]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
authorYunfei Dong <yunfei.dong@mediatek.com>
Thu, 13 Jun 2024 09:33:56 +0000 (17:33 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 4 Oct 2024 14:33:08 +0000 (16:33 +0200)
[ Upstream commit b113bc7c0e83b32f4dd2d291a2b6c4803e0a2c44 ]

Fix a smatch static checker warning on vdec_vp8_req_if.c.
Which leads to a kernel crash when fb is NULL.

Fixes: 7a7ae26fd458 ("media: mediatek: vcodec: support stateless VP8 decoding")
Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c

index e27e728f392e6cf1d59af96797d93d767bd1ad92..232ef3bd246a3d7615e0c9931e30bb7fa84dec36 100644 (file)
@@ -334,14 +334,18 @@ static int vdec_vp8_slice_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
        src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
 
        fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst->ctx);
-       dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
+       if (!fb) {
+               mtk_vdec_err(inst->ctx, "fb buffer is NULL");
+               return -ENOMEM;
+       }
 
-       y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
+       dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
+       y_fb_dma = fb->base_y.dma_addr;
        if (inst->ctx->q_data[MTK_Q_DATA_DST].fmt->num_planes == 1)
                c_fb_dma = y_fb_dma +
                        inst->ctx->picinfo.buf_w * inst->ctx->picinfo.buf_h;
        else
-               c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
+               c_fb_dma = fb->base_c.dma_addr;
 
        inst->vsi->dec.bs_dma = (u64)bs->dma_addr;
        inst->vsi->dec.bs_sz = bs->size;