drivers: speculative load before bound-check

[hercules2020/nv-tegra/linux-4.4.git] / drivers / media / i2c / s5c73m3 / s5c73m3-core.c

diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
index 51b26010403c1be42126ad481fd3b6b465cd2fbc..0774003744054038154f5538ae4b6e09e72ccee4 100644 (file)
--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
@@ -38,6 +38,7 @@
 #include <media/v4l2-of.h>
 
 #include "s5c73m3.h"
+#include <asm/barrier.h>
 
 int s5c73m3_dbg;
 module_param_named(debug, s5c73m3_dbg, int, 0644);
@@ -965,6 +966,8 @@ static int s5c73m3_oif_enum_frame_interval(struct v4l2_subdev *sd,
        if (fie->index >= ARRAY_SIZE(s5c73m3_intervals))
                return -EINVAL;
 
+       speculation_barrier();
+
        mutex_lock(&state->lock);
        fi = &s5c73m3_intervals[fie->index];
        if (fie->width > fi->size.width || fie->height > fi->size.height)
@@ -1239,6 +1242,8 @@ static int s5c73m3_enum_frame_size(struct v4l2_subdev *sd,
        if (fse->index >= s5c73m3_resolutions_len[idx])
                return -EINVAL;
 
+       speculation_barrier();
+
        fse->min_width  = s5c73m3_resolutions[idx][fse->index].width;
        fse->max_width  = fse->min_width;
        fse->max_height = s5c73m3_resolutions[idx][fse->index].height;
@@ -1298,6 +1303,8 @@ static int s5c73m3_oif_enum_frame_size(struct v4l2_subdev *sd,
        if (fse->index >= s5c73m3_resolutions_len[idx])
                return -EINVAL;
 
+       speculation_barrier();
+
        fse->min_width  = s5c73m3_resolutions[idx][fse->index].width;
        fse->max_width  = fse->min_width;
        fse->max_height = s5c73m3_resolutions[idx][fse->index].height;