2017-12-06 16:38:05

by Flavio Ceolin

Subject: [PATCH] media: s5p-jpeg: Fix off-by-one problem

s5p_jpeg_runtime_resume() does not call clk_disable_unprepare() for
jpeg->clocks[0] when one of the clk_prepare_enable() fails.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Flavio Ceolin <[email protected]>
---
drivers/media/platform/s5p-jpeg/jpeg-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index faac816..79b63da 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -3086,7 +3086,7 @@ static int s5p_jpeg_runtime_resume(struct device *dev)
for (i = 0; i < jpeg->variant->num_clocks; i++) {
ret = clk_prepare_enable(jpeg->clocks[i]);
if (ret) {
- while (--i > 0)
+ while (--i >= 0)
clk_disable_unprepare(jpeg->clocks[i]);
return ret;
}
--
2.9.5

2017-12-07 14:53:32

by Andrzej Pietrasiewicz

Subject: Re: [PATCH] media: s5p-jpeg: Fix off-by-one problem

W dniu 06.12.2017 o 17:37, Flavio Ceolin pisze:
> s5p_jpeg_runtime_resume() does not call clk_disable_unprepare() for
> jpeg->clocks[0] when one of the clk_prepare_enable() fails.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Flavio Ceolin <[email protected]>

Acked-by: Andrzej Pietrasiewicz <[email protected]>


> ---
> drivers/media/platform/s5p-jpeg/jpeg-core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
> index faac816..79b63da 100644
> --- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
> +++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
> @@ -3086,7 +3086,7 @@ static int s5p_jpeg_runtime_resume(struct device *dev)
> for (i = 0; i < jpeg->variant->num_clocks; i++) {
> ret = clk_prepare_enable(jpeg->clocks[i]);
> if (ret) {
> - while (--i > 0)
> + while (--i >= 0)
> clk_disable_unprepare(jpeg->clocks[i]);
> return ret;
> }
>