[PATCH 01/14] rc: fix bad indenting

[PATCH 01/14] rc: fix bad indenting

[Mauro Carvalho Chehab]

drivers/media/rc/rc-main.c:749 rc_close() warn: inconsistent indenting

There's an extra space there.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index f8c5e47a30aa..0ff388a16168 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -746,7 +746,7 @@ void rc_close(struct rc_dev *rdev)
 	if (rdev) {
 		mutex_lock(&rdev->lock);
 
-		 if (!--rdev->users && rdev->close != NULL)
+		if (!--rdev->users && rdev->close != NULL)
 			rdev->close(rdev);
 
 		mutex_unlock(&rdev->lock);
-- 
2.1.0

[PATCH 02/14] cx18: avoid going past input/audio array

[Mauro Carvalho Chehab]

As reported by smatch:
	drivers/media/pci/cx18/cx18-driver.c:807 cx18_init_struct2() error: buffer overflow 'cx->card->video_inputs' 6 <= 6

That happens because nof_inputs and nof_audio_inputs can be initialized
as CX18_CARD_MAX_VIDEO_INPUTS, instead of CX18_CARD_MAX_VIDEO_INPUTS - 1.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c
index 83f5074706f9..260e462d91b4 100644
--- a/drivers/media/pci/cx18/cx18-driver.c
+++ b/drivers/media/pci/cx18/cx18-driver.c
@@ -786,11 +786,11 @@ static void cx18_init_struct2(struct cx18 *cx)
 {
 	int i;
 
-	for (i = 0; i < CX18_CARD_MAX_VIDEO_INPUTS; i++)
+	for (i = 0; i < CX18_CARD_MAX_VIDEO_INPUTS - 1; i++)
 		if (cx->card->video_inputs[i].video_type == 0)
 			break;
 	cx->nof_inputs = i;
-	for (i = 0; i < CX18_CARD_MAX_AUDIO_INPUTS; i++)
+	for (i = 0; i < CX18_CARD_MAX_AUDIO_INPUTS - 1; i++)
 		if (cx->card->audio_inputs[i].audio_type == 0)
 			break;
 	cx->nof_audio_inputs = i;
-- 
2.1.0

[PATCH 03/14] saa7134: fix indent issues

[Mauro Carvalho Chehab]

As reported by smatch:
	drivers/media/pci/saa7134/saa7134-cards.c:7197 saa7134_xc2028_callback() warn: inconsistent indenting
	drivers/media/pci/saa7134/saa7134-cards.c:7846 saa7134_board_init2() warn: inconsistent indenting
	drivers/media/pci/saa7134/saa7134-cards.c:7913 saa7134_board_init2() warn: inconsistent indenting

While here, fix a few CodingStyle issues on the affected code

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/pci/saa7134/saa7134-cards.c b/drivers/media/pci/saa7134/saa7134-cards.c
index 3ca078057755..d48fd5338db5 100644
--- a/drivers/media/pci/saa7134/saa7134-cards.c
+++ b/drivers/media/pci/saa7134/saa7134-cards.c
@@ -7194,7 +7194,7 @@ static int saa7134_xc2028_callback(struct saa7134_dev *dev,
 			saa7134_set_gpio(dev, 20, 1);
 		break;
 		}
-	return 0;
+		return 0;
 	}
 	return -EINVAL;
 }
@@ -7842,7 +7842,8 @@ int saa7134_board_init2(struct saa7134_dev *dev)
 				break;
 			case 0x001d:
 				dev->tuner_type = TUNER_PHILIPS_FMD1216ME_MK3;
-					printk(KERN_INFO "%s Board has DVB-T\n", dev->name);
+				printk(KERN_INFO "%s Board has DVB-T\n",
+				       dev->name);
 				break;
 			default:
 				printk(KERN_ERR "%s Can't determine tuner type %x from EEPROM\n", dev->name, tuner_t);
@@ -7903,13 +7904,15 @@ int saa7134_board_init2(struct saa7134_dev *dev)
 	case SAA7134_BOARD_ASUSTeK_TVFM7135:
 	/* The card below is detected as card=53, but is different */
 	       if (dev->autodetected && (dev->eedata[0x27] == 0x03)) {
-		       dev->board = SAA7134_BOARD_ASUSTeK_P7131_ANALOG;
-		       printk(KERN_INFO "%s: P7131 analog only, using "
-						       "entry of %s\n",
-		       dev->name, saa7134_boards[dev->board].name);
+			dev->board = SAA7134_BOARD_ASUSTeK_P7131_ANALOG;
+			printk(KERN_INFO
+			       "%s: P7131 analog only, using entry of %s\n",
+			dev->name, saa7134_boards[dev->board].name);
 
-			/* IR init has already happened for other cards, so
-			 * we have to catch up. */
+			/*
+			 * IR init has already happened for other cards, so
+			 * we have to catch up.
+			 */
 			dev->has_remote = SAA7134_REMOTE_GPIO;
 			saa7134_input_init1(dev);
 	       }
-- 
2.1.0

[PATCH 04/14] ngene: preventing dereferencing a NULL pointer

[Mauro Carvalho Chehab]

As reported by smatch:
	drivers/media/pci/ngene/ngene-core.c:1529 init_channel() error: we previously assumed 'chan->fe' could be null (see line 1521)

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/pci/ngene/ngene-core.c b/drivers/media/pci/ngene/ngene-core.c
index e29bc3af4baf..1b92d836a564 100644
--- a/drivers/media/pci/ngene/ngene-core.c
+++ b/drivers/media/pci/ngene/ngene-core.c
@@ -1526,10 +1526,12 @@ static int init_channel(struct ngene_channel *chan)
 	if (chan->fe2) {
 		if (dvb_register_frontend(adapter, chan->fe2) < 0)
 			goto err;
-		chan->fe2->tuner_priv = chan->fe->tuner_priv;
-		memcpy(&chan->fe2->ops.tuner_ops,
-		       &chan->fe->ops.tuner_ops,
-		       sizeof(struct dvb_tuner_ops));
+		if (chan->fe) {
+			chan->fe2->tuner_priv = chan->fe->tuner_priv;
+			memcpy(&chan->fe2->ops.tuner_ops,
+			       &chan->fe->ops.tuner_ops,
+			       sizeof(struct dvb_tuner_ops));
+		}
 	}
 
 	if (chan->has_demux) {
-- 
2.1.0

[PATCH 05/14] saa7164: Check if dev is NULL before dereferencing it

[Mauro Carvalho Chehab]

As reported by smatch:
	drivers/media/pci/saa7164/saa7164-core.c:631 saa7164_irq() warn: variable dereferenced before check 'dev' (see line 621)

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
index 9cf3c6cba498..072dcc8f13d9 100644
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -618,12 +618,7 @@ static irqreturn_t saa7164_irq_ts(struct saa7164_port *port)
 static irqreturn_t saa7164_irq(int irq, void *dev_id)
 {
 	struct saa7164_dev *dev = dev_id;
-	struct saa7164_port *porta = &dev->ports[SAA7164_PORT_TS1];
-	struct saa7164_port *portb = &dev->ports[SAA7164_PORT_TS2];
-	struct saa7164_port *portc = &dev->ports[SAA7164_PORT_ENC1];
-	struct saa7164_port *portd = &dev->ports[SAA7164_PORT_ENC2];
-	struct saa7164_port *porte = &dev->ports[SAA7164_PORT_VBI1];
-	struct saa7164_port *portf = &dev->ports[SAA7164_PORT_VBI2];
+	struct saa7164_port *porta, *portb, *portc, *portd, *porte, *portf;
 
 	u32 intid, intstat[INT_SIZE/4];
 	int i, handled = 0, bit;
@@ -634,6 +629,13 @@ static irqreturn_t saa7164_irq(int irq, void *dev_id)
 		goto out;
 	}
 
+	porta = &dev->ports[SAA7164_PORT_TS1];
+	portb = &dev->ports[SAA7164_PORT_TS2];
+	portc = &dev->ports[SAA7164_PORT_ENC1];
+	portd = &dev->ports[SAA7164_PORT_ENC2];
+	porte = &dev->ports[SAA7164_PORT_VBI1];
+	portf = &dev->ports[SAA7164_PORT_VBI2];
+
 	/* Check that the hardware is accessible. If the status bytes are
 	 * 0xFF then the device is not accessible, the the IRQ belongs
 	 * to another driver.
-- 
2.1.0

[PATCH 06/14] saa717x: fix multi-byte read code

[Mauro Carvalho Chehab]

As reported by smatch:
	drivers/media/i2c/saa717x.c:155 saa717x_read() warn: mask and shift to zero
	drivers/media/i2c/saa717x.c:155 saa717x_read() warn: mask and shift to zero

This is done right at saa717x_write(), but the read function is
broken. Thankfully, there's just one place at saa717x driver that
uses multibyte read (for status report, via printk).

Yet, let's fix it. From saa717x_write(), it is clear that the
bytes are in little endian:
		mm1[4] = (value >> 16) & 0xff;
		mm1[3] = (value >> 8) & 0xff;
		mm1[2] = value & 0xff;

So, the same order should be valid for read too.

Compile-tested only.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/i2c/saa717x.c b/drivers/media/i2c/saa717x.c
index 0d0f9a917cd3..17557b2f1b09 100644
--- a/drivers/media/i2c/saa717x.c
+++ b/drivers/media/i2c/saa717x.c
@@ -152,9 +152,9 @@ static u32 saa717x_read(struct v4l2_subdev *sd, u32 reg)
 	i2c_transfer(adap, msgs, 2);
 
 	if (fw_addr)
-		value = (mm2[2] & 0xff)  | ((mm2[1] & 0xff) >> 8) | ((mm2[0] & 0xff) >> 16);
+		value = (mm2[2] << 16)  | (mm2[1] << 8) | mm2[0];
 	else
-		value = mm2[0] & 0xff;
+		value = mm2[0];
 
 	v4l2_dbg(2, debug, sd, "read:  reg 0x%03x=0x%08x\n", reg, value);
 	return value;
-- 
2.1.0

[PATCH 07/14] radio-si476x: Fix indent

[Mauro Carvalho Chehab]

As reported by smatch:
	drivers/media/radio/radio-si476x.c:571 si476x_radio_do_post_powerup_init() warn: inconsistent indenting

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/radio/radio-si476x.c b/drivers/media/radio/radio-si476x.c
index dccf58691650..9cbb8cdf0ac0 100644
--- a/drivers/media/radio/radio-si476x.c
+++ b/drivers/media/radio/radio-si476x.c
@@ -568,8 +568,8 @@ static int si476x_radio_do_post_powerup_init(struct si476x_radio *radio,
 	err = regcache_sync_region(radio->core->regmap,
 				   SI476X_PROP_DIGITAL_IO_INPUT_SAMPLE_RATE,
 				   SI476X_PROP_DIGITAL_IO_OUTPUT_FORMAT);
-		if (err < 0)
-			return err;
+	if (err < 0)
+		return err;
 
 	err = regcache_sync_region(radio->core->regmap,
 				   SI476X_PROP_AUDIO_DEEMPHASIS,
-- 
2.1.0

[PATCH 08/14] avoid going past input/audio array

[Mauro Carvalho Chehab]

As reported by smatch:
	drivers/media/pci/ivtv/ivtv-driver.c:832 ivtv_init_struct2() error: buffer overflow 'itv->card->video_inputs' 6 <= 6

That happens because nof_inputs and nof_audio_inputs can be initialized
as IVTV_CARD_MAX_VIDEO_INPUTS, instead of IVTV_CARD_MAX_VIDEO_INPUTS - 1.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
index c2e60b4f292d..8616fa8193bc 100644
--- a/drivers/media/pci/ivtv/ivtv-driver.c
+++ b/drivers/media/pci/ivtv/ivtv-driver.c
@@ -805,11 +805,11 @@ static void ivtv_init_struct2(struct ivtv *itv)
 {
 	int i;
 
-	for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS; i++)
+	for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS - 1; i++)
 		if (itv->card->video_inputs[i].video_type == 0)
 			break;
 	itv->nof_inputs = i;
-	for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS; i++)
+	for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS - 1; i++)
 		if (itv->card->audio_inputs[i].audio_type == 0)
 			break;
 	itv->nof_audio_inputs = i;
-- 
2.1.0

[PATCH 09/14] zoran: fix indent

[Mauro Carvalho Chehab]

As reported by smatch:
	drivers/media/pci/zoran/zoran_device.c:1594 zoran_init_hardware() warn: inconsistent indenting

Fix indent. While here, fix CodingStyle and remove dead code, as it
can always be recovered from git logs.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/pci/zoran/zoran_device.c b/drivers/media/pci/zoran/zoran_device.c
index b6801e035ea4..40119b3c52c1 100644
--- a/drivers/media/pci/zoran/zoran_device.c
+++ b/drivers/media/pci/zoran/zoran_device.c
@@ -1584,14 +1584,11 @@ zoran_init_hardware (struct zoran *zr)
 	jpeg_codec_sleep(zr, 1);
 	jpeg_codec_sleep(zr, 0);
 
-	/* set individual interrupt enables (without GIRQ1)
-	 * but don't global enable until zoran_open() */
-
-	//btwrite(IRQ_MASK & ~ZR36057_ISR_GIRQ1, ZR36057_ICR);  // SW
-	// It looks like using only JPEGRepIRQEn is not always reliable,
-	// may be when JPEG codec crashes it won't generate IRQ? So,
-	 /*CP*/			//        btwrite(IRQ_MASK, ZR36057_ICR); // Enable Vsync interrupts too. SM    WHY ? LP
-	    zr36057_init_vfe(zr);
+	/*
+	 * set individual interrupt enables (without GIRQ1)
+	 * but don't global enable until zoran_open()
+	 */
+	zr36057_init_vfe(zr);
 
 	zr36057_enable_jpg(zr, BUZ_MODE_IDLE);
 
-- 
2.1.0

[PATCH 10/14] s3c-camif: Check if fmt is NULL before use

[Mauro Carvalho Chehab]

As reported by smatch:
	drivers/media/platform/s3c-camif/camif-capture.c:463 queue_setup() warn: variable dereferenced before check 'fmt' (see line 460)

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c
index db4d7d23beb9..76e6289a5612 100644
--- a/drivers/media/platform/s3c-camif/camif-capture.c
+++ b/drivers/media/platform/s3c-camif/camif-capture.c
@@ -449,19 +449,22 @@ static int queue_setup(struct vb2_queue *vq, const struct v4l2_format *pfmt,
 	struct camif_vp *vp = vb2_get_drv_priv(vq);
 	struct camif_dev *camif = vp->camif;
 	struct camif_frame *frame = &vp->out_frame;
-	const struct camif_fmt *fmt = vp->out_fmt;
+	const struct camif_fmt *fmt;
 	unsigned int size;
 
 	if (pfmt) {
 		pix = &pfmt->fmt.pix;
 		fmt = s3c_camif_find_format(vp, &pix->pixelformat, -1);
+		if (fmt == NULL)
+			return -EINVAL;
 		size = (pix->width * pix->height * fmt->depth) / 8;
 	} else {
+		fmt = vp->out_fmt;
+		if (fmt == NULL)
+			return -EINVAL;
 		size = (frame->f_width * frame->f_height * fmt->depth) / 8;
 	}
 
-	if (fmt == NULL)
-		return -EINVAL;
 	*num_planes = 1;
 
 	if (pix)
-- 
2.1.0

[PATCH 11/14] s5p_mfc: remove a dead code

[Mauro Carvalho Chehab]

As reported by smatch:
	drivers/media/platform/s5p-mfc/s5p_mfc.c:1340 s5p_mfc_runtime_resume() warn: this array is probably non-NULL. 'm_dev->alloc_ctx'

alloc_ctx can never be NULL, as it is embeeded inside the struct
s5p_mfc_dev.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 8333fbc2fe96..1263d99d638e 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -1337,8 +1337,6 @@ static int s5p_mfc_runtime_resume(struct device *dev)
 	struct platform_device *pdev = to_platform_device(dev);
 	struct s5p_mfc_dev *m_dev = platform_get_drvdata(pdev);
 
-	if (!m_dev->alloc_ctx)
-		return 0;
 	atomic_set(&m_dev->pm.power, 1);
 	return 0;
 }
-- 
2.1.0

[PATCH 12/14] ir-sony-decoder: shutup smatch warnings

[Mauro Carvalho Chehab]

There are some false-positive warnings produced by smatch:
	drivers/media/rc/ir-sony-decoder.c:129 ir_sony_decode() warn: missing break? reassigning 'data->state'
	drivers/media/rc/ir-sony-decoder.c:137 ir_sony_decode() warn: missing break? reassigning 'data->state'
	drivers/media/rc/ir-sony-decoder.c:165 ir_sony_decode() warn: missing break? reassigning 'data->state'

This is due to the logic used there to detect the need of a break.

While those are false positives, it is easy to get rid of them without
any drawbacks. The side effect is a cleaner function, with is good.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/rc/ir-sony-decoder.c b/drivers/media/rc/ir-sony-decoder.c
index d12dc3da5931..58ef06f35175 100644
--- a/drivers/media/rc/ir-sony-decoder.c
+++ b/drivers/media/rc/ir-sony-decoder.c
@@ -125,30 +125,27 @@ static int ir_sony_decode(struct rc_dev *dev, struct ir_raw_event ev)
 
 		switch (data->count) {
 		case 12:
-			if (!(dev->enabled_protocols & RC_BIT_SONY12)) {
-				data->state = STATE_INACTIVE;
-				return 0;
-			}
+			if (!(dev->enabled_protocols & RC_BIT_SONY12))
+				goto finish_state_machine;
+
 			device    = bitrev8((data->bits <<  3) & 0xF8);
 			subdevice = 0;
 			function  = bitrev8((data->bits >>  4) & 0xFE);
 			protocol = RC_TYPE_SONY12;
 			break;
 		case 15:
-			if (!(dev->enabled_protocols & RC_BIT_SONY15)) {
-				data->state = STATE_INACTIVE;
-				return 0;
-			}
+			if (!(dev->enabled_protocols & RC_BIT_SONY15))
+				goto finish_state_machine;
+
 			device    = bitrev8((data->bits >>  0) & 0xFF);
 			subdevice = 0;
 			function  = bitrev8((data->bits >>  7) & 0xFE);
 			protocol = RC_TYPE_SONY15;
 			break;
 		case 20:
-			if (!(dev->enabled_protocols & RC_BIT_SONY20)) {
-				data->state = STATE_INACTIVE;
-				return 0;
-			}
+			if (!(dev->enabled_protocols & RC_BIT_SONY20))
+				goto finish_state_machine;
+
 			device    = bitrev8((data->bits >>  5) & 0xF8);
 			subdevice = bitrev8((data->bits >>  0) & 0xFF);
 			function  = bitrev8((data->bits >> 12) & 0xFE);
@@ -162,8 +159,7 @@ static int ir_sony_decode(struct rc_dev *dev, struct ir_raw_event ev)
 		scancode = device << 16 | subdevice << 8 | function;
 		IR_dprintk(1, "Sony(%u) scancode 0x%05x\n", data->count, scancode);
 		rc_keydown(dev, protocol, scancode, 0);
-		data->state = STATE_INACTIVE;
-		return 0;
+		goto finish_state_machine;
 	}
 
 out:
@@ -171,6 +167,10 @@ out:
 		   data->state, TO_US(ev.duration), TO_STR(ev.pulse));
 	data->state = STATE_INACTIVE;
 	return -EINVAL;
+
+finish_state_machine:
+	data->state = STATE_INACTIVE;
+	return 0;
 }
 
 static struct ir_raw_handler sony_handler = {
-- 
2.1.0

[PATCH 13/14] wl128x: fix int type for streg_cbdata

[Mauro Carvalho Chehab]

The streg_cbdata can have a negative error value. So, it should be
an integer, and not u8, as reported by smatch:
	drivers/media/radio/wl128x/fmdrv_common.c:1517 fmc_prepare() warn: assigning (-115) to unsigned variable 'fmdev->streg_cbdata'

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/radio/wl128x/fmdrv.h b/drivers/media/radio/wl128x/fmdrv.h
index a587c9bac930..dd203de5de95 100644
--- a/drivers/media/radio/wl128x/fmdrv.h
+++ b/drivers/media/radio/wl128x/fmdrv.h
@@ -210,7 +210,7 @@ struct fmdev {
 	spinlock_t resp_skb_lock; /* To protect access to received SKB */
 
 	long flag;		/*  FM driver state machine info */
-	u8 streg_cbdata; /* status of ST registration */
+	int streg_cbdata; /* status of ST registration */
 
 	struct sk_buff_head rx_q;	/* RX queue */
 	struct tasklet_struct rx_task;	/* RX Tasklet */
-- 
2.1.0

[PATCH 14/14] qt1010: Reduce text size by using static const

[Mauro Carvalho Chehab]

Using static const allows the compiler to optimize the code.

Before static const:
   text	   data	    bss	    dec	    hex	filename
   4982	    524	   1568	   7074	   1ba2	drivers/media/tuners/qt1010.o

After static const:
   text	   data	    bss	    dec	    hex	filename
   4714	    524	   1568	   6806	   1a96	drivers/media/tuners/qt1010.o

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c
index bc419f8a9671..74b6b17cdbaf 100644
--- a/drivers/media/tuners/qt1010.c
+++ b/drivers/media/tuners/qt1010.c
@@ -294,7 +294,7 @@ static int qt1010_init(struct dvb_frontend *fe)
 	int err = 0;
 	u8 i, tmpval, *valptr = NULL;
 
-	qt1010_i2c_oper_t i2c_data[] = {
+	static const qt1010_i2c_oper_t i2c_data[] = {
 		{ QT1010_WR, 0x01, 0x80 },
 		{ QT1010_WR, 0x0d, 0x84 },
 		{ QT1010_WR, 0x0e, 0xb7 },
-- 
2.1.0

Re: [PATCH 02/14] cx18: avoid going past input/audio array

[Andy Walls]

On April 28, 2015 11:43:41 AM EDT, Mauro Carvalho Chehab <mchehab@osg.samsung.com> wrote:
>As reported by smatch:
>	drivers/media/pci/cx18/cx18-driver.c:807 cx18_init_struct2() error:
>buffer overflow 'cx->card->video_inputs' 6 <= 6
>
>That happens because nof_inputs and nof_audio_inputs can be initialized
>as CX18_CARD_MAX_VIDEO_INPUTS, instead of CX18_CARD_MAX_VIDEO_INPUTS -
>1.
>
>Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
>
>diff --git a/drivers/media/pci/cx18/cx18-driver.c
>b/drivers/media/pci/cx18/cx18-driver.c
>index 83f5074706f9..260e462d91b4 100644
>--- a/drivers/media/pci/cx18/cx18-driver.c
>+++ b/drivers/media/pci/cx18/cx18-driver.c
>@@ -786,11 +786,11 @@ static void cx18_init_struct2(struct cx18 *cx)
> {
> 	int i;
> 
>-	for (i = 0; i < CX18_CARD_MAX_VIDEO_INPUTS; i++)
>+	for (i = 0; i < CX18_CARD_MAX_VIDEO_INPUTS - 1; i++)
> 		if (cx->card->video_inputs[i].video_type == 0)
> 			break;
> 	cx->nof_inputs = i;
>-	for (i = 0; i < CX18_CARD_MAX_AUDIO_INPUTS; i++)
>+	for (i = 0; i < CX18_CARD_MAX_AUDIO_INPUTS - 1; i++)
> 		if (cx->card->audio_inputs[i].audio_type == 0)
> 			break;
> 	cx->nof_audio_inputs = i;

Acked-by: Andy Walls <awalls@md.metrocast.net>

Re: [PATCH 08/14] avoid going past input/audio array

[Andy Walls]

On April 28, 2015 11:43:47 AM EDT, Mauro Carvalho Chehab <mchehab@osg.samsung.com> wrote:
>As reported by smatch:
>	drivers/media/pci/ivtv/ivtv-driver.c:832 ivtv_init_struct2() error:
>buffer overflow 'itv->card->video_inputs' 6 <= 6
>
>That happens because nof_inputs and nof_audio_inputs can be initialized
>as IVTV_CARD_MAX_VIDEO_INPUTS, instead of IVTV_CARD_MAX_VIDEO_INPUTS -
>1.
>
>Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
>
>diff --git a/drivers/media/pci/ivtv/ivtv-driver.c
>b/drivers/media/pci/ivtv/ivtv-driver.c
>index c2e60b4f292d..8616fa8193bc 100644
>--- a/drivers/media/pci/ivtv/ivtv-driver.c
>+++ b/drivers/media/pci/ivtv/ivtv-driver.c
>@@ -805,11 +805,11 @@ static void ivtv_init_struct2(struct ivtv *itv)
> {
> 	int i;
> 
>-	for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS; i++)
>+	for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS - 1; i++)
> 		if (itv->card->video_inputs[i].video_type == 0)
> 			break;
> 	itv->nof_inputs = i;
>-	for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS; i++)
>+	for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS - 1; i++)
> 		if (itv->card->audio_inputs[i].audio_type == 0)
> 			break;
> 	itv->nof_audio_inputs = i;

Acked-by: Andy Walls <awalls@md.metrocast.net>

Re: [PATCH 10/14] s3c-camif: Check if fmt is NULL before use

[Sylwester Nawrocki]

On 28/04/15 17:43, Mauro Carvalho Chehab wrote:
> As reported by smatch:
> 	drivers/media/platform/s3c-camif/camif-capture.c:463 queue_setup() warn: variable dereferenced before check 'fmt' (see line 460)
> 
> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>

Re: [PATCH 03/14] saa7134: fix indent issues

[Hans Verkuil]

On 04/28/2015 05:43 PM, Mauro Carvalho Chehab wrote:
> As reported by smatch:
> 	drivers/media/pci/saa7134/saa7134-cards.c:7197 saa7134_xc2028_callback() warn: inconsistent indenting
> 	drivers/media/pci/saa7134/saa7134-cards.c:7846 saa7134_board_init2() warn: inconsistent indenting
> 	drivers/media/pci/saa7134/saa7134-cards.c:7913 saa7134_board_init2() warn: inconsistent indenting
> 
> While here, fix a few CodingStyle issues on the affected code
> 
> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
> 
> diff --git a/drivers/media/pci/saa7134/saa7134-cards.c b/drivers/media/pci/saa7134/saa7134-cards.c
> index 3ca078057755..d48fd5338db5 100644
> --- a/drivers/media/pci/saa7134/saa7134-cards.c
> +++ b/drivers/media/pci/saa7134/saa7134-cards.c
> @@ -7194,7 +7194,7 @@ static int saa7134_xc2028_callback(struct saa7134_dev *dev,
>  			saa7134_set_gpio(dev, 20, 1);
>  		break;
>  		}
> -	return 0;
> +		return 0;
>  	}
>  	return -EINVAL;
>  }
> @@ -7842,7 +7842,8 @@ int saa7134_board_init2(struct saa7134_dev *dev)
>  				break;
>  			case 0x001d:
>  				dev->tuner_type = TUNER_PHILIPS_FMD1216ME_MK3;
> -					printk(KERN_INFO "%s Board has DVB-T\n", dev->name);
> +				printk(KERN_INFO "%s Board has DVB-T\n",
> +				       dev->name);

If you're changing this anyway, why not use pr_info instead?

>  				break;
>  			default:
>  				printk(KERN_ERR "%s Can't determine tuner type %x from EEPROM\n", dev->name, tuner_t);
> @@ -7903,13 +7904,15 @@ int saa7134_board_init2(struct saa7134_dev *dev)
>  	case SAA7134_BOARD_ASUSTeK_TVFM7135:
>  	/* The card below is detected as card=53, but is different */
>  	       if (dev->autodetected && (dev->eedata[0x27] == 0x03)) {
> -		       dev->board = SAA7134_BOARD_ASUSTeK_P7131_ANALOG;
> -		       printk(KERN_INFO "%s: P7131 analog only, using "
> -						       "entry of %s\n",
> -		       dev->name, saa7134_boards[dev->board].name);
> +			dev->board = SAA7134_BOARD_ASUSTeK_P7131_ANALOG;
> +			printk(KERN_INFO
> +			       "%s: P7131 analog only, using entry of %s\n",

Ditto.

> +			dev->name, saa7134_boards[dev->board].name);
>  
> -			/* IR init has already happened for other cards, so
> -			 * we have to catch up. */
> +			/*
> +			 * IR init has already happened for other cards, so
> +			 * we have to catch up.
> +			 */
>  			dev->has_remote = SAA7134_REMOTE_GPIO;
>  			saa7134_input_init1(dev);
>  	       }
> 

Regards,

	Hans

Re: [PATCH 05/14] saa7164: Check if dev is NULL before dereferencing it

[Hans Verkuil]

On 04/28/2015 05:43 PM, Mauro Carvalho Chehab wrote:
> As reported by smatch:
> 	drivers/media/pci/saa7164/saa7164-core.c:631 saa7164_irq() warn: variable dereferenced before check 'dev' (see line 621)
> 
> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

Acked-by: Hans Verkuil <hans.verkuil@cisco.com>

> 
> diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
> index 9cf3c6cba498..072dcc8f13d9 100644
> --- a/drivers/media/pci/saa7164/saa7164-core.c
> +++ b/drivers/media/pci/saa7164/saa7164-core.c
> @@ -618,12 +618,7 @@ static irqreturn_t saa7164_irq_ts(struct saa7164_port *port)
>  static irqreturn_t saa7164_irq(int irq, void *dev_id)
>  {
>  	struct saa7164_dev *dev = dev_id;
> -	struct saa7164_port *porta = &dev->ports[SAA7164_PORT_TS1];
> -	struct saa7164_port *portb = &dev->ports[SAA7164_PORT_TS2];
> -	struct saa7164_port *portc = &dev->ports[SAA7164_PORT_ENC1];
> -	struct saa7164_port *portd = &dev->ports[SAA7164_PORT_ENC2];
> -	struct saa7164_port *porte = &dev->ports[SAA7164_PORT_VBI1];
> -	struct saa7164_port *portf = &dev->ports[SAA7164_PORT_VBI2];
> +	struct saa7164_port *porta, *portb, *portc, *portd, *porte, *portf;
>  
>  	u32 intid, intstat[INT_SIZE/4];
>  	int i, handled = 0, bit;
> @@ -634,6 +629,13 @@ static irqreturn_t saa7164_irq(int irq, void *dev_id)
>  		goto out;
>  	}
>  
> +	porta = &dev->ports[SAA7164_PORT_TS1];
> +	portb = &dev->ports[SAA7164_PORT_TS2];
> +	portc = &dev->ports[SAA7164_PORT_ENC1];
> +	portd = &dev->ports[SAA7164_PORT_ENC2];
> +	porte = &dev->ports[SAA7164_PORT_VBI1];
> +	portf = &dev->ports[SAA7164_PORT_VBI2];
> +
>  	/* Check that the hardware is accessible. If the status bytes are
>  	 * 0xFF then the device is not accessible, the the IRQ belongs
>  	 * to another driver.
> 

Re: [PATCH 09/14] zoran: fix indent

[Hans Verkuil]

On 04/28/2015 05:43 PM, Mauro Carvalho Chehab wrote:
> As reported by smatch:
> 	drivers/media/pci/zoran/zoran_device.c:1594 zoran_init_hardware() warn: inconsistent indenting
> 
> Fix indent. While here, fix CodingStyle and remove dead code, as it
> can always be recovered from git logs.
> 
> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

Acked-by: Hans Verkuil <hans.verkuil@cisco.com>

> 
> diff --git a/drivers/media/pci/zoran/zoran_device.c b/drivers/media/pci/zoran/zoran_device.c
> index b6801e035ea4..40119b3c52c1 100644
> --- a/drivers/media/pci/zoran/zoran_device.c
> +++ b/drivers/media/pci/zoran/zoran_device.c
> @@ -1584,14 +1584,11 @@ zoran_init_hardware (struct zoran *zr)
>  	jpeg_codec_sleep(zr, 1);
>  	jpeg_codec_sleep(zr, 0);
>  
> -	/* set individual interrupt enables (without GIRQ1)
> -	 * but don't global enable until zoran_open() */
> -
> -	//btwrite(IRQ_MASK & ~ZR36057_ISR_GIRQ1, ZR36057_ICR);  // SW
> -	// It looks like using only JPEGRepIRQEn is not always reliable,
> -	// may be when JPEG codec crashes it won't generate IRQ? So,
> -	 /*CP*/			//        btwrite(IRQ_MASK, ZR36057_ICR); // Enable Vsync interrupts too. SM    WHY ? LP
> -	    zr36057_init_vfe(zr);
> +	/*
> +	 * set individual interrupt enables (without GIRQ1)
> +	 * but don't global enable until zoran_open()
> +	 */
> +	zr36057_init_vfe(zr);
>  
>  	zr36057_enable_jpg(zr, BUZ_MODE_IDLE);
>  
> 

Re: [PATCH 09/14] zoran: fix indent

[Lad, Prabhakar]

On Tue, Apr 28, 2015 at 4:43 PM, Mauro Carvalho Chehab
<mchehab@osg.samsung.com> wrote:
> As reported by smatch:
>         drivers/media/pci/zoran/zoran_device.c:1594 zoran_init_hardware() warn: inconsistent indenting
>
> Fix indent. While here, fix CodingStyle and remove dead code, as it
> can always be recovered from git logs.
>
> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>

Cheers,
--Prabhakar Lad

Re: [PATCH 03/14] saa7134: fix indent issues

[Mauro Carvalho Chehab]

Em Thu, 30 Apr 2015 08:20:49 +0200
Hans Verkuil <hverkuil@xs4all.nl> escreveu:

> On 04/28/2015 05:43 PM, Mauro Carvalho Chehab wrote:
> > As reported by smatch:
> > 	drivers/media/pci/saa7134/saa7134-cards.c:7197 saa7134_xc2028_callback() warn: inconsistent indenting
> > 	drivers/media/pci/saa7134/saa7134-cards.c:7846 saa7134_board_init2() warn: inconsistent indenting
> > 	drivers/media/pci/saa7134/saa7134-cards.c:7913 saa7134_board_init2() warn: inconsistent indenting
> > 
> > While here, fix a few CodingStyle issues on the affected code
> > 
> > Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
> > 
> > diff --git a/drivers/media/pci/saa7134/saa7134-cards.c b/drivers/media/pci/saa7134/saa7134-cards.c
> > index 3ca078057755..d48fd5338db5 100644
> > --- a/drivers/media/pci/saa7134/saa7134-cards.c
> > +++ b/drivers/media/pci/saa7134/saa7134-cards.c
> > @@ -7194,7 +7194,7 @@ static int saa7134_xc2028_callback(struct saa7134_dev *dev,
> >  			saa7134_set_gpio(dev, 20, 1);
> >  		break;
> >  		}
> > -	return 0;
> > +		return 0;
> >  	}
> >  	return -EINVAL;
> >  }
> > @@ -7842,7 +7842,8 @@ int saa7134_board_init2(struct saa7134_dev *dev)
> >  				break;
> >  			case 0x001d:
> >  				dev->tuner_type = TUNER_PHILIPS_FMD1216ME_MK3;
> > -					printk(KERN_INFO "%s Board has DVB-T\n", dev->name);
> > +				printk(KERN_INFO "%s Board has DVB-T\n",
> > +				       dev->name);
> 
> If you're changing this anyway, why not use pr_info instead?

Converting it to pr_foo is actually complex. Anyway, I found some time
today to do such conversion. I'll be adding on a patch series I'm about
to send.

> 
> >  				break;
> >  			default:
> >  				printk(KERN_ERR "%s Can't determine tuner type %x from EEPROM\n", dev->name, tuner_t);
> > @@ -7903,13 +7904,15 @@ int saa7134_board_init2(struct saa7134_dev *dev)
> >  	case SAA7134_BOARD_ASUSTeK_TVFM7135:
> >  	/* The card below is detected as card=53, but is different */
> >  	       if (dev->autodetected && (dev->eedata[0x27] == 0x03)) {
> > -		       dev->board = SAA7134_BOARD_ASUSTeK_P7131_ANALOG;
> > -		       printk(KERN_INFO "%s: P7131 analog only, using "
> > -						       "entry of %s\n",
> > -		       dev->name, saa7134_boards[dev->board].name);
> > +			dev->board = SAA7134_BOARD_ASUSTeK_P7131_ANALOG;
> > +			printk(KERN_INFO
> > +			       "%s: P7131 analog only, using entry of %s\n",
> 
> Ditto.
> 
> > +			dev->name, saa7134_boards[dev->board].name);
> >  
> > -			/* IR init has already happened for other cards, so
> > -			 * we have to catch up. */
> > +			/*
> > +			 * IR init has already happened for other cards, so
> > +			 * we have to catch up.
> > +			 */
> >  			dev->has_remote = SAA7134_REMOTE_GPIO;
> >  			saa7134_input_init1(dev);
> >  	       }
> > 
> 
> Regards,
> 
> 	Hans

Re: [PATCH 03/14] saa7134: fix indent issues

[Hans Verkuil]

On 04/30/2015 04:08 PM, Mauro Carvalho Chehab wrote:
> Em Thu, 30 Apr 2015 08:20:49 +0200
> Hans Verkuil <hverkuil@xs4all.nl> escreveu:
> 
>> On 04/28/2015 05:43 PM, Mauro Carvalho Chehab wrote:
>>> As reported by smatch:
>>> 	drivers/media/pci/saa7134/saa7134-cards.c:7197 saa7134_xc2028_callback() warn: inconsistent indenting
>>> 	drivers/media/pci/saa7134/saa7134-cards.c:7846 saa7134_board_init2() warn: inconsistent indenting
>>> 	drivers/media/pci/saa7134/saa7134-cards.c:7913 saa7134_board_init2() warn: inconsistent indenting
>>>
>>> While here, fix a few CodingStyle issues on the affected code
>>>
>>> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
>>>
>>> diff --git a/drivers/media/pci/saa7134/saa7134-cards.c b/drivers/media/pci/saa7134/saa7134-cards.c
>>> index 3ca078057755..d48fd5338db5 100644
>>> --- a/drivers/media/pci/saa7134/saa7134-cards.c
>>> +++ b/drivers/media/pci/saa7134/saa7134-cards.c
>>> @@ -7194,7 +7194,7 @@ static int saa7134_xc2028_callback(struct saa7134_dev *dev,
>>>  			saa7134_set_gpio(dev, 20, 1);
>>>  		break;
>>>  		}
>>> -	return 0;
>>> +		return 0;
>>>  	}
>>>  	return -EINVAL;
>>>  }
>>> @@ -7842,7 +7842,8 @@ int saa7134_board_init2(struct saa7134_dev *dev)
>>>  				break;
>>>  			case 0x001d:
>>>  				dev->tuner_type = TUNER_PHILIPS_FMD1216ME_MK3;
>>> -					printk(KERN_INFO "%s Board has DVB-T\n", dev->name);
>>> +				printk(KERN_INFO "%s Board has DVB-T\n",
>>> +				       dev->name);
>>
>> If you're changing this anyway, why not use pr_info instead?
> 
> Converting it to pr_foo is actually complex. Anyway, I found some time
> today to do such conversion. I'll be adding on a patch series I'm about
> to send.

I was just referring to this single patch, not the whole driver! :-)

Anyway, for the saa7134 patches:

Acked-by: Hans Verkuil <hans.verkuil@cisco.com>

> 
>>
>>>  				break;
>>>  			default:
>>>  				printk(KERN_ERR "%s Can't determine tuner type %x from EEPROM\n", dev->name, tuner_t);
>>> @@ -7903,13 +7904,15 @@ int saa7134_board_init2(struct saa7134_dev *dev)
>>>  	case SAA7134_BOARD_ASUSTeK_TVFM7135:
>>>  	/* The card below is detected as card=53, but is different */
>>>  	       if (dev->autodetected && (dev->eedata[0x27] == 0x03)) {
>>> -		       dev->board = SAA7134_BOARD_ASUSTeK_P7131_ANALOG;
>>> -		       printk(KERN_INFO "%s: P7131 analog only, using "
>>> -						       "entry of %s\n",
>>> -		       dev->name, saa7134_boards[dev->board].name);
>>> +			dev->board = SAA7134_BOARD_ASUSTeK_P7131_ANALOG;
>>> +			printk(KERN_INFO
>>> +			       "%s: P7131 analog only, using entry of %s\n",
>>
>> Ditto.
>>
>>> +			dev->name, saa7134_boards[dev->board].name);
>>>  
>>> -			/* IR init has already happened for other cards, so
>>> -			 * we have to catch up. */
>>> +			/*
>>> +			 * IR init has already happened for other cards, so
>>> +			 * we have to catch up.
>>> +			 */
>>>  			dev->has_remote = SAA7134_REMOTE_GPIO;
>>>  			saa7134_input_init1(dev);
>>>  	       }
>>>
>>
>> Regards,
>>
>> 	Hans
> --
> To unsubscribe from this list: send the line "unsubscribe linux-media" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>