1. 05 5月, 2018 38 次提交
  2. 04 5月, 2018 2 次提交
    • A
      media: cxd2880-spi: avoid out-of-bounds access warning · 53dcd70e
      Arnd Bergmann 提交于
      The -Warray-bounds warning in gcc-8 triggers for a newly added file:
      
      drivers/media/spi/cxd2880-spi.c: In function 'cxd2880_write_reg':
      drivers/media/spi/cxd2880-spi.c:111:3: error: 'memcpy' forming offset [133, 258] is out of the bounds [0, 132] of object 'send_data' with type 'u8[132]' {aka 'unsigned char[132]'} [-Werror=array-bounds]
      
      The problem appears to be that we have two range checks in this function,
      first comparing against BURST_WRITE_MAX (128) and then comparing against
      a literal '255'. The logic checking the buffer size looks at the second
      one and decides that this might be the actual maximum data length.
      
      This is understandable behavior from the compiler, but the code is actually
      safe. Since the first check is already shorter, we can remove the loop
      and only leave that. To be on the safe side in case BURST_WRITE_MAX might
      be increased, I'm leaving the check against U8_MAX.
      
      Fixes: bd24fcdd ("media: cxd2880-spi: Add support for CXD2880 SPI interface")
      
      Cc: Martin Sebor <msebor@gmail.com>
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Reviewed-by: NYasunari Takiguchi <Yasunari.Takiguchi@sony.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      53dcd70e
    • M
      media: lgdt330x: don't use an uninitialized state · 89eaaf2d
      Mauro Carvalho Chehab 提交于
      If state is not initialized or is freed, we can't use it:
      	drivers/media/dvb-frontends/lgdt330x.c:920 lgdt330x_probe() error: potential null dereference 'state'.  (kzalloc returns null)
      	drivers/media/dvb-frontends/lgdt330x.c:920 lgdt330x_probe() error: we previously assumed 'state' could be null (see line 878)
      	drivers/media/dvb-frontends/lgdt330x.c:920 lgdt330x_probe() error: dereferencing freed memory 'state'
      
      Fixes: 23ba635d ("media: lgdt330x: convert it to the new I2C binding way")
      Signed-off-by: NMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      89eaaf2d