MLK-20316 gpu: imx: dpu: Avoid out-of-bound array access in dpu_{unit}_init()
The callers of dpu_{unit}_init() might provide an invalid id as the parameter, it may cause overrunning dpu->{unit}_priv[] and cf_shdlreqs[] arrays and out-of-bound array access. Although the current only caller is dpu_submodules_init() and it always provides valid ids, it would be good to fix the potential issue. This patch fixes several issues reported by coverity - CID 1477330, CID 1477335, CID 1477348, CID 1477346, CID 3298619, CID 1477347, CID 5233021 and CID 1477321. Signed-off-by: Liu Ying <victor.liu@nxp.com>pull/10/head
parent
92899d70e5
commit
d95b6b9740
|
@ -258,6 +258,9 @@ int dpu_cf_init(struct dpu_soc *dpu, unsigned int id,
|
|||
if (cf_ids[i] == id)
|
||||
break;
|
||||
|
||||
if (i == ARRAY_SIZE(cf_ids))
|
||||
return -EINVAL;
|
||||
|
||||
dpu->cf_priv[i] = cf;
|
||||
|
||||
cf->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_16);
|
||||
|
|
|
@ -519,6 +519,9 @@ int dpu_ed_init(struct dpu_soc *dpu, unsigned int id,
|
|||
if (ed_ids[i] == id)
|
||||
break;
|
||||
|
||||
if (i == ARRAY_SIZE(ed_ids))
|
||||
return -EINVAL;
|
||||
|
||||
dpu->ed_priv[i] = ed;
|
||||
|
||||
ed->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_32);
|
||||
|
|
|
@ -406,6 +406,9 @@ int dpu_fe_init(struct dpu_soc *dpu, unsigned int id,
|
|||
if (fe_ids[i] == id)
|
||||
break;
|
||||
|
||||
if (i == ARRAY_SIZE(fe_ids))
|
||||
return -EINVAL;
|
||||
|
||||
fu = &fe->fu;
|
||||
dpu->fe_priv[i] = fu;
|
||||
|
||||
|
|
|
@ -299,6 +299,9 @@ int dpu_fw_init(struct dpu_soc *dpu, unsigned int id,
|
|||
if (fw_ids[i] == id)
|
||||
break;
|
||||
|
||||
if (i == ARRAY_SIZE(fw_ids))
|
||||
return -EINVAL;
|
||||
|
||||
fu = &fw->fu;
|
||||
dpu->fw_priv[i] = fu;
|
||||
|
||||
|
|
|
@ -371,6 +371,9 @@ int dpu_hs_init(struct dpu_soc *dpu, unsigned int id,
|
|||
if (hs_ids[i] == id)
|
||||
break;
|
||||
|
||||
if (i == ARRAY_SIZE(hs_ids))
|
||||
return -EINVAL;
|
||||
|
||||
dpu->hs_priv[i] = hs;
|
||||
|
||||
hs->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_8);
|
||||
|
|
|
@ -118,6 +118,9 @@ int dpu_st_init(struct dpu_soc *dpu, unsigned int id,
|
|||
if (st_ids[i] == id)
|
||||
break;
|
||||
|
||||
if (i == ARRAY_SIZE(st_ids))
|
||||
return -EINVAL;
|
||||
|
||||
dpu->st_priv[i] = st;
|
||||
|
||||
st->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_32);
|
||||
|
|
|
@ -423,6 +423,9 @@ int dpu_vs_init(struct dpu_soc *dpu, unsigned int id,
|
|||
if (vs_ids[i] == id)
|
||||
break;
|
||||
|
||||
if (i == ARRAY_SIZE(vs_ids))
|
||||
return -EINVAL;
|
||||
|
||||
dpu->vs_priv[i] = vs;
|
||||
|
||||
vs->pec_base = devm_ioremap(dpu->dev, pec_base, SZ_8);
|
||||
|
|
Loading…
Reference in New Issue