Messages in this thread Patch in this message | | From: Colin Ian King <colin.king@canonical.com>
The current pre-decrement is incorrect and should be replaced with a post-decrement. Consider the case where the very first clk_prepare_enable fails when i is 0; in this case the error clean up will decrement the unsigned int which wraps to the largest unsigned int value causing an array out of bounds read on core->clks[i].
Detected by CoverityScan, CID#1446590 ("Out-of-bounds read")
Signed-off-by: Colin Ian King <colin.king@canonical.com> --- drivers/media/platform/qcom/venus/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c index 776d2bae6979..d8cbe8549d97 100644 --- a/drivers/media/platform/qcom/venus/core.c +++ b/drivers/media/platform/qcom/venus/core.c @@ -137,7 +137,7 @@ static int venus_clks_enable(struct venus_core *core) return 0; err: - while (--i) + while (i--) clk_disable_unprepare(core->clks[i]); return ret; -- 2.11.0
| |