nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-22 09:11:26 +03:00
Code Issues Packages Projects Releases Wiki Activity

linux: kmd: static analysis TOP25 S03/05 Part 4

Browse Source 
Under the following path:
- drivers/media/platform/tegra/camera/camera_common.c
- drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
- drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c
- drivers/media/platform/tegra/camera/sensor_common.c
- drivers/media/platform/tegra/camera/tegracam_core.c
- drivers/media/platform/tegra/camera/tegracam_utils.c
- drivers/media/platform/tegra/camera/vi/graph.c

Jira CAMERASW-32528

Change-Id: I8f3bb839dfe6e61928642f0ca32bcaf972d6c84a
Signed-off-by: Junsheng Chen <junshengc@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3314084
Reviewed-by: Shan Neng Chen <snchen@nvidia.com>
Reviewed-by: Sumeet Gupta <sumeetg@nvidia.com>
Reviewed-by: svcacv <svcacv@nvidia.com>
Reviewed-by: Ankur Pawar <ankurp@nvidia.com>
GVS: buildbot_gerritrpt <buildbot_gerritrpt@nvidia.com>
Reviewed-by: Zhiyuan Wang <zhiwang@nvidia.com>
This commit is contained in:
Junsheng Chen
2025-03-05 11:00:05 +00:00
committed by Jon Hunter
parent 46c2c0bca3
commit 90b244eb03
7 changed files with 44 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/media/platform/tegra/camera/camera_common.c
View File

@@ -259,8 +259,12 @@ int camera_common_parse_clocks(struct device *dev,
/* find length of clock-names string array */
for (i = 0; i < proplen; i++) {
if (prop[i] == '\0')
numclocks++;
if (prop[i] == '\0') {
if (check_add_overflow(numclocks, 1, &numclocks)) {
dev_err(dev, "%s: numclocks overflow\n", __func__);
return -EINVAL;
}
}
}
if (numclocks > 1) {

5
drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
View File

@@ -2496,7 +2496,8 @@ static int capture_isp_probe(struct platform_device *pdev)
}
}
for (i = 0; ; i++) {
i = 0U;
do {
struct device_node *node;
struct platform_device *ispdev;
@@ -2521,7 +2522,7 @@ static int capture_isp_probe(struct platform_device *pdev)
info->isp_pdevices[i] = ispdev;
info->num_isp_devices++;
}
} while (!check_add_overflow(i, 1U, &i));
if (info->num_isp_devices < 1)
return -EINVAL;

5
drivers/media/platform/tegra/camera/fusa-capture/capture-vi.c
View File

@@ -1787,7 +1787,8 @@ static int capture_vi_probe(struct platform_device *pdev)
if (info->max_vi_channels == 0)
info->max_vi_channels = DEFAULT_VI_CHANNELS;
for (ii = 0; ; ii++) {
ii = 0U;
do {
struct device_node *np;
struct platform_device *pvidev;
@@ -1812,7 +1813,7 @@ static int capture_vi_probe(struct platform_device *pdev)
info->vi_pdevices[ii] = pvidev;
info->num_vi_devices++;
}
} while (!check_add_overflow(ii, 1U, &ii));
if (info->num_vi_devices < 1)
return -EINVAL;

16
drivers/media/platform/tegra/camera/sensor_common.c
View File

@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* SPDX-FileCopyrightText: Copyright (c) 2017-2024 NVIDIA CORPORATION & AFFILIATES.
* SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES.
* All rights reserved.
*
* This program is free software; you can redistribute it and/or modify it
@@ -65,6 +65,8 @@ static int sensor_common_parse_signal_props(
u64 val64 = 0;
u64 rate;
int depth;
u64 lane_rate;
u64 symbol_rate;
err = of_property_read_string(node, "phy_mode", &temp_str);
if (err) {
@@ -137,14 +139,22 @@ static int sensor_common_parse_signal_props(
}
/* Convert pixel rate to lane data rate */
rate = rate * depth / signal->num_lanes;
if (check_mul_overflow(rate, (u64)depth, &lane_rate)) {
dev_err(dev, "%s: convert pixel rate to lane data rate overflow\n", __func__);
return -EINVAL;
}
rate = lane_rate / signal->num_lanes;
if (signal->phy_mode == CSI_PHY_MODE_DPHY) {
/* MIPI clock rate */
signal->mipi_clock.val = rate / 2;
} else if (signal->phy_mode == CSI_PHY_MODE_CPHY) {
/* Symbol rate */
signal->mipi_clock.val = rate * 7 / 16;
if (check_mul_overflow(rate, 7ULL, &symbol_rate)) {
dev_err(dev, "%s: symbol rate overflow\n", __func__);
return -EINVAL;
}
signal->mipi_clock.val = symbol_rate / 16;
} else {
/* Data rate */
signal->mipi_clock.val = rate;

12
drivers/media/platform/tegra/camera/tegracam_core.c
View File

@@ -1,8 +1,10 @@
// SPDX-License-Identifier: GPL-2.0
// SPDX-License-Identifier: GPL-2.0-only
/*
* SPDX-FileCopyrightText: Copyright (c) 2017-2025 NVIDIA CORPORATION & AFFILIATES.
* All rights reserved.
*
* tegracam_core - tegra camera framework initialization
*
* Copyright (c) 2017-2022, NVIDIA CORPORATION. All rights reserved.
*/
#include <linux/list.h>
#include <linux/mutex.h>
@@ -153,7 +155,11 @@ int tegracam_device_register(struct tegracam_device *tc_dev)
s_data->frmfmt[mode_idx].size.width;
s_data->def_height = s_data->fmt_height =
s_data->frmfmt[mode_idx].size.height;
s_data->def_clk_freq = signal_props->mclk_freq * 1000;
if (check_mul_overflow(signal_props->mclk_freq, 1000U, (u32 *)(&(s_data->def_clk_freq)))) {
dev_err(dev, "%s: mclk freq overflow\n", __func__);
return -EINVAL;
}
/* add version info to identify the right feature set */
tc_dev->version = tegracam_version(TEGRACAM_MAJOR_VERSION,

5
drivers/media/platform/tegra/camera/tegracam_utils.c
View File

@@ -214,7 +214,10 @@ int write_sensor_blob(struct regmap *regmap, struct sensor_blob *blob)
&blob->buf[buf_index], size);
if (err)
return err;
buf_index += size;
if (check_add_overflow(buf_index, size, &buf_index)) {
pr_err("buffer index overflow\n");
return -EINVAL;
}
} else {
pr_err("blob has been packaged with errors\n");
return -EINVAL;

9
drivers/media/platform/tegra/camera/vi/graph.c
View File

@@ -1,8 +1,8 @@
// SPDX-License-Identifier: GPL-2.0
// SPDX-License-Identifier: GPL-2.0-only
// SPDX-FileCopyrightText: Copyright (c) 2018-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
/*
* NVIDIA Media controller graph management
*
* Copyright (c) 2015-2023 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
*/
#include <nvidia/conftest.h>
@@ -651,7 +651,10 @@ int tegra_vi_graph_init(struct tegra_mc_vi *vi)
entity->asd.match.fwnode = of_fwnode_handle(remote);
#endif
list_add_tail(&entity->list, &chan->entities);
chan->num_subdevs++;
if (check_add_overflow(chan->num_subdevs, 1U, &chan->num_subdevs)) {
dev_err(vi->dev, "%s: num subdevs overflow\n", __func__);
break;
}
chan->notifier.ops = chan->notifier.ops ? chan->notifier.ops : &vi_chan_notify_ops;
/* Parse and add entities on this enpoint/channel */