From: Pengcheng Chen <pengcheng.chen@amlogic.com>
Date: Fri, 15 Nov 2019 08:42:05 +0000 (+0800)
Subject: osd: fixed osd coverity error [1/1]
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=d266ad6469838a64da5a527ad634e4bac942e7fa;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git

osd: fixed osd coverity error [1/1]

PD#SWPL-13983

Problem:
fixed osd coverity error

Solution:
fixed osd coverity error

Verify:
coverity check

Change-Id: I5689930d4112493827dc07e22aa5d086dc2104d7
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
(cherry picked from commit 4efcc5b340309d92fb79c7d6f473931327436244)
---

diff --git a/drivers/amlogic/media/osd/osd_drm.c b/drivers/amlogic/media/osd/osd_drm.c
index 6aaf297562e7..662fdbf1dc40 100644
--- a/drivers/amlogic/media/osd/osd_drm.c
+++ b/drivers/amlogic/media/osd/osd_drm.c
@@ -57,7 +57,6 @@ static int parse_para(const char *para, int para_num, int *result)
 
 	if (!para)
 		return 0;
-
 	params = kstrdup(para, GFP_KERNEL);
 	params_base = params;
 	token = params;
@@ -130,18 +129,24 @@ static ssize_t logmodule_write_file(
 	size_t count, loff_t *ppos)
 {
 	unsigned int log_module;
-	char buf[128];
+	char *buf = NULL;
 	int ret = 0;
 
 	if (count > sizeof(buf) || count <= 0)
 		return -EINVAL;
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count + 1, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
+	}
 	if (buf[count - 1] == '\n')
 		buf[count - 1] = '\0';
 	ret = kstrtoint(buf, 0, &log_module);
 	osd_log_info("log_level: %d->%d\n", osd_log_module, log_module);
 	osd_log_module = log_module;
+	kfree(buf);
 	return count;
 }
 
@@ -191,16 +196,20 @@ static ssize_t osd_display_debug_write_file(struct file *file,
 {
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
-	char buf[128];
+	char *buf = NULL;
 	u32 osd_display_debug_enable;
 	int ret = 0;
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
-	buf[count] = 0;
+	}
 	ret = kstrtoint(buf, 0, &osd_display_debug_enable);
 	osd_set_display_debug(osd_id, osd_display_debug_enable);
+	kfree(buf);
 	return count;
 }
 
@@ -231,17 +240,21 @@ static ssize_t blank_read_file(struct file *file, char __user *userbuf,
 static ssize_t blank_write_file(struct file *file, const char __user *userbuf,
 				   size_t count, loff_t *ppos)
 {
-	char buf[128];
+	char *buf = NULL;
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
 	int ret = 0;
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
-	buf[count] = 0;
+	}
 	ret = kstrtoint(buf, 0, &osd_enable[osd_id]);
 	osd_enable_hw(osd_id, (osd_enable[osd_id] != 0) ? 0 : 1);
+	kfree(buf);
 	return count;
 }
 
@@ -264,18 +277,22 @@ static ssize_t free_scale_write_file(struct file *file,
 				const char __user *userbuf,
 				size_t count, loff_t *ppos)
 {
-	char buf[128];
+	char *buf = NULL;
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
 	unsigned int free_scale_enable;
 	int ret = 0;
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
-	buf[count] = 0;
+	}
 	ret = kstrtoint(buf, 0, &free_scale_enable);
 	osd_set_free_scale_enable_hw(osd_id, free_scale_enable);
+	kfree(buf);
 	return count;
 }
 
@@ -298,20 +315,25 @@ static ssize_t free_scale_axis_write_file(struct file *file,
 				const char __user *userbuf,
 				size_t count, loff_t *ppos)
 {
-	char buf[128];
+	char *buf = NULL;
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
 	int parsed[4];
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count + 1, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
+	}
 	buf[count] = 0;
 	if (likely(parse_para(buf, 4, parsed) == 4))
 		osd_set_free_scale_axis_hw(osd_id,
 			parsed[0], parsed[1], parsed[2], parsed[3]);
 	else
 		osd_log_err("set free scale axis error\n");
+	kfree(buf);
 	return count;
 }
 
@@ -335,20 +357,25 @@ static ssize_t window_axis_write_file(struct file *file,
 				const char __user *userbuf,
 				size_t count, loff_t *ppos)
 {
-	char buf[128];
+	char *buf = NULL;
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
 	int parsed[4];
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count + 1, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
+	}
 	buf[count] = 0;
 	if (likely(parse_para(buf, 4, parsed) == 4))
 		osd_set_window_axis_hw(osd_id,
 			parsed[0], parsed[1], parsed[2], parsed[3]);
 	else
 		osd_log_err("set window axis error\n");
+	kfree(buf);
 	return count;
 }
 
@@ -375,20 +402,24 @@ static ssize_t osd_reverse_write_file(struct file *file,
 				const char __user *userbuf,
 				size_t count, loff_t *ppos)
 {
-	char buf[128];
+	char *buf = NULL;
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
 	unsigned int osd_reverse = 0;
 	int ret = 0;
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
-	buf[count] = 0;
+	}
 	ret = kstrtoint(buf, 0, &osd_reverse);
 	if (osd_reverse >= REVERSE_MAX)
 		osd_reverse = REVERSE_FALSE;
 	osd_set_reverse_hw(osd_id, osd_reverse, 1);
+	kfree(buf);
 	return count;
 }
 
@@ -411,18 +442,22 @@ static ssize_t osd_order_write_file(struct file *file,
 				const char __user *userbuf,
 				size_t count, loff_t *ppos)
 {
-	char buf[128];
+	char *buf = NULL;
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
 	unsigned int order = 0;
 	int ret = 0;
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
-	buf[count] = 0;
+	}
 	ret = kstrtoint(buf, 0, &order);
 	osd_set_order_hw(osd_id, order);
+	kfree(buf);
 	return count;
 }
 
@@ -447,17 +482,21 @@ static ssize_t osd_afbcd_write_file(struct file *file,
 {
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
-	char buf[128];
+	char *buf = NULL;
 	unsigned int enable_afbcd = 0;
 	int ret = 0;
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
-	buf[count] = 0;
+	}
 	ret = kstrtoint(buf, 0, &enable_afbcd);
 	osd_log_info("afbc: %d\n", enable_afbcd);
 	osd_set_afbc(osd_id, enable_afbcd);
+	kfree(buf);
 	return count;
 }
 
@@ -465,19 +504,23 @@ static ssize_t osd_clear_write_file(struct file *file,
 				const char __user *userbuf,
 				size_t count, loff_t *ppos)
 {
-	char buf[128];
+	char *buf = NULL;
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
 	unsigned int osd_clear = 0;
 	int ret = 0;
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
-	buf[count] = 0;
+	}
 	ret = kstrtoint(buf, 0, &osd_clear);
 	if (osd_clear)
 		osd_set_clear(osd_id);
+	kfree(buf);
 	return count;
 }
 
@@ -584,17 +627,21 @@ static ssize_t osd_hwc_enable_write_file(struct file *file,
 {
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
-	char buf[128];
+	char *buf = NULL;
 	unsigned int hwc_enable = 0;
 	int ret = 0;
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
-	buf[count] = 0;
+	}
 	ret = kstrtoint(buf, 0, &hwc_enable);
 	osd_log_info("hwc enable: %d\n", hwc_enable);
 	osd_set_hwc_enable(osd_id, hwc_enable);
+	kfree(buf);
 	return count;
 }
 
@@ -604,18 +651,22 @@ static ssize_t osd_do_hwc_write_file(struct file *file,
 {
 	struct seq_file *s = file->private_data;
 	int osd_id = *(int *)s;
-	char buf[128];
+	char *buf = NULL;
 	unsigned int do_hwc = 0;
 	int ret = 0;
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
-	if (copy_from_user(buf, userbuf, count))
+	buf = kmalloc(count, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (copy_from_user(buf, userbuf, count)) {
+		kfree(buf);
 		return -EFAULT;
-	buf[count] = 0;
+	}
 	ret = kstrtoint(buf, 0, &do_hwc);
 	osd_log_info("do_hwc: %d\n", do_hwc);
 	if (do_hwc)
 		osd_do_hwc(osd_id);
+	kfree(buf);
 	return count;
 }
 
diff --git a/drivers/amlogic/media/osd/osd_fb.c b/drivers/amlogic/media/osd/osd_fb.c
index 5da35272c8e2..eb3152cb4ba6 100644
--- a/drivers/amlogic/media/osd/osd_fb.c
+++ b/drivers/amlogic/media/osd/osd_fb.c
@@ -1164,7 +1164,7 @@ static int osd_compat_ioctl(struct fb_info *info,
 
 static int malloc_osd_memory(struct fb_info *info)
 {
-	int j;
+	int j = 0;
 	int ret = 0;
 	u32 fb_index;
 	int logo_index = -1;
@@ -1432,14 +1432,16 @@ static int malloc_osd_memory(struct fb_info *info)
 		if (fbdev->fb_mem_vaddr)
 			memset(fbdev->fb_mem_vaddr, 0x0, fbdev->fb_len);
 		if (osd_meson_dev.afbc_type && osd_get_afbc(fb_index)) {
-			for (j = 1; j < OSD_MAX_BUF_NUM; j++) {
-				osd_log_info(
-					"---------------clear fb%d memory %p\n",
-					fb_index,
-					fbdev->fb_mem_afbc_vaddr[j]);
-				memset(fbdev->fb_mem_afbc_vaddr[j],
-					0x0,
-					fbdev->fb_afbc_len[j]);
+			for (j = 0; j < OSD_MAX_BUF_NUM; j++) {
+				if (j > 0) {
+					osd_log_info(
+						"---------------clear fb%d memory %p\n",
+						fb_index,
+						fbdev->fb_mem_afbc_vaddr[j]);
+					memset(fbdev->fb_mem_afbc_vaddr[j],
+					       0x0,
+					       fbdev->fb_afbc_len[j]);
+				}
 			}
 		} else {
 			/* two case in one