Re: [PATCH] media: au0828: Move a variable assignment behind condition checks in au0828_isoc_copy()

[Hans Verkuil]

On 14/04/2023 21:10, Markus Elfring wrote:
> Date: Fri, 14 Apr 2023 21:00:45 +0200
> 
> The address of a data structure member was determined before
> a corresponding null pointer check in the implementation of
> the function “au0828_isoc_copy”.
> 
> Thus avoid the risk for undefined behaviour by moving the assignment
> for the variable “vbi_dma_q” behind some condition checks.

Just drop these lines instead:

        if (!dev)
                return 0;

If you analyze the code then you'll see that dev is never NULL.

> 
> This issue was detected by using the Coccinelle software.
> 
> Fixes: 7f8eacd2162a39ca7fc1240883118a786f147ccb ("V4L/DVB: Add closed captioning support for the HVR-950q")

This doesn't actually fix anything since nothing was wrong. Drop the
Fixes tag. Same for all the other patches.

Regards,

	Hans

> Signed-off-by: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/media/usb/au0828/au0828-video.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c
> index fd9fc43d47e0..c0c5f2ed65e3 100644
> --- a/drivers/media/usb/au0828/au0828-video.c
> +++ b/drivers/media/usb/au0828/au0828-video.c
> @@ -491,7 +491,7 @@ static inline int au0828_isoc_copy(struct au0828_dev *dev, struct urb *urb)
>  	struct au0828_buffer    *buf;
>  	struct au0828_buffer    *vbi_buf;
>  	struct au0828_dmaqueue  *dma_q = urb->context;
> -	struct au0828_dmaqueue  *vbi_dma_q = &dev->vbiq;
> +	struct au0828_dmaqueue  *vbi_dma_q;
>  	unsigned char *outp = NULL;
>  	unsigned char *vbioutp = NULL;
>  	int i, len = 0, rc = 1;
> @@ -521,6 +521,8 @@ static inline int au0828_isoc_copy(struct au0828_dev *dev, struct urb *urb)
>  	if (vbi_buf != NULL)
>  		vbioutp = vb2_plane_vaddr(&vbi_buf->vb.vb2_buf, 0);
> 
> +	vbi_dma_q = &dev->vbiq;
> +
>  	for (i = 0; i < urb->number_of_packets; i++) {
>  		int status = urb->iso_frame_desc[i].status;
> 
> --
> 2.40.0
>