Commit f07d4b42 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

staging: atomisp: off by one in atomisp_acc_load_extensions()

We should be doing i-- on all error paths but we don't if the loop
finishes successfully.  I've re-arranged this so that we don't read
beyond the end of acc_flag_to_pipe[] array.

Fixes: a49d2536 ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d8621971
...@@ -472,10 +472,8 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd) ...@@ -472,10 +472,8 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
acc_fw->fw, acc_fw->fw,
acc_flag_to_pipe[i].pipe_id, acc_flag_to_pipe[i].pipe_id,
acc_fw->type); acc_fw->type);
if (ret) { if (ret)
i--;
goto error; goto error;
}
ext_loaded = true; ext_loaded = true;
} }
...@@ -499,7 +497,7 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd) ...@@ -499,7 +497,7 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
return 0; return 0;
error: error:
for (; i >= 0; i--) { while (--i >= 0) {
if (acc_fw->flags & acc_flag_to_pipe[i].flag) { if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
atomisp_css_unload_acc_extension(asd, acc_fw->fw, atomisp_css_unload_acc_extension(asd, acc_fw->fw,
acc_flag_to_pipe[i].pipe_id); acc_flag_to_pipe[i].pipe_id);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment