^^
Same
118 writel_relaxed(val, priv->base + IR_CONFIG);
119
120 writel_relaxed(0x00, priv->base + IR_INTM);
121 /* write arbitrary value to start */
122 writel_relaxed(0x01, priv->base + IR_START);
123 return 0;
124 }
regards,
dan carpenter
of putting everything in a centralized MAINTAINERS file.
But it doesn't make sense to try store that information MY BRAIN! I
can't remember anything from one minute to the next so I have no idea
who maintains media submodules...
regards,
dan carpenter
there is another mailing list but
at least one subsystem uses LKML for patchwork so this isn't safe.
So the safest instructions are "Use get_matainer.pl and add the person
who wrote the commit in the Fixes tag".
regards,
dan carpenter
deobuf_read_start(q);
1135 if (!q->reading) {
1136 rc = EPOLLERR;
1137 } else if (NULL == q->read_buf) {
1138 q->read_buf = list_entry(q->stream.next,
regards,
dan carpenter
ties.
These patches look really nice.
regards,
dan carpenter
if (ret)
return ret;
return 0;
Or you can make the last check a little special if you want...
return vchiq_mmal_port_enable(dev->instance, src, NULL);
Either format is good.
regards,
dan carpenter
ktime_t kernel_start_ts;
> + /* Timestamp of last frame */
> + u64 last_timestamp;
Not directly related to this patch but the indenting in this .h file is
all higgle-piggledy.
regards,
dan carpenter
247
248 memset(dma->vaddr, 0, nr_pages << PAGE_SHIFT);
249 dma->nr_pages = nr_pages;
250
251 return 0;
252 out_free_pages:
253 while (i > 0) {
254 void *addr;
regards,
dan carpenter
error:
5032 kfree(state);
^^^^
Double free.
5033 return ret;
5034 }
regards,
dan carpenter
_F_VID_MUX)
> + src = &csi->sd.entity;
This would be easier to read if the white space were tweaked a little:
if (src->function != MEDIA_ENT_F_VID_IF_BRIDGE &&
src->function != MEDIA_ENT_F_VID_MUX)
src = &csi->sd.entity;
regards,
dan carpenter
Thus the address of "&ctx->dev->variant->codec_ops[codec_mode]"
can't possibly be NULL.
Signed-off-by: Dan Carpenter
---
drivers/staging/media/rockchip/vpu/rockchip_vpu_v4l2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/driver
The imx_media_pipeline_pad() function return NULL pointers on error, it
never returns error pointers.
Fixes: 3ef46bc97ca2 ("media: staging/imx: Improve pipeline searching")
Signed-off-by: Dan Carpenter
---
drivers/staging/media/imx/imx-media-csi.c | 4 ++--
drivers/staging/media/imx/
FIELD_GET(CECB_RW_RD_DATA, reg);
386
387 read_out:
388 spin_unlock_irqrestore(&ao_cec->cec_reg_lock, flags);
389
390 return ret;
391 }
regards,
dan carpenter
Hi Michael,
url:
https://github.com/0day-ci/linux/commits/Michael-Tretter/Add-ZynqMP-VCU-Allegro-DVT-H-264-encoder-driver/20190504-161958
base: git://linuxtv.org/media_tree.git master
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot
Reported-by: Dan Carpenter
i < sdinfo->num_inputs; i++) {
887 inps = &sdinfo->inputs[i];
888 video->video_dev.tvnorms |= inps->std;
889 }
890 video->current_input = index;
891 unlock_out:
892 mutex_unlock(&video->lock);
893 return ret;
894 }
regards,
dan carpenter
In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
the problem is that "temp_index" can be negative. This patch changes
the types to unsigned to address this array underflow bug.
Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")
Si
ma map and unmap v4l2 buffers
in qbuf and dqbuf")
Signed-off-by: Dan Carpenter
---
v2: check videobuf_dqbuf() return
drivers/media/platform/omap/omap_vout.c | 15 ++-
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/drivers/media/platform/omap/omap_vout.c
b/dr
On Wed, Apr 10, 2019 at 01:24:44PM +0200, Hans Verkuil wrote:
> On 4/10/19 1:09 PM, Dan Carpenter wrote:
> > [ Hi Hans,
> >
> > This might not really be your bug, but I just respect you a lot and
> > so I always come to you with questions and for advice. -dan ]
&g
On Wed, Apr 10, 2019 at 12:50:31PM +0200, Hans Verkuil wrote:
> On 4/9/19 1:29 PM, Dan Carpenter wrote:
> > diff --git a/drivers/media/platform/omap/omap_vout.c
> > b/drivers/media/platform/omap/omap_vout.c
> > index 37f0d7146dfa..15e38990e85a 100644
> > --- a/
ent array out of bounds
later...
659 tea6420_route(mxb, a->index);
660 if (mxb->cur_audinput == 0)
661 mxb_update_audmode(mxb);
662 }
663 return 0;
664 }
665 return -EINVAL;
666 }
regards,
dan carpenter
hen re-initializes it
inside the videobuf_status() function. It's this final value which we
want.
Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers
in qbuf and dqbuf")
Signed-off-by: Dan Carpenter
---
UNTESTED! I think I understand this code now, but I
_allowed_mask mask is configured in pvr2_hdw_create()
and the highest valid bit is BIT(4).
Fixes: 7fb20fa38caa ("V4L/DVB (7299): pvrusb2: Improve logic which handles
input choice availability")
Signed-off-by: Dan Carpenter
---
drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 ++
drivers/medi
On Fri, Apr 05, 2019 at 12:02:49PM +0200, Andrzej Hajda wrote:
> Hi Dan,
>
> On 04.04.2019 17:42, Dan Carpenter wrote:
> > Hello Andrzej Hajda,
> >
> > The patch 4d0b0ed63660: "[media] s5p-mfc: use MFC_BUF_FLAG_EOS to
> > identify last buffers in decoder capt
Even if I have to manually muck
in the DB.
665 v4l2_event_queue_fh(&ctx->fh, &ev);
666 return 0;
667 default:
668 return -EINVAL;
669 }
670 }
regards,
dan carpenter
The st_register() returns have changed over time, but these days it
never returns -1. We should just be checking for any negative error
codes.
Signed-off-by: Dan Carpenter
---
drivers/media/radio/wl128x/fmdrv_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers
drivers:media:radio: wl128x: FM Driver Common
sources")
Signed-off-by: Dan Carpenter
---
drivers/media/radio/wl128x/fmdrv_common.c | 7 +--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/radio/wl128x/fmdrv_common.c
b/drivers/media/radio/wl128x/fmdrv_commo
On Mon, Mar 11, 2019 at 02:10:12PM +, Colin Ian King wrote:
> On 11/03/2019 14:07, Dan Carpenter wrote:
> > On Mon, Mar 11, 2019 at 10:14:05PM +0800, Mao Wenan wrote:
> >> There is no need to have the 'T *v' variable static
> >> since new v
Thanks!
Reviewed-by: Dan Carpenter
regards,
dan carpenter
t; struct media_entity *me = &sd->entity;
> - static resource_size_t res_len;
> + resource_size_t res_len;
^
Could you remove the extra space character also, please.
> struct resource *res;
> int ret;
regards,
dan carpenter
We forgot to set "ret" on this error path.
Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common
sources")
Signed-off-by: Dan Carpenter
---
drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff -
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
master
head: 550f4769c7c4a84e3966f20887c6e249c5f2afc4
commit: 05f634040c0d05f59f2dcd39722157cb3b57c85b [8840/10202] media:
staging/imx7: add imx7 CSI subdev driver
New smatch warnings:
drivers/staging/media/imx/imx7-me
We should be updating *pos. The current code is a no-op.
Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418
MPEG encoder chip")
Signed-off-by: Dan Carpenter
---
drivers/media/pci/cx18/cx18-fileops.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
We had intended to update *pos, but the current code is a no-op.
Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415
MPEG encoder/decoder")
Signed-off-by: Dan Carpenter
---
drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
1 file changed, 1 insertion(+),
We accidentally return IS_ERR(), which is 1, instead of the PTR_ERR()
which is the negative error code.
Fixes: 7807063b862b ("media: staging/imx7: add MIPI CSI-2 receiver subdev for
i.MX7")
Signed-off-by: Dan Carpenter
---
drivers/staging/media/imx/imx7-mipi-csis.c | 2 +-
1 file
3315 break;
3316
3317 default:
3318 break;
3319 }
regards,
dan carpenter
css->pipes[pipe].pool.binary_params_p[i]);
> + ipu3_css_pool_cleanup
> + (imgu,
> + &css->pipes[pipe].pool.binary_params_p[i]);
The original is better.
regards,
dan carpenter
This function prints an error message on success. I don't have the
hardware, I just noticed this while reading the code.
Fixes: 8b99312b7214 ("[media] Add v4l2 subdev driver for S5K4ECGX sensor")
Signed-off-by: Dan Carpenter
---
drivers/media/i2c/s5k4ecgx.c | 2 --
1 file chang
s objects that have static storage duration."
Static storage is initialized to zero so this is fine. It's just
that Sparse complains if you mix NULL and zero.
regards,
dan carpenter
>pci_dev->dev,
496 "failed to dequeue buffers (%ld)\n",
497 PTR_ERR(b));
498 break;
499 }
500
regards,
dan carpenter
into account.
I'm pretty sure it complains about both equally. If you make fix one
warning it will complain about the other. So you just have to pick
which warning to not care about.
regards,
dan carpenter
to be a gcc extension. So, I decided to check upstream
> >
> > No, this is not a gcc extension. It's part of the latest C standard.
>
> Sure? Where the C standard spec states that? I've been seeking for
> such info for a while, as '= {}' is also my personal preference.
>
> I tried to build the Kernel with clang, just to be sure that this
> won't cause issues with the clang support
My test says that clang works with {}.
I support this in Smatch as well.
regards,
dan carpenter
Hi Lubomir,
url:
https://github.com/0day-ci/linux/commits/Lubomir-Rintel/media-don-t-ifdef-v4l2_subdev_get_try_format-any-more/20181129-205631
base: git://linuxtv.org/media_tree.git master
smatch warnings:
drivers/media/i2c/ov2680.c:687 ov2680_get_fmt() warn: inconsistent returns
'mutex:&s
83a Benoit Parrot 2015-03-20 1101 struct
v4l2_subdev_format *fmt)
c4c0283a Benoit Parrot 2015-03-20 1102 {
c4c0283a Benoit Parrot 2015-03-20 1103struct i2c_client *client =
v4l2_get_subdevdata(sd);
5f5859d1 Dan Carpenter 2015-04-15 1104int in
The devm_ioremap_resource() function doesn't return NULL pointers, it
returns error pointers.
Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver")
Signed-off-by: Dan Carpenter
---
drivers/staging/media/sunxi/cedrus/cedrus_hw.c | 4 ++--
1 file changed, 2 i
Hi Lubomir,
url:
https://github.com/0day-ci/linux/commits/Lubomir-Rintel/media-ov7670-hook-s_power-onto-v4l2-core/20181105-163336
base: git://linuxtv.org/media_tree.git master
smatch warnings:
drivers/media/platform/marvell-ccic/mcam-core.c:1682 mcam_v4l_open() warn:
inconsistent returns '
p the code a bit and silence the static checker warning
by not passing the parameter at all.
Signed-off-by: Dan Carpenter
diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c
b/drivers/media/platform/mtk-vpu/mtk_vpu.c
index f8d35e3ac1dc..616f78b24a79 100644
--- a/drivers/media/platform/mtk-vpu/mtk
LL to that check can be removed.
The other thing is that if "ret" is an error code here, then we don't
want to do the next call to cam_i2c_write(), so actually let's flip that
test around and return the error. This is more of a theoretical issue
than something which is likely to
;
> unsigned int i, k;
> + size_t size;
> +
> + size = num_ref_pics * 4 * 8;
> + memset(vde->iram, 0, size);
I can't get behind the magical size calculation... :(
regards,
dan carpenter
TR_ERR(mt9v111->vblank);
1195 goto error_free_ctrls;
1196 }
1197
1198 /* PIXEL_RATE is fixed: just expose it to user space. */
1199 v4l2_ctrl_new_std(&mt9v111->ctrls, &mt9v111_ctrl_ops,
regards,
dan carpenter
The > should be >= so we don't read one element beyond the end of the
ca->slot_info[] array. The array is allocated in dvb_ca_en50221_init().
Signed-off-by: Dan Carpenter
diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c
b/drivers/media/dvb-core/dvb_ca_en50221.c
inde
If info->pdata is NULL then we would oops on the next line. And we can
flip the "ret" test around and give up if a failure has already occured.
Signed-off-by: Dan Carpenter
diff --git a/drivers/media/i2c/sr030pc30.c b/drivers/media/i2c/sr030pc30.c
index 2a4882cddc51..4ebd00198d34
not NULL
> > due
> > to line 26)
> > - On line 28, smatch assumes that vsp1->bru is not NULL
> > - On line 29, brx is assigned a non-NULL value (as vsp1->bru is not NULL
> > due
> > to line 28)
> > - On line 31, brx is assigned a possibly NULL value (as there's no
> > information
> > regarding vsp1->brs)
> > - On line 34, pipe->brx is not assigned a non-NULL value if brx is NULL
> > - On line 36 pipe->brx is dereferenced
> >
> > The problem comes from the fact that smatch assumes that vsp1->brs isn't
> > NULL.
> > Adding a "(void)vsp1->brs->entity;" statement on line 25 makes the warning
> > disappear.
> >
I will respond to the other emails in this thread. You guys are
basically spot on. All this analysis is 100% correct. Btw, if you want
to see Smatch's internal state you can do:
#include "/home/whatever/smatch/check_debug.h"
else if (!vsp1->bru->entity.pipe) {
__smatch_implied(&vsp1->bru->entity);
And it tells you what Smatch thinks it is at that point. The
__smatch_about() output can also be useful.
regards,
dan carpenter
ty;".
Smatch assumes &vsp1->bru->entity can be == to pipe->brx and NULL.
Adding a "(void)vsp1->bru->entity;" on that path will silence the
warning (hopefully).
regards,
dan carpenter
parately. In other words smatch_comparison.c has all the
information about brx == &vsp1->bru->entity and smatch_extra.c has the
information about if brx is NULL or non-NULL. They don't really share
information very well.
regards,
dan carpenter
27;s just taking the address. On the path where
we do:
else if (!vsp1->bru->entity.pipe)
brx = &vsp1->bru->entity;
Then Smatch sees that vsp1->bru is dereferenced and marks "brx" as
non-NULL.
regards,
dan carpenter
...
> }
>
> 4. format.pad = pipe->brx->source_pad
>
>
> (1) ensures that brx can't be NULL. (2) is thus always true if pipe->brx is
> NULL. (3) then assigns a non-NULL value to pipe->brx. Smatch should thus
> never
> complain about (4), even if it can't backtrack.
Oh wow... That's a very basic and ancient bug. I've written a fix and
will push it out tomorrow if it passes my testing.
regards,
dan carpenter
On Mon, May 28, 2018 at 01:54:18PM +0300, Laurent Pinchart wrote:
> Hi Dan,
>
> Thank you for your quick reply.
>
> On Monday, 28 May 2018 13:20:49 EEST Dan Carpenter wrote:
> > On Mon, May 28, 2018 at 11:28:41AM +0300, Laurent Pinchart wrote:
> > > and I still
) {
> struct vsp1_entity *released_brx = NULL;
>
Just to be clear. After this patch, Smatch does *NOT* think that
"pipe->brx" is necessarily non-NULL. What this patch does it that
Smatch says "pipe->brx has been modified on every code path since we
checked for NULL, so forget about the earlier check".
regards,
dan carpenter
On Fri, May 25, 2018 at 03:16:21PM +0200, Hans Verkuil wrote:
> On 25/05/18 15:12, Dan Carpenter wrote:
> > In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
> > the problem is that temp_index can be negative. I've made
> > cgf->num
In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
the problem is that temp_index can be negative. I've made
cgf->num_outputs unsigned to fix this issue.
Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")
Signed-off-by: Dan Car
rlier in a central place. There is no
one who need p->index to be more than INT_MAX.
Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")
Signed-off-by: Dan Carpenter
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c
b/drivers/media/v4l2-core/v4l2-ioctl.c
index a40db
If we pick a very large "edid->blocks" value then the "edid->start_block
+ edid->blocks" addition could wrap around.
Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts")
Signed-off-by: Dan Carpenter
diff --git a/drivers/media/platf
s/media/dvb-core/dvb_net.c:252 handle_one_ule_extension() warn:
> > potential spectre issue 'p->ule_next_hdr'
>
> I failed to see what's wrong here, or if this is exploited.
Oh... Huh. This is a bug in smatch. That line looks like:
p->ule_sndu_type =
On Tue, May 15, 2018 at 12:29:10PM -0500, Gustavo A. R. Silva wrote:
>
>
> On 05/15/2018 09:16 AM, Dan Carpenter wrote:
> > > >
> > > > I'm curious about how you finally resolved to handle these issues.
> > > >
> > > > I noticed
mismatches with Control-Flow Integrity, caused by calling standard
> ioctls using a function pointer that doesn't match the function type.
>
> Signed-off-by: Sami Tolvanen
> Signed-off-by: Hans Verkuil
> Signed-off-by: Mauro Carvalho Chehab
>
Possibly... There was an ancient bug in Smatch's function pointer
handling. I just pushed a fix for it now so the warning is there on
linux-next.
regards,
dan carpenter
minor bug would exist too... If there were really a race condition like
that then we'd want to fix it instead. In other words, this is not a
real life bug fix.
But it would be fine as a readability or static checker fix so that's
fine.
regards,
dan carpenter
^^^
350 out:
351 mutex_unlock(&vin->group->lock);
352
353 kref_put(&vin->group->refcount, rvin_group_release);
^^^^^^^^
There are a bunch of NULL dereferences here...
354 }
regards,
dan carpenter
And yet here we are.
409 return 0;
410 }
regards,
dan carpenter
if (rval)
> @@ -1287,7 +1287,9 @@ static int ipipe_s_config(struct v4l2_subdev *sd,
> struct vpfe_ipipe_config *cfg)
> }
> kfree(params);
> }
> + return rval;
Doing a "return 0;" is more readable than "return rval;".
regards,
dan carpenter
> array _format_
> >
> > Notice that given that speculation windows are large, the policy is
> > to kill the speculation on the first load and not worry if it can be
> > completed with a dependent load/store [1].
> >
> > [1] https://marc.info/?l=l
Smatch complains that "venc" could be unintialized. There a couple
error paths where it looks like maybe that could happen. I don't know
if it's really a bug, but it's reasonable to set "venc" to NULL and
silence the warning.
Signed-off-by: Dan Carpenter
We check "lutdpc->dpc_size" in ipipe_validate_lutdpc_params() but if
it's invalid then we would have corrupted memory already when we do
the memcpy() before calling it.
We don't ever check "gamma->tbl_size" but we should since they come from
the user.
Signed-
x27;s not hard to invert the varible in this case, because the only thing
we need to change is imx_media_probe() to set:
+ imxmd->ipu_present = true;
regards,
dan carpenter
s */
> + if ((status & MIPI_CSIS_INTSRC_ERRORS) || 1) {
^^^
Was this supposed to make it into the published code?
> + for (i = 0; i < MIPI_CSIS_NUM_EVENTS; i++) {
> + if (!(status & state->eve
+ v4l2_err(&csi->sd, "failed to find upstream endpoint\n");
> + return ret;
> + }
> +
> + mutex_lock(&csi->lock);
> +
> + csi->upstream_ep = upstream_ep;
> + csi->is_csi2 = (upstream_ep.bus_type == V4L2_MBUS_CSI2);
> +
> + mutex_unlock(&csi->lock);
> +
> + return ret;
return 0;
> +}
> +
[ snip ]
> +
> +static int imx7_csi_remove(struct platform_device *pdev)
> +{
> + return 0;
> +}
There is no need for this empty (struct platform_driver)->remove()
function. See platform_drv_remove() for how it's called.
This looks nice, though.
regards,
dan carpenter
>
> +#ifdef CONFIG_64BIT
> /* To avoid owerflows when calling the efivar API */
> if (*out_len > ULONG_MAX)
> return -EINVAL;
> +#endif
I should just silence this particular warning in Smatch. I feel like
this is a pretty common thing and the ifdefs aren't very pretty. :(
regards,
dan carpenter
We should check if kzalloc() fails.
Fixes: 8f569c0b4e6b ("media: dvb-core: add helper functions for I2C binding")
Signed-off-by: Dan Carpenter
diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
index cf747d753a79..787fe06df217 100644
--- a/drivers/medi
On Tue, Mar 27, 2018 at 02:00:45PM +0900, Ji-Hun Kim wrote:
>
> Are there any opinions? I'd like to know how this patch is going.
>
Looks good. Thanks!
Greg just hasn't gotten to it yet.
regards,
dan carpenter
#x27;array' 14 <= 20
It's always good to simplify the code, but I have a fix for this that I
will publish very soon.
regards,
dan carpenter
dit to:
Reported-by: "Yavuz, Tuba"
regards,
dan carpenter
On Tue, Mar 20, 2018 at 02:30:45PM +, Yavuz, Tuba wrote:
> Hello,
>
>
> It looks like there is a double-free on an error path in the zr364xx_probe
> function of the zr364xx driver.
>
> fail:
> v4l
Looks good. Thanks!
regards,
dan carpenter
the calls to:
video_unregister_device(&dev->rx_vdev);
and
kfree(dev);
are a double free.
regards,
dan carpenter
On Tue, Mar 20, 2018 at 01:48:17PM +, Yavuz, Tuba wrote:
> Hello,
>
>
> It looks like there is a double-free vulnerability on an error path in the
ors all do a return or a goto so "rval"
would be zero here. Then the error path would look like:
err_free_params:
kfree(params);
return rval;
}
regards,
dan carpenter
o free_params.
1298 }
1299 kfree(params);
1300 }
1301 }
1302 error:
1303 return rval;
Change this to:
return 0;
free_params:
kfree(params);
return rval;
1304 }
regards,
dan carpenter
MUCH BETTER!111!Exclamationmark! Thanks! :)
regards,
dan carpenter
bool nfb4eof;/* NFB4EOF encountered during streaming */
> struct completion last_eof_comp;
regards,
dan carpenter
There is a double sizeof() typo here so we don't duplicate the struct
properly.
Fixes: be7fd3c3a8c5 ("media: em28xx: Hauppauge DualHD second tuner
functionality")
Signed-off-by: Dan Carpenter
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c
b/drivers/media/usb/em28xx/em28x
>> 8) & 0x03);
> >
>
> Won't your analyzer in that case point out that
> "15 >> 8 is zero" again? I may have been underestimating it though
>
It will complain, yes, but it's a pretty common false positive and I
have it in the back of my head to teach the static checker to look for
that situation. Eventually I will get around to it.
regards,
dan carpenter
On Fri, Mar 02, 2018 at 03:20:16PM +0100, jacopo mondi wrote:
> Hi Dan,
>
> On Thu, Mar 01, 2018 at 12:59:54PM +0300, Dan Carpenter wrote:
> > [ I know you're just copying files, but you might have a fix for these
> > since you're looking at the code. - dan
The ">" should be ">=" so that we don't read one element beyond the end
of the array.
Fixes: 8a77009be4be ("media: ov5695: add support for OV5695 sensor")
Signed-off-by: Dan Carpenter
diff --git a/drivers/media/i2c/ov5695.c b/drivers/media/i2c/ov5695.
ret = i2c_smbus_write_byte_data(client, VACTIVE_LO,
545 vact & 0xff);
546
547 return ret;
548 }
regards,
dan carpenter
}
728 pos = ret & 0x0f;
729 if (pos < 0x0f)
^^
Smatch thinks this implies pos can be 0-14.
730 type |= regs[pos].type.vbi_type;
^
This array only has 5 elements.
731 }
732
733 return type;
734 }
regards,
dan carpenter
he right thing. But here
it just makes it look like a variable when it's a constant. It's makes
the code slightly less readable.
Just ignore the warning.
regards,
dan carpenter
adv7511_probe(struct i2c_client *i2c, const
> struct i2c_device_id *id)
> adv7511_audio_init(dev, adv7511);
> return 0;
>
> +err_unregister_packet:
> + i2c_unregister_device(adv7511->i2c_packet);
> err_unregister_cec:
> i2c_unregister_device(adv7511->i2c_cec);
> if (adv7511->cec_clk)
regards,
dan carpenter
e two bugs that Geert found where the right side
wasn't a number literal.
drivers/net/can/m_can/m_can.c:#define RXFC_FWM_MASK (0x7f < RXFC_FWM_SHIFT)
drivers/usb/gadget/udc/goku_udc.h:#define INT_EPnNAK(n) (0x00100 < (n))
/* 0 < n < 4 */
regards,
dan carpenter
On Tue, Feb 06, 2018 at 02:15:51PM +0100, Julia Lawall wrote:
>
>
> On Tue, 6 Feb 2018, Dan Carpenter wrote:
>
> > On Mon, Feb 05, 2018 at 09:09:57PM +0100, Wolfram Sang wrote:
> > > In one Renesas driver, I found a typo which turned an intended bit shift
> >
e. Julia the bugs
look like this:
- reissue_mask |= 0x < 4;
+ reissue_mask |= 0x << 4;
regards,
dan carpenter
> Wolfram Sang (4):
> v4l: vsp1: fix mask creation for MULT_ALPHA_RATIO
> drm/exynos: fix comparison to bi
Signed-off-by: Dan Carpenter
diff --git a/drivers/media/i2c/sr030pc30.c b/drivers/media/i2c/sr030pc30.c
index 0bf031b7e4fa..2a4882cddc51 100644
--- a/drivers/media/i2c/sr030pc30.c
+++ b/drivers/media/i2c/sr030pc30.c
@@ -511,13 +511,16 @@ static int sr030pc30_get_fmt(struct v4l2_subdev *sd
in videobuf2-v4l2.c is called by
> vb2_core_dqbuf().
> And that __fill_v4l2_buffer() overwrited the index field: b->index =
> vb->index;
>
> So after the vb2_dqbuf call the buf->index field is correct and bounded.
>
Ah.. I get it. Thanks.
regards,
dan carpenter
On Thu, Jan 25, 2018 at 10:58:45AM +0100, Andrzej Hajda wrote:
> On 23.01.2018 09:32, Dan Carpenter wrote:
> > Hello Andrzej Hajda,
> >
> > The patch 4d0b0ed63660: "[media] s5p-mfc: use MFC_BUF_FLAG_EOS to
> > identify last buffers in decoder capture queue&quo
1 - 100 of 738 matches
Mail list logo
