media: dvb-core: Fix coding errors in broadcast drivers

Added Check to verify TSPP channel input source is valid.
Initialize return variables to return correct values in fail conditions.
Move deferencing of input pointer arguments after NULL checking.

CR's-Fixed: 2043689
Change-Id: I7febdb0e0f499846cfcf8836ea35c8547a5074fb
Signed-off-by: Udaya Bhaskara Reddy Mallavarapu <udaym@codeaurora.org>

diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index a9c4237..9b743f5 100644 (file)
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -1615,7 +1615,7 @@ static int dvb_dvr_get_event(struct dmxdev *dmxdev,
                                unsigned int f_flags,
                                struct dmx_filter_event *event)
 {
-       int res;
+       int res = 0;
 
        if (!((f_flags & O_ACCMODE) == O_RDONLY))
                return -EINVAL;
@@ -2402,8 +2402,10 @@ static int dvb_dmxdev_set_playback_mode(struct dmxdev_filter *dmxdevfilter,
                (playback_mode != DMX_PB_MODE_PULL))
                return -EINVAL;
 
+       if (dmxdev->demux->set_playback_mode == NULL)
+               return -EINVAL;
+
        if (((dmxdev->source < DMX_SOURCE_DVR0) ||
-                !dmxdev->demux->set_playback_mode ||
                 !(caps.caps & DMX_CAP_PULL_MODE)) &&
                 (playback_mode == DMX_PB_MODE_PULL))
                return -EPERM;
@@ -2520,7 +2522,7 @@ static int dvb_dmxdev_release_data(struct dmxdev_filter *dmxdevfilter,
 static int dvb_dmxdev_get_event(struct dmxdev_filter *dmxdevfilter,
                                        struct dmx_filter_event *event)
 {
-       int res;
+       int res = 0;
 
        spin_lock_irq(&dmxdevfilter->dev->lock);
 

diff --git a/drivers/media/platform/msm/broadcast/tspp.c b/drivers/media/platform/msm/broadcast/tspp.c
index b706d59..fa566ad 100644 (file)
--- a/drivers/media/platform/msm/broadcast/tspp.c
+++ b/drivers/media/platform/msm/broadcast/tspp.c
@@ -2210,7 +2210,13 @@ int tspp_remove_filter(u32 dev, u32 channel_id,
        channel = &pdev->channels[channel_id];
 
        src = channel->src;
-       tspp_filter = &(pdev->filters[src]->filter[filter->priority]);
+       if ((src == TSPP_SOURCE_TSIF0) || (src == TSPP_SOURCE_TSIF1))
+               tspp_filter = &(pdev->filters[src]->filter[filter->priority]);
+       else {
+               pr_err("tspp_remove: wrong source type %d", src);
+               return -EINVAL;
+       }
+
 
        /* disable pipe (channel) */
        val = readl_relaxed(pdev->base + TSPP_PS_DISABLE);

diff --git a/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c b/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c
index 2fc3ce4..2d22968 100644 (file)
--- a/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c
+++ b/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c
@@ -6536,10 +6536,8 @@ static int mpq_sdmx_write(struct mpq_demux *mpq_demux,
        const char *buf,
        size_t count)
 {
-       struct ion_handle *ion_handle =
-               mpq_demux->demux.dmx.dvr_input.priv_handle;
-       struct dvb_ringbuffer *rbuf = (struct dvb_ringbuffer *)
-               mpq_demux->demux.dmx.dvr_input.ringbuff;
+       struct ion_handle *ion_handle;
+       struct dvb_ringbuffer *rbuf;
        struct sdmx_buff_descr buf_desc;
        u32 read_offset;
        int ret;
@@ -6549,10 +6547,13 @@ static int mpq_sdmx_write(struct mpq_demux *mpq_demux,
                return -EINVAL;
        }
 
+       ion_handle = mpq_demux->demux.dmx.dvr_input.priv_handle;
+       rbuf = (struct dvb_ringbuffer *)mpq_demux->demux.dmx.dvr_input.ringbuff;
+
        ret = mpq_sdmx_dvr_buffer_desc(mpq_demux, &buf_desc);
        if (ret) {
                MPQ_DVB_ERR_PRINT(
-                       "%s: Failed to init input buffer descriptor. ret = %d\n",
+               "%s: Failed to init input buffer descriptor. ret = %d\n",
                        __func__, ret);
                return ret;
        }