From 9b5416fd50b0dcc8d2bf6daa826c375dd137daa5 Mon Sep 17 00:00:00 2001 From: Prateek Patel Date: Mon, 31 Jan 2022 04:50:55 +0000 Subject: [PATCH] drivers: platform: dce: fix Coverity defects Dereference after null check for pointers cl and handlep. Add a null check before referencing cl and handlep. Check return value of request_firmware for error. Using uninitialized value event when calling dce_worker_thread_wait. Add EVENT_ID_DCE_INVALID_EVENT and have a check before using the value event. CID 10127898 CID 10127999 CID 10127954 CID 10127811 Bug 3461002 Change-Id: If00ece28fd52e495b3a8d3eec7bdb4825d3c7892 Signed-off-by: Prateek Patel Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2661588 Reviewed-by: svc-mobile-coverity Reviewed-by: svc-mobile-cert Reviewed-by: svc_kernel_abi Reviewed-by: svcacv Reviewed-by: Mahesh Kumar Reviewed-by: Sachin Nikam GVS: Gerrit_Virtual_Submit --- drivers/platform/tegra/dce/dce-admin.c | 14 ++++++--- drivers/platform/tegra/dce/dce-client-ipc.c | 30 ++++++++++++------- drivers/platform/tegra/dce/dce-util-common.c | 7 +++-- .../platform/tegra/dce/include/dce-worker.h | 3 +- 4 files changed, 37 insertions(+), 17 deletions(-) diff --git a/drivers/platform/tegra/dce/dce-admin.c b/drivers/platform/tegra/dce/dce-admin.c index a76f46f7..3211f6f4 100644 --- a/drivers/platform/tegra/dce/dce-admin.c +++ b/drivers/platform/tegra/dce/dce-admin.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2019-2021, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2019-2022, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -29,7 +29,7 @@ int dce_admin_ipc_wait(struct tegra_dce *d, u32 w_type) { int ret = 0; - enum dce_worker_event_id_type event; + enum dce_worker_event_id_type event = EVENT_ID_DCE_INVALID_EVENT; struct admin_rpc_post_boot_info *admin_rpc = &d->admin_rpc; switch (w_type) { @@ -50,13 +50,19 @@ int dce_admin_ipc_wait(struct tegra_dce *d, u32 w_type) 0); atomic_set(&admin_rpc->complete, 0); } else { - dce_worker_thread_wait(d, event); + if (event != EVENT_ID_DCE_INVALID_EVENT) + dce_worker_thread_wait(d, event); + else { + dce_err(d, "Invalid event type [%d]", event); + ret = -1; + goto end; + } } if (dce_worker_get_state(d) == STATE_DCE_WORKER_ABORTED) ret = -1; - +end: return ret; } diff --git a/drivers/platform/tegra/dce/dce-client-ipc.c b/drivers/platform/tegra/dce/dce-client-ipc.c index 60d6e3c4..59c94f78 100644 --- a/drivers/platform/tegra/dce/dce-client-ipc.c +++ b/drivers/platform/tegra/dce/dce-client-ipc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2019-2021, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2019-2022, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -140,6 +140,18 @@ int tegra_dce_register_ipc_client(u32 type, struct tegra_dce_client_ipc *cl; u32 handle = DCE_CLIENT_IPC_HANDLE_INVALID; + if (handlep == NULL) { + dce_err(d, "Invalid handle pointer"); + ret = -EINVAL; + goto end; + } + + if (type >= DCE_CLIENT_IPC_TYPE_MAX) { + dce_err(d, "Failed to retrieve client info for type: [%u]", type); + ret = -EINVAL; + goto end; + } + int_type = dce_interface_type_map[type]; d = dce_ipc_get_dce_from_ch(int_type); @@ -148,12 +160,6 @@ int tegra_dce_register_ipc_client(u32 type, goto out; } - if (handlep == NULL) { - dce_err(d, "Invalid handle pointer"); - ret = -EINVAL; - goto out; - } - ret = dce_client_ipc_handle_alloc(&handle); if (ret) goto out; @@ -184,7 +190,7 @@ out: } *handlep = handle; - +end: return ret; } EXPORT_SYMBOL(tegra_dce_register_ipc_client); @@ -309,8 +315,12 @@ static void dce_client_process_event_ipc(struct tegra_dce *d, u32 msg_length; int ret = 0; - if ((cl == NULL) || (cl->callback_fn == NULL) || - (cl->type != DCE_CLIENT_IPC_TYPE_RM_EVENT)) { + if ((cl == NULL) || (cl->callback_fn == NULL)) { + dce_err(d, "Invalid arg tegra_dce_client_ipc"); + return; + } + + if (cl->type != DCE_CLIENT_IPC_TYPE_RM_EVENT) { dce_err(d, "Invalid arg for DCE_CLIENT_IPC_TYPE_RM_EVENT type:[%u]", cl->type); return; } diff --git a/drivers/platform/tegra/dce/dce-util-common.c b/drivers/platform/tegra/dce/dce-util-common.c index 24d1af7b..df05eaa9 100644 --- a/drivers/platform/tegra/dce/dce-util-common.c +++ b/drivers/platform/tegra/dce/dce-util-common.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2019-2020, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2019-2022, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -159,7 +159,10 @@ struct dce_firmware *dce_request_firmware(struct tegra_dce *d, if (!fw) return NULL; - request_firmware(&l_fw, fw_name, dev); + if (request_firmware(&l_fw, fw_name, dev) < 0) { + dce_err(d, "FW Request Failed"); + goto err; + } if (!l_fw) goto err; diff --git a/drivers/platform/tegra/dce/include/dce-worker.h b/drivers/platform/tegra/dce/include/dce-worker.h index 53f522e1..5fc293b8 100644 --- a/drivers/platform/tegra/dce/include/dce-worker.h +++ b/drivers/platform/tegra/dce/include/dce-worker.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2019-2020, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2019-2022, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -25,6 +25,7 @@ struct tegra_dce; * events thoughout the life cycle of dce worker thread. */ enum dce_worker_event_id_type { + EVENT_ID_DCE_INVALID_EVENT = -1, EVENT_ID_DCE_BOOT_COMPLETE_IRQ_REQ_SET = 0, EVENT_ID_DCE_BOOT_COMPLETE_IRQ_RECEIVED = 1, EVENT_ID_DCE_IPC_SYNC_TRIGGERED = 2,