From: Cao Jian <jian.cao@amlogic.com>
Date: Thu, 14 Nov 2019 14:02:28 +0000 (+0800)
Subject: ge2d: fix ge2d coverity issue [1/1]
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=254b2e75cde8e2392afd7d0f5b949b9f4f824726;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git

ge2d: fix ge2d coverity issue [1/1]

PD#SWPL-13975

Problem:
coverity defect cleanup for ge2d

Solution:
DEADCODE on aml_dmabuf_ops_attach()
RESOURCE_LEAK on aml_dma_alloc()
REVERSE_INULL on aml_dma_mmap()
USE_AFTER_FREE on aml_dma_put()
COPY_PASTE_ERROR&FORWARD_NULL on build_ge2d_config()

Verify:
coverity check

Change-Id: I1b80cb993254adb1721dfb2e5b25db0248dca1a6
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
(cherry picked from commit 801723a61128d84861d64ee5336e6054169fea8b)
---

diff --git a/drivers/amlogic/media/common/ge2d/ge2d_dmabuf.c b/drivers/amlogic/media/common/ge2d/ge2d_dmabuf.c
index e397caa1fc2e..c5502f25f212 100644
--- a/drivers/amlogic/media/common/ge2d/ge2d_dmabuf.c
+++ b/drivers/amlogic/media/common/ge2d/ge2d_dmabuf.c
@@ -102,9 +102,9 @@ static void aml_dma_put(void *buf_priv)
 	buf->vaddr = NULL;
 	clear_dma_buffer((struct aml_dma_buffer *)buf->priv, buf->index);
 	put_device(buf->dev);
-	kfree(buf);
 	ge2d_log_dbg("ge2d free:aml_dma_buf=0x%p,buf->index=%d\n",
 		buf, buf->index);
+	kfree(buf);
 }
 
 static void *aml_dma_alloc(struct device *dev, unsigned long attrs,
@@ -129,6 +129,7 @@ static void *aml_dma_alloc(struct device *dev, unsigned long attrs,
 	if (cma_pages) {
 		paddr = page_to_phys(cma_pages);
 	} else {
+		kfree(buf);
 		pr_err("failed to alloc cma pages.\n");
 		return NULL;
 	}
@@ -148,7 +149,7 @@ static int aml_dma_mmap(void *buf_priv, struct vm_area_struct *vma)
 {
 	struct aml_dma_buf *buf = buf_priv;
 	unsigned long pfn = 0;
-	unsigned long vsize = vma->vm_end - vma->vm_start;
+	unsigned long vsize;
 	int ret = -1;
 
 	if (!buf || !vma) {
@@ -156,6 +157,8 @@ static int aml_dma_mmap(void *buf_priv, struct vm_area_struct *vma)
 		return -EINVAL;
 	}
 
+	vsize = vma->vm_end - vma->vm_start;
+
 	pfn = buf->dma_addr >> PAGE_SHIFT;
 	ret = remap_pfn_range(vma, vma->vm_start, pfn,
 		vsize, vma->vm_page_prot);
@@ -206,11 +209,6 @@ static int aml_dmabuf_ops_attach(struct dma_buf *dbuf, struct device *dev,
 	for_each_sg(sgt->sgl, sg, sgt->nents, i) {
 		struct page *page = phys_to_page(phys);
 
-		if (!page) {
-			sg_free_table(sgt);
-			kfree(attach);
-			return -ENOMEM;
-		}
 		sg_set_page(sg, page, PAGE_SIZE, 0);
 		phys += PAGE_SIZE;
 	}
diff --git a/drivers/amlogic/media/common/ge2d/ge2d_wq.c b/drivers/amlogic/media/common/ge2d/ge2d_wq.c
index 3e35319206f3..b775f27684a9 100644
--- a/drivers/amlogic/media/common/ge2d/ge2d_wq.c
+++ b/drivers/amlogic/media/common/ge2d/ge2d_wq.c
@@ -806,7 +806,7 @@ static int build_ge2d_config(struct ge2d_context_s *context,
 					update_canvas_cfg(canvas_cfg,
 						cfg->dst_planes[i].addr,
 						cfg->dst_planes[i].w *
-						src->bpp / 8,
+						dst->bpp / 8,
 						cfg->dst_planes[i].h);
 				}
 			}
@@ -824,7 +824,8 @@ static int setup_display_property(struct src_dst_para_s *src_dst, int index)
 	u32 cs_width = 0, cs_height = 0, cs_addr = 0;
 	unsigned	int	data32;
 	unsigned	int	bpp;
-	unsigned int	block_mode[] = {2, 4, 8, 16, 16, 32, 0, 24};
+	unsigned int	block_mode[] = {2, 4, 8, 16, 16, 32, 0, 24,
+					0, 0, 0, 0, 0, 0, 0, 0};
 
 	src_dst->canvas_index = index;
 	if (ge2d_meson_dev.canvas_status == 0) {