[PATCH 0/3] media: mediatek: vcodec: fix vcodec smatch warning

[PATCH 0/3] media: mediatek: vcodec: fix vcodec smatch warning

[Yunfei Dong]

Fix below smatch static checker warning from [bug report]:
The patch 397edc703a10: "media: mediatek: vcodec: add h264 decoder
driver for mt8186" from May 12, 2022 (linux-next), leads to the
following (in development) Smatch static checker warning:

drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c:351
vdec_h264_slice_decode() potential NULL container_of 'fb'

drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c:337
vdec_vp8_slice_decode() potential NULL container_of 'fb'

drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c:728
vdec_h264_slice_single_decode() potential NULL container_of 'fb'

---
Yunfei Dong (3):
  media: mediatek: vcodec: fix h264 multi statless decoder smatch
    warning
  media: mediatek: vcodec: fix vp8 stateless decoder smatch warning
  media: mediatek: vcodec: fix h264 stateless decoder smatch warning

 .../mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c    |  9 +++++++--
 .../vcodec/decoder/vdec/vdec_h264_req_multi_if.c       |  9 +++++++--
 .../mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c     | 10 +++++++---
 3 files changed, 21 insertions(+), 7 deletions(-)

-- 
2.25.1

[PATCH 1/3] media: mediatek: vcodec: fix h264 multi statless decoder smatch warning

[Yunfei Dong]

Fix smatch static checker warning for vdec_h264_req_multi_if.c.
Leading to kernel crash when fb is NULL.

Fixes: 397edc703a10 ("media: mediatek: vcodec: add h264 decoder")
Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
---
 .../vcodec/decoder/vdec/vdec_h264_req_multi_if.c         | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c
index 0e741e0dc8ba..ab8e708e0df1 100644
--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c
+++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c
@@ -724,11 +724,16 @@ static int vdec_h264_slice_single_decode(void *h_vdec, struct mtk_vcodec_mem *bs
 		return vpu_dec_reset(vpu);
 
 	fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst->ctx);
+	if (!fb) {
+		mtk_vdec_err(inst->ctx, "fb buffer is NULL");
+		return -EBUSY;
+	}
+
 	src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
 	dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
 
-	y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
-	c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
+	y_fb_dma = (u64)fb->base_y.dma_addr;
+	c_fb_dma = (u64)fb->base_c.dma_addr;
 	mtk_vdec_debug(inst->ctx, "[h264-dec] [%d] y_dma=%llx c_dma=%llx",
 		       inst->ctx->decoded_frame_cnt, y_fb_dma, c_fb_dma);
 
-- 
2.25.1

[PATCH 2/3] media: mediatek: vcodec: fix vp8 stateless decoder smatch warning

[Yunfei Dong]

Fix smatch static checker warning for vdec_vp8_req_if.c. Leading
to kernel crash when fb is NULL.

Fixes: 7a7ae26fd458 ("media: mediatek: vcodec: support stateless VP8 decoding")
Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
---
 .../mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c     | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c
index f677e499fefa..0889517a58e8 100644
--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c
+++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c
@@ -334,14 +334,18 @@ static int vdec_vp8_slice_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
 	src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
 
 	fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst->ctx);
-	dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
+	if (!fb) {
+		mtk_vdec_err(inst->ctx, "fb buffer is NULL");
+		return -EBUSY;
+	}
 
-	y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
+	dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
+	y_fb_dma = (u64)fb->base_y.dma_addr;
 	if (inst->ctx->q_data[MTK_Q_DATA_DST].fmt->num_planes == 1)
 		c_fb_dma = y_fb_dma +
 			inst->ctx->picinfo.buf_w * inst->ctx->picinfo.buf_h;
 	else
-		c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
+		c_fb_dma = (u64)fb->base_c.dma_addr;
 
 	inst->vsi->dec.bs_dma = (u64)bs->dma_addr;
 	inst->vsi->dec.bs_sz = bs->size;
-- 
2.25.1

[PATCH 3/3] media: mediatek: vcodec: fix h264 stateless decoder smatch warning

[Yunfei Dong]

Fix smatch static checker warning for vdec_h264_req_if.c. Leading
to kernel crash when fb is NULL.

Fixes: 06fa5f757dc5 ("media: mtk-vcodec: vdec: support stateless H.264 decoding")
Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
---
 .../mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c      | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c
index 5600f1df653d..f1c164b644f8 100644
--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c
+++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c
@@ -347,11 +347,16 @@ static int vdec_h264_slice_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
 		return vpu_dec_reset(vpu);
 
 	fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst->ctx);
+	if (!fb) {
+		mtk_vdec_err(inst->ctx, "fb buffer is NULL");
+		return -EBUSY;
+	}
+
 	src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
 	dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
 
-	y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
-	c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
+	y_fb_dma = (u64)fb->base_y.dma_addr;
+	c_fb_dma = (u64)fb->base_c.dma_addr;
 
 	mtk_vdec_debug(inst->ctx, "+ [%d] FB y_dma=%llx c_dma=%llx va=%p",
 		       inst->num_nalu, y_fb_dma, c_fb_dma, fb);
-- 
2.25.1

Re: [PATCH 1/3] media: mediatek: vcodec: fix h264 multi statless decoder smatch warning

[AngeloGioacchino Del Regno]

Il 29/02/24 10:56, Yunfei Dong ha scritto:
> Fix smatch static checker warning for vdec_h264_req_multi_if.c.
> Leading to kernel crash when fb is NULL.
> 
> Fixes: 397edc703a10 ("media: mediatek: vcodec: add h264 decoder")
> Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
> ---
>   .../vcodec/decoder/vdec/vdec_h264_req_multi_if.c         | 9 +++++++--
>   1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c
> index 0e741e0dc8ba..ab8e708e0df1 100644
> --- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c
> +++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c
> @@ -724,11 +724,16 @@ static int vdec_h264_slice_single_decode(void *h_vdec, struct mtk_vcodec_mem *bs
>   		return vpu_dec_reset(vpu);
>   
>   	fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst->ctx);
> +	if (!fb) {
> +		mtk_vdec_err(inst->ctx, "fb buffer is NULL");
> +		return -EBUSY;
> +	}
> +
>   	src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
>   	dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
>   
> -	y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
> -	c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;

You're changing the behavior here, can you please explain why this change is valid
into the commit description?

Thanks,
Angelo

> +	y_fb_dma = (u64)fb->base_y.dma_addr;
> +	c_fb_dma = (u64)fb->base_c.dma_addr;
>   	mtk_vdec_debug(inst->ctx, "[h264-dec] [%d] y_dma=%llx c_dma=%llx",
>   		       inst->ctx->decoded_frame_cnt, y_fb_dma, c_fb_dma);
>   

Re: [PATCH 1/3] media: mediatek: vcodec: fix h264 multi statless decoder smatch warning

[Yunfei Dong (董云飞)]

Hi AngeloGioacchino,

Thanks for your reviewing.
On Tue, 2024-04-02 at 11:50 +0200, AngeloGioacchino Del Regno wrote:
> Il 29/02/24 10:56, Yunfei Dong ha scritto:
> > Fix smatch static checker warning for vdec_h264_req_multi_if.c.
> > Leading to kernel crash when fb is NULL.
> > 
> > Fixes: 397edc703a10 ("media: mediatek: vcodec: add h264 decoder")
> > Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
> > ---
> >   .../vcodec/decoder/vdec/vdec_h264_req_multi_if.c         | 9
> > +++++++--
> >   1 file changed, 7 insertions(+), 2 deletions(-)
> > 
> > diff --git
> > a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req
> > _multi_if.c
> > b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req
> > _multi_if.c
> > index 0e741e0dc8ba..ab8e708e0df1 100644
> > ---
> > a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req
> > _multi_if.c
> > +++
> > b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req
> > _multi_if.c
> > @@ -724,11 +724,16 @@ static int vdec_h264_slice_single_decode(void
> > *h_vdec, struct mtk_vcodec_mem *bs
> >   		return vpu_dec_reset(vpu);
> >   
> >   	fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst->ctx);
> > +	if (!fb) {
> > +		mtk_vdec_err(inst->ctx, "fb buffer is NULL");
> > +		return -EBUSY;
> > +	}
> > +
> >   	src_buf_info = container_of(bs, struct mtk_video_dec_buf,
> > bs_buffer);
> >   	dst_buf_info = container_of(fb, struct mtk_video_dec_buf,
> > frame_buffer);
> >   
> > -	y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
> > -	c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
> 
> You're changing the behavior here, can you please explain why this
> change is valid
> into the commit description?
> 
The driver already add the condition to check whether fb is NULL at the
front, no need these two lines again.

> Thanks,
> Angelo
> 
Best Regards,
Yunfei Dong
> > +	y_fb_dma = (u64)fb->base_y.dma_addr;
> > +	c_fb_dma = (u64)fb->base_c.dma_addr;
> >   	mtk_vdec_debug(inst->ctx, "[h264-dec] [%d] y_dma=%llx
> > c_dma=%llx",
> >   		       inst->ctx->decoded_frame_cnt, y_fb_dma,
> > c_fb_dma);
> >   
> 
> 
> 

Re: [PATCH 1/3] media: mediatek: vcodec: fix h264 multi statless decoder smatch warning

[Andrzej Pietrasiewicz]

Hi,

W dniu 3.04.2024 o 05:45, Yunfei Dong (董云飞) pisze:
> Hi AngeloGioacchino,
> 
> Thanks for your reviewing.
> On Tue, 2024-04-02 at 11:50 +0200, AngeloGioacchino Del Regno wrote:
>> Il 29/02/24 10:56, Yunfei Dong ha scritto:
>>> Fix smatch static checker warning for vdec_h264_req_multi_if.c.
>>> Leading to kernel crash when fb is NULL.
>>>
>>> Fixes: 397edc703a10 ("media: mediatek: vcodec: add h264 decoder")
>>> Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
>>> ---
>>>    .../vcodec/decoder/vdec/vdec_h264_req_multi_if.c         | 9
>>> +++++++--
>>>    1 file changed, 7 insertions(+), 2 deletions(-)
>>>
>>> diff --git
>>> a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req
>>> _multi_if.c
>>> b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req
>>> _multi_if.c
>>> index 0e741e0dc8ba..ab8e708e0df1 100644
>>> ---
>>> a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req
>>> _multi_if.c
>>> +++
>>> b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req
>>> _multi_if.c
>>> @@ -724,11 +724,16 @@ static int vdec_h264_slice_single_decode(void
>>> *h_vdec, struct mtk_vcodec_mem *bs
>>>    		return vpu_dec_reset(vpu);
>>>    
>>>    	fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst->ctx);
>>> +	if (!fb) {
>>> +		mtk_vdec_err(inst->ctx, "fb buffer is NULL");
>>> +		return -EBUSY;
>>> +	}
>>> +
>>>    	src_buf_info = container_of(bs, struct mtk_video_dec_buf,
>>> bs_buffer);
>>>    	dst_buf_info = container_of(fb, struct mtk_video_dec_buf,
>>> frame_buffer);
>>>    
>>> -	y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
>>> -	c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
>>
>> You're changing the behavior here, can you please explain why this
>> change is valid
>> into the commit description?
>>
> The driver already add the condition to check whether fb is NULL at the
> front, no need these two lines again.
> 

Maybe Angelo refers to the function never returning -EBUSY before?
While at it, if fb is a kind of a buffer, why not -ENOMEM
when get_cap_buffer() fails?

Regards,

Andrzej

>> Thanks,
>> Angelo
>>
> Best Regards,
> Yunfei Dong
>>> +	y_fb_dma = (u64)fb->base_y.dma_addr;
>>> +	c_fb_dma = (u64)fb->base_c.dma_addr;
>>>    	mtk_vdec_debug(inst->ctx, "[h264-dec] [%d] y_dma=%llx
>>> c_dma=%llx",
>>>    		       inst->ctx->decoded_frame_cnt, y_fb_dma,
>>> c_fb_dma);
>>>    
>>
>>
>>

Re: [PATCH 1/3] media: mediatek: vcodec: fix h264 multi statless decoder smatch warning

[Yunfei Dong (董云飞)]

Hi Andrzej,

Thanks for your help to review this patch.

On Wed, 2024-05-29 at 15:14 +0200, Andrzej Pietrasiewicz wrote:
> Hi,
> 
> W dniu 3.04.2024 o 05:45, Yunfei Dong (董云飞) pisze:
> > Hi AngeloGioacchino,
> > 
> > Thanks for your reviewing.
> > On Tue, 2024-04-02 at 11:50 +0200, AngeloGioacchino Del Regno
> > wrote:
> > > Il 29/02/24 10:56, Yunfei Dong ha scritto:
> > > > Fix smatch static checker warning for vdec_h264_req_multi_if.c.
> > > > Leading to kernel crash when fb is NULL.
> > > > 
> > > > Fixes: 397edc703a10 ("media: mediatek: vcodec: add h264
> > > > decoder")
> > > > Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
> > > > ---
> > > >    .../vcodec/decoder/vdec/vdec_h264_req_multi_if.c         | 9
> > > > +++++++--
> > > >    1 file changed, 7 insertions(+), 2 deletions(-)
> > > > 
> > > > diff --git
> > > > a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264
> > > > _req
> > > > _multi_if.c
> > > > b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264
> > > > _req
> > > > _multi_if.c
> > > > index 0e741e0dc8ba..ab8e708e0df1 100644
> > > > ---
> > > > a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264
> > > > _req
> > > > _multi_if.c
> > > > +++
> > > > b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264
> > > > _req
> > > > _multi_if.c
> > > > @@ -724,11 +724,16 @@ static int
> > > > vdec_h264_slice_single_decode(void
> > > > *h_vdec, struct mtk_vcodec_mem *bs
> > > >    		return vpu_dec_reset(vpu);
> > > >    
> > > >    	fb = inst->ctx->dev->vdec_pdata->get_cap_buffer(inst-
> > > > >ctx);
> > > > +	if (!fb) {
> > > > +		mtk_vdec_err(inst->ctx, "fb buffer is NULL");
> > > > +		return -EBUSY;
> > > > +	}
> > > > +
> > > >    	src_buf_info = container_of(bs, struct
> > > > mtk_video_dec_buf,
> > > > bs_buffer);
> > > >    	dst_buf_info = container_of(fb, struct
> > > > mtk_video_dec_buf,
> > > > frame_buffer);
> > > >    
> > > > -	y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
> > > > -	c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
> > > 
> > > You're changing the behavior here, can you please explain why
> > > this
> > > change is valid
> > > into the commit description?
> > > 
> > 
> > The driver already add the condition to check whether fb is NULL at
> > the
> > front, no need these two lines again.
> > 
> 
> Maybe Angelo refers to the function never returning -EBUSY before?
> While at it, if fb is a kind of a buffer, why not -ENOMEM
> when get_cap_buffer() fails?
> 
Looks change the return value from EBUSY to ENOMEM much more
reasonable.

> Regards,
> 
> Andrzej
> 
Best Regards,
Yunfei Dong
> > > Thanks,
> > > Angelo
> > > 
> > 
> > Best Regards,
> > Yunfei Dong
> > > > +	y_fb_dma = (u64)fb->base_y.dma_addr;
> > > > +	c_fb_dma = (u64)fb->base_c.dma_addr;
> > > >    	mtk_vdec_debug(inst->ctx, "[h264-dec] [%d] y_dma=%llx
> > > > c_dma=%llx",
> > > >    		       inst->ctx->decoded_frame_cnt, y_fb_dma,
> > > > c_fb_dma);
> > > >    
> > > 
> > > 
> > > 
> 
>