } while (!check_add_overflow(i, 1U, &i)); if (info->num_isp_devices < 1) return -EINVAL; diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c index d998132b..65854e43 100644 --- a/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c +++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c @@ -1787,7 +1787,8 @@ static int capture_vi_probe(struct platform_device *pdev) if (info->max_vi_channels == 0) info->max_vi_channels = DEFAULT_VI_CHANNELS; - for (ii = 0; ; ii++) { + ii = 0U; + do { struct device_node *np; struct platform_device *pvidev; @@ -1812,7 +1813,7 @@ static int capture_vi_probe(struct platform_device *pdev) info->vi_pdevices[ii] = pvidev; info->num_vi_devices++; - } + } while (!check_add_overflow(ii, 1U, &ii)); if (info->num_vi_devices < 1) return -EINVAL; diff --git a/drivers/media/platform/tegra/camera/sensor_common.c b/drivers/media/platform/tegra/camera/sensor_common.c index 501a230d..1de2ac35 100644 --- a/drivers/media/platform/tegra/camera/sensor_common.c +++ b/drivers/media/platform/tegra/camera/sensor_common.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * SPDX-FileCopyrightText: Copyright (c) 2017-2024 NVIDIA CORPORATION & AFFILIATES. + * SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES. * All rights reserved. * * This program is free software; you can redistribute it and/or modify it @@ -65,6 +65,8 @@ static int sensor_common_parse_signal_props( u64 val64 = 0; u64 rate; int depth; + u64 lane_rate; + u64 symbol_rate; err = of_property_read_string(node, "phy_mode", &temp_str); if (err) { @@ -137,14 +139,22 @@ static int sensor_common_parse_signal_props( } /* Convert pixel rate to lane data rate */ - rate = rate * depth / signal->num_lanes; + if (check_mul_overflow(rate, (u64)depth, &lane_rate)) { + dev_err(dev, "%s: convert pixel rate to lane data rate overflow\n", __func__); + return -EINVAL; + } + rate = lane_rate / signal->num_lanes; if (signal->phy_mode == CSI_PHY_MODE_DPHY) { /* MIPI clock rate */ signal->mipi_clock.val = rate / 2; } else if (signal->phy_mode == CSI_PHY_MODE_CPHY) { /* Symbol rate */ - signal->mipi_clock.val = rate * 7 / 16; + if (check_mul_overflow(rate, 7ULL, &symbol_rate)) { + dev_err(dev, "%s: symbol rate overflow\n", __func__); + return -EINVAL; + } + signal->mipi_clock.val = symbol_rate / 16; } else { /* Data rate */ signal->mipi_clock.val = rate; diff --git a/drivers/media/platform/tegra/camera/tegracam_core.c b/drivers/media/platform/tegra/camera/tegracam_core.c index 142e53d8..8a8914a3 100644 --- a/drivers/media/platform/tegra/camera/tegracam_core.c +++ b/drivers/media/platform/tegra/camera/tegracam_core.c @@ -1,8 +1,10 @@ -// SPDX-License-Identifier: GPL-2.0 +// SPDX-License-Identifier: GPL-2.0-only /* + * SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES. + * All rights reserved. + * * tegracam_core - tegra camera framework initialization * - * Copyright (c) 2017-2022, NVIDIA CORPORATION. All rights reserved. */ #include #include @@ -153,7 +155,11 @@ int tegracam_device_register(struct tegracam_device *tc_dev) s_data->frmfmt[mode_idx].size.width; s_data->def_height = s_data->fmt_height = s_data->frmfmt[mode_idx].size.height; - s_data->def_clk_freq = signal_props->mclk_freq * 1000; + + if (check_mul_overflow(signal_props->mclk_freq, 1000U, (u32 *)(&(s_data->def_clk_freq)))) { + dev_err(dev, "%s: mclk freq overflow\n", __func__); + return -EINVAL; + } /* add version info to identify the right feature set */ tc_dev->version = tegracam_version(TEGRACAM_MAJOR_VERSION, diff --git a/drivers/media/platform/tegra/camera/tegracam_utils.c b/drivers/media/platform/tegra/camera/tegracam_utils.c index 6b044788..d088b1c5 100644 --- a/drivers/media/platform/tegra/camera/tegracam_utils.c +++ b/drivers/media/platform/tegra/camera/tegracam_utils.c @@ -214,7 +214,10 @@ int write_sensor_blob(struct regmap *regmap, struct sensor_blob *blob) &blob->buf[buf_index], size); if (err) return err; - buf_index += size; + if (check_add_overflow(buf_index, size, &buf_index)) { + pr_err("buffer index overflow\n"); + return -EINVAL; + } } else { pr_err("blob has been packaged with errors\n"); return -EINVAL; diff --git a/drivers/media/platform/tegra/camera/vi/graph.c b/drivers/media/platform/tegra/camera/vi/graph.c index b578792a..3983b562 100644 --- a/drivers/media/platform/tegra/camera/vi/graph.c +++ b/drivers/media/platform/tegra/camera/vi/graph.c @@ -1,8 +1,8 @@ -// SPDX-License-Identifier: GPL-2.0 +// SPDX-License-Identifier: GPL-2.0-only +// SPDX-FileCopyrightText: Copyright (c) 2018-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved. /* * NVIDIA Media controller graph management * - * Copyright (c) 2015-2023 NVIDIA CORPORATION & AFFILIATES. All rights reserved. */ #include @@ -651,7 +651,10 @@ int tegra_vi_graph_init(struct tegra_mc_vi *vi) entity->asd.match.fwnode = of_fwnode_handle(remote); #endif list_add_tail(&entity->list, &chan->entities); - chan->num_subdevs++; + if (check_add_overflow(chan->num_subdevs, 1U, &chan->num_subdevs)) { + dev_err(vi->dev, "%s: num subdevs overflow\n", __func__); + break; + } chan->notifier.ops = chan->notifier.ops ? chan->notifier.ops : &vi_chan_notify_ops; /* Parse and add entities on this enpoint/channel */