1
0
Fork 0

MLK-20316 gpu: imx: dpu: Avoid out-of-bound array access in dpu_{unit}_init()

The callers of dpu_{unit}_init() might provide an invalid id as
the parameter, it may cause overrunning dpu->{unit}_priv[] and
cf_shdlreqs[] arrays and out-of-bound array access.  Although
the current only caller is dpu_submodules_init() and it always
provides valid ids, it would be good to fix the potential issue.
This patch fixes several issues reported by coverity - CID 1477330,
CID 1477335, CID 1477348, CID 1477346, CID 3298619, CID 1477347,
CID 5233021 and CID 1477321.

Signed-off-by: Liu Ying <victor.liu@nxp.com>
pull/10/head
Liu Ying 2018-11-12 10:32:29 +08:00
parent 92899d70e5
commit d95b6b9740
7 changed files with 21 additions and 0 deletions

View File

@ -258,6 +258,9 @@ int dpu_cf_init(struct dpu_soc *dpu, unsigned int id,
if (cf_ids[i] == id)
break;
if (i == ARRAY_SIZE(cf_ids))
return -EINVAL;
dpu->cf_priv[i] = cf;
cf->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_16);

View File

@ -519,6 +519,9 @@ int dpu_ed_init(struct dpu_soc *dpu, unsigned int id,
if (ed_ids[i] == id)
break;
if (i == ARRAY_SIZE(ed_ids))
return -EINVAL;
dpu->ed_priv[i] = ed;
ed->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_32);

View File

@ -406,6 +406,9 @@ int dpu_fe_init(struct dpu_soc *dpu, unsigned int id,
if (fe_ids[i] == id)
break;
if (i == ARRAY_SIZE(fe_ids))
return -EINVAL;
fu = &fe->fu;
dpu->fe_priv[i] = fu;

View File

@ -299,6 +299,9 @@ int dpu_fw_init(struct dpu_soc *dpu, unsigned int id,
if (fw_ids[i] == id)
break;
if (i == ARRAY_SIZE(fw_ids))
return -EINVAL;
fu = &fw->fu;
dpu->fw_priv[i] = fu;

View File

@ -371,6 +371,9 @@ int dpu_hs_init(struct dpu_soc *dpu, unsigned int id,
if (hs_ids[i] == id)
break;
if (i == ARRAY_SIZE(hs_ids))
return -EINVAL;
dpu->hs_priv[i] = hs;
hs->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_8);

View File

@ -118,6 +118,9 @@ int dpu_st_init(struct dpu_soc *dpu, unsigned int id,
if (st_ids[i] == id)
break;
if (i == ARRAY_SIZE(st_ids))
return -EINVAL;
dpu->st_priv[i] = st;
st->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_32);

View File

@ -423,6 +423,9 @@ int dpu_vs_init(struct dpu_soc *dpu, unsigned int id,
if (vs_ids[i] == id)
break;
if (i == ARRAY_SIZE(vs_ids))
return -EINVAL;
dpu->vs_priv[i] = vs;
vs->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_8);