From bc8e2d627a5888c48d553abe534c341c1c096a5e Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Thu, 22 Jun 2017 14:27:21 -0300 Subject: [PATCH] media: venus: fix loop wrap in cleanup of clks The current pre-decrement is incorrect and should be replaced with a post-decrement. Consider the case where the very first clk_prepare_enable fails when i is 0; in this case the error clean up will decrement the unsigned int which wraps to the largest unsigned int value causing an array out of bounds read on core->clks[i]. Detected by CoverityScan, CID#1446590 ("Out-of-bounds read") Signed-off-by: Colin Ian King Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/platform/qcom/venus/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c index 776d2bae6979..d8cbe8549d97 100644 --- a/drivers/media/platform/qcom/venus/core.c +++ b/drivers/media/platform/qcom/venus/core.c @@ -137,7 +137,7 @@ static int venus_clks_enable(struct venus_core *core) return 0; err: - while (--i) + while (i--) clk_disable_unprepare(core->clks[i]); return ret; -- 2.20.1