video: tegra: host: fix Coverity issues

- fix dereference of NULL return value. Add a NULL check
  Coverity id : 23335
- fix logically dead code
  handle function return values and use them for error checking
  Coverity id : 23733
- fix write to pointer after free
  free the pointer only after all operations are performed on it
  Coverity id : 23719
- fix dereference before NULL check
  check for NULL before dereferencing the variable
  Coverity id : 22918
- fix out of bounds read
  first check if value of variable 'i' is within range and
  then only use it as array index
  Coverity id : 23662

Bug 1329327

Change-Id: I70c9d6b00672211c7aaecc023ff2229efb52517f
Signed-off-by: Deepak Nibade <dnibade@nvidia.com>
Reviewed-on: http://git-master/r/256283
Reviewed-by: Mandar Padmawar <mpadmawar@nvidia.com>
Tested-by: Mandar Padmawar <mpadmawar@nvidia.com>

diff --git a/drivers/video/tegra/host/bus_client.c b/drivers/video/tegra/host/bus_client.c
index 28e10c3937c066eb0ac8648bb9199afe788d3461..0b483bc9561c98d4d10999d9f7ec4a5dd4fde871 100644 (file)
--- a/drivers/video/tegra/host/bus_client.c
+++ b/drivers/video/tegra/host/bus_client.c
@@ -59,8 +59,12 @@
 
 static int validate_reg(struct platform_device *ndev, u32 offset, int count)
 {
-       struct resource *r = platform_get_resource(ndev, IORESOURCE_MEM, 0);
        int err = 0;
+       struct resource *r = platform_get_resource(ndev, IORESOURCE_MEM, 0);
+       if (!r) {
+               dev_err(&ndev->dev, "failed to get memory resource\n");
+               return -ENODEV;
+       }
 
        if (offset + 4 * count > resource_size(r)
                        || (offset + 4 * count < offset))

diff --git a/drivers/video/tegra/host/host1x/host1x.c b/drivers/video/tegra/host/host1x/host1x.c
index 47258eb74867643f2e58db40df116d335174239a..37ccf86c3bd1b7283f355935f275d8e107d49943 100644 (file)
--- a/drivers/video/tegra/host/host1x/host1x.c
+++ b/drivers/video/tegra/host/host1x/host1x.c
@@ -688,11 +688,11 @@ static int nvhost_probe(struct platform_device *dev)
 
 #ifdef CONFIG_PM_RUNTIME
        if (pdata->clockgate_delay)
-               pm_runtime_put_sync_autosuspend(&dev->dev);
+               err = pm_runtime_put_sync_autosuspend(&dev->dev);
        else
-               pm_runtime_put(&dev->dev);
+               err = pm_runtime_put(&dev->dev);
        if (err)
-               return err;
+               goto fail;
 #endif
 
        dev_info(&dev->dev, "initialized\n");

diff --git a/drivers/video/tegra/host/msenc/msenc.c b/drivers/video/tegra/host/msenc/msenc.c
index a09cc1603b86d6345ba1f4c28cdb8ea8faa2ed0d..d8d5ad11f324de3431ddf943600328e630a3e398 100644 (file)
--- a/drivers/video/tegra/host/msenc/msenc.c
+++ b/drivers/video/tegra/host/msenc/msenc.c
@@ -400,9 +400,9 @@ void nvhost_msenc_deinit(struct platform_device *dev)
                nvhost_memmgr_put(nvhost_get_host(dev)->memmgr, m->mem_r);
                m->mem_r = NULL;
        }
+       m->valid = false;
        kfree(m);
        set_msenc(dev, NULL);
-       m->valid = false;
 }
 
 int nvhost_msenc_finalize_poweron(struct platform_device *dev)

diff --git a/drivers/video/tegra/host/nvhost_acm.c b/drivers/video/tegra/host/nvhost_acm.c
index baf3b07f436dd0dd9b4e6cccef039f313c54063c..a46546d3f38960525d8cd10aed5fd2ba6313e946 100644 (file)
--- a/drivers/video/tegra/host/nvhost_acm.c
+++ b/drivers/video/tegra/host/nvhost_acm.c
@@ -438,7 +438,7 @@ int nvhost_module_init(struct platform_device *dev)
        /* initialize clocks to known state (=enabled) */
        pdata->num_clks = 0;
        INIT_LIST_HEAD(&pdata->client_list);
-       while (pdata->clocks[i].name && i < NVHOST_MODULE_MAX_CLOCKS) {
+       while (i < NVHOST_MODULE_MAX_CLOCKS && pdata->clocks[i].name) {
                char devname[MAX_DEVID_LENGTH];
                long rate = pdata->clocks[i].default_rate;
                struct clk *c;