From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Date: Tue, 11 Aug 2015 15:18:33 +0000 (-0300)
Subject: [media] sr030pc30: don't read a new pointer
X-Git-Tag: firefly_0821_release~176^2~795^2~206
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=27c039750c8ff1297632e424a4674732cc4c3c70;p=firefly-linux-kernel-4.4.55.git

[media] sr030pc30: don't read a new pointer

sr030pc30_get_fmt() can only succeed if both info->curr_win and
info->curr_fmt are not NULL.

If one of those vars are null, the curent code would call:
	ret = sr030pc30_set_params(sd);

If the curr_win is null, it will return -EINVAL, as it would be
expected. However, if curr_fmt is NULL, the function won't
set it.

The code will then try to read from it:

        mf->code        = info->curr_fmt->code;
        mf->colorspace  = info->curr_fmt->colorspace;

with obviouly won't work.

This got reported by smatch:
	drivers/media/i2c/sr030pc30.c:505 sr030pc30_get_fmt() error: we previously assumed 'info->curr_win' could be null (see line 499)
	drivers/media/i2c/sr030pc30.c:507 sr030pc30_get_fmt() error: we previously assumed 'info->curr_fmt' could be null (see line 499)

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
---

diff --git a/drivers/media/i2c/sr030pc30.c b/drivers/media/i2c/sr030pc30.c
index 229dc76c44a5..b04c09dd4bfb 100644
--- a/drivers/media/i2c/sr030pc30.c
+++ b/drivers/media/i2c/sr030pc30.c
@@ -489,18 +489,14 @@ static int sr030pc30_get_fmt(struct v4l2_subdev *sd,
 {
 	struct v4l2_mbus_framefmt *mf;
 	struct sr030pc30_info *info = to_sr030pc30(sd);
-	int ret;
 
 	if (!format || format->pad)
 		return -EINVAL;
 
 	mf = &format->format;
 
-	if (!info->curr_win || !info->curr_fmt) {
-		ret = sr030pc30_set_params(sd);
-		if (ret)
-			return ret;
-	}
+	if (!info->curr_win || !info->curr_fmt)
+		return -EINVAL;
 
 	mf->width	= info->curr_win->width;
 	mf->height	= info->curr_win->height;