osd: fixed osd coverity error [1/1]

PD#SWPL-13983

Problem:
fixed osd coverity error

Solution:
fixed osd coverity error

Verify:
coverity check

Change-Id: I5689930d4112493827dc07e22aa5d086dc2104d7
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
(cherry picked from commit 4efcc5b340309d92fb79c7d6f473931327436244)

diff --git a/drivers/amlogic/media/osd/osd_drm.c b/drivers/amlogic/media/osd/osd_drm.c
index 6aaf297562e78a31a442cb50d849aeb4262b773c..662fdbf1dc401737151df1badbbb187c4df1b4ac 100644 (file)
--- a/drivers/amlogic/media/osd/osd_drm.c
+++ b/drivers/amlogic/media/osd/osd_drm.c
@@ -57,7 +57,6 @@ static int parse_para(const char *para, int para_num, int *result)
 
        if (!para)
                return 0;
-
        params = kstrdup(para, GFP_KERNEL);
        params_base = params;
        token = params;
@@ -130,18 +129,24 @@ static ssize_t logmodule_write_file(
        size_t count, loff_t *ppos)
 {
        unsigned int log_module;
-       char buf[128];
+       char *buf = NULL;
        int ret = 0;
 
        if (count > sizeof(buf) || count <= 0)
                return -EINVAL;
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count + 1, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
+       }
        if (buf[count - 1] == '\n')
                buf[count - 1] = '\0';
        ret = kstrtoint(buf, 0, &log_module);
        osd_log_info("log_level: %d->%d\n", osd_log_module, log_module);
        osd_log_module = log_module;
+       kfree(buf);
        return count;
 }
 
@@ -191,16 +196,20 @@ static ssize_t osd_display_debug_write_file(struct file *file,
 {
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
-       char buf[128];
+       char *buf = NULL;
        u32 osd_display_debug_enable;
        int ret = 0;
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
-       buf[count] = 0;
+       }
        ret = kstrtoint(buf, 0, &osd_display_debug_enable);
        osd_set_display_debug(osd_id, osd_display_debug_enable);
+       kfree(buf);
        return count;
 }
 
@@ -231,17 +240,21 @@ static ssize_t blank_read_file(struct file *file, char __user *userbuf,
 static ssize_t blank_write_file(struct file *file, const char __user *userbuf,
                                   size_t count, loff_t *ppos)
 {
-       char buf[128];
+       char *buf = NULL;
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
        int ret = 0;
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
-       buf[count] = 0;
+       }
        ret = kstrtoint(buf, 0, &osd_enable[osd_id]);
        osd_enable_hw(osd_id, (osd_enable[osd_id] != 0) ? 0 : 1);
+       kfree(buf);
        return count;
 }
 
@@ -264,18 +277,22 @@ static ssize_t free_scale_write_file(struct file *file,
                                const char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-       char buf[128];
+       char *buf = NULL;
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
        unsigned int free_scale_enable;
        int ret = 0;
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
-       buf[count] = 0;
+       }
        ret = kstrtoint(buf, 0, &free_scale_enable);
        osd_set_free_scale_enable_hw(osd_id, free_scale_enable);
+       kfree(buf);
        return count;
 }
 
@@ -298,20 +315,25 @@ static ssize_t free_scale_axis_write_file(struct file *file,
                                const char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-       char buf[128];
+       char *buf = NULL;
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
        int parsed[4];
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count + 1, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
+       }
        buf[count] = 0;
        if (likely(parse_para(buf, 4, parsed) == 4))
                osd_set_free_scale_axis_hw(osd_id,
                        parsed[0], parsed[1], parsed[2], parsed[3]);
        else
                osd_log_err("set free scale axis error\n");
+       kfree(buf);
        return count;
 }
 
@@ -335,20 +357,25 @@ static ssize_t window_axis_write_file(struct file *file,
                                const char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-       char buf[128];
+       char *buf = NULL;
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
        int parsed[4];
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count + 1, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
+       }
        buf[count] = 0;
        if (likely(parse_para(buf, 4, parsed) == 4))
                osd_set_window_axis_hw(osd_id,
                        parsed[0], parsed[1], parsed[2], parsed[3]);
        else
                osd_log_err("set window axis error\n");
+       kfree(buf);
        return count;
 }
 
@@ -375,20 +402,24 @@ static ssize_t osd_reverse_write_file(struct file *file,
                                const char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-       char buf[128];
+       char *buf = NULL;
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
        unsigned int osd_reverse = 0;
        int ret = 0;
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
-       buf[count] = 0;
+       }
        ret = kstrtoint(buf, 0, &osd_reverse);
        if (osd_reverse >= REVERSE_MAX)
                osd_reverse = REVERSE_FALSE;
        osd_set_reverse_hw(osd_id, osd_reverse, 1);
+       kfree(buf);
        return count;
 }
 
@@ -411,18 +442,22 @@ static ssize_t osd_order_write_file(struct file *file,
                                const char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-       char buf[128];
+       char *buf = NULL;
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
        unsigned int order = 0;
        int ret = 0;
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
-       buf[count] = 0;
+       }
        ret = kstrtoint(buf, 0, &order);
        osd_set_order_hw(osd_id, order);
+       kfree(buf);
        return count;
 }
 
@@ -447,17 +482,21 @@ static ssize_t osd_afbcd_write_file(struct file *file,
 {
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
-       char buf[128];
+       char *buf = NULL;
        unsigned int enable_afbcd = 0;
        int ret = 0;
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
-       buf[count] = 0;
+       }
        ret = kstrtoint(buf, 0, &enable_afbcd);
        osd_log_info("afbc: %d\n", enable_afbcd);
        osd_set_afbc(osd_id, enable_afbcd);
+       kfree(buf);
        return count;
 }
 
@@ -465,19 +504,23 @@ static ssize_t osd_clear_write_file(struct file *file,
                                const char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-       char buf[128];
+       char *buf = NULL;
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
        unsigned int osd_clear = 0;
        int ret = 0;
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
-       buf[count] = 0;
+       }
        ret = kstrtoint(buf, 0, &osd_clear);
        if (osd_clear)
                osd_set_clear(osd_id);
+       kfree(buf);
        return count;
 }
 
@@ -584,17 +627,21 @@ static ssize_t osd_hwc_enable_write_file(struct file *file,
 {
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
-       char buf[128];
+       char *buf = NULL;
        unsigned int hwc_enable = 0;
        int ret = 0;
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
-       buf[count] = 0;
+       }
        ret = kstrtoint(buf, 0, &hwc_enable);
        osd_log_info("hwc enable: %d\n", hwc_enable);
        osd_set_hwc_enable(osd_id, hwc_enable);
+       kfree(buf);
        return count;
 }
 
@@ -604,18 +651,22 @@ static ssize_t osd_do_hwc_write_file(struct file *file,
 {
        struct seq_file *s = file->private_data;
        int osd_id = *(int *)s;
-       char buf[128];
+       char *buf = NULL;
        unsigned int do_hwc = 0;
        int ret = 0;
 
-       count = min_t(size_t, count, (sizeof(buf)-1));
-       if (copy_from_user(buf, userbuf, count))
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+       if (copy_from_user(buf, userbuf, count)) {
+               kfree(buf);
                return -EFAULT;
-       buf[count] = 0;
+       }
        ret = kstrtoint(buf, 0, &do_hwc);
        osd_log_info("do_hwc: %d\n", do_hwc);
        if (do_hwc)
                osd_do_hwc(osd_id);
+       kfree(buf);
        return count;
 }
 

diff --git a/drivers/amlogic/media/osd/osd_fb.c b/drivers/amlogic/media/osd/osd_fb.c
index 5da35272c8e277369e25990457f1cbcdd89c790d..eb3152cb4ba6a1cb886ed35ba24534e6d6a9491c 100644 (file)
--- a/drivers/amlogic/media/osd/osd_fb.c
+++ b/drivers/amlogic/media/osd/osd_fb.c
@@ -1164,7 +1164,7 @@ static int osd_compat_ioctl(struct fb_info *info,
 
 static int malloc_osd_memory(struct fb_info *info)
 {
-       int j;
+       int j = 0;
        int ret = 0;
        u32 fb_index;
        int logo_index = -1;
@@ -1432,14 +1432,16 @@ static int malloc_osd_memory(struct fb_info *info)
                if (fbdev->fb_mem_vaddr)
                        memset(fbdev->fb_mem_vaddr, 0x0, fbdev->fb_len);
                if (osd_meson_dev.afbc_type && osd_get_afbc(fb_index)) {
-                       for (j = 1; j < OSD_MAX_BUF_NUM; j++) {
-                               osd_log_info(
-                                       "---------------clear fb%d memory %p\n",
-                                       fb_index,
-                                       fbdev->fb_mem_afbc_vaddr[j]);
-                               memset(fbdev->fb_mem_afbc_vaddr[j],
-                                       0x0,
-                                       fbdev->fb_afbc_len[j]);
+                       for (j = 0; j < OSD_MAX_BUF_NUM; j++) {
+                               if (j > 0) {
+                                       osd_log_info(
+                                               "---------------clear fb%d memory %p\n",
+                                               fb_index,
+                                               fbdev->fb_mem_afbc_vaddr[j]);
+                                       memset(fbdev->fb_mem_afbc_vaddr[j],
+                                              0x0,
+                                              fbdev->fb_afbc_len[j]);
+                               }
                        }
                } else {
                        /* two case in one