[bug report] Revert "media: staging: atomisp: Remove driver"

[Dan Carpenter <dan.carpenter@xxxxxxxxxx>]

Hello Mauro Carvalho Chehab,

The patch ad85094b293e: "Revert "media: staging: atomisp: Remove
driver"" from Apr 19, 2020, leads to the following static checker
warning:

	drivers/staging/media/atomisp/pci/atomisp_acc.c:506 atomisp_acc_load_extensions()
	warn: iterator used outside loop: 'acc_fw'

drivers/staging/media/atomisp/pci/atomisp_acc.c
   446  int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
   447  {
   448          struct atomisp_acc_fw *acc_fw;
   449          bool ext_loaded = false;
   450          bool continuous = asd->continuous_mode->val &&
   451                            asd->run_mode->val == ATOMISP_RUN_MODE_PREVIEW;
   452          int ret = 0, i = -1;
   453          struct atomisp_device *isp = asd->isp;
   454  
   455          if (asd->acc.pipeline || asd->acc.extension_mode)
   456                  return -EBUSY;
   457  
   458          /* Invalidate caches. FIXME: should flush only necessary buffers */
   459          wbinvd();
   460  
   461          list_for_each_entry(acc_fw, &asd->acc.fw, list) {
   462                  if (acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_OUTPUT &&
   463                      acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_VIEWFINDER)
   464                          continue;
   465  
   466                  for (i = 0; i < ARRAY_SIZE(acc_flag_to_pipe); i++) {
   467                          /* QoS (ACC pipe) acceleration stages are currently
   468                           * allowed only in continuous mode. Skip them for
   469                           * all other modes. */
   470                          if (!continuous &&
   471                              acc_flag_to_pipe[i].flag ==
   472                              ATOMISP_ACC_FW_LOAD_FL_ACC)
   473                                  continue;
   474  
   475                          if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
   476                                  ret = atomisp_css_load_acc_extension(asd,
   477                                                                       acc_fw->fw,
   478                                                                       acc_flag_to_pipe[i].pipe_id,
   479                                                                       acc_fw->type);
   480                                  if (ret)
   481                                          goto error;

The little loop is intended to clean up a partial iteration from this
goto.

   482  
   483                                  ext_loaded = true;
   484                          }
   485                  }
   486  
   487                  ret = atomisp_css_set_acc_parameters(acc_fw);
   488                  if (ret < 0)
   489                          goto error;

And this one.

   490          }
   491  
   492          if (!ext_loaded)
   493                  return ret;
   494  
   495          ret = atomisp_css_update_stream(asd);
   496          if (ret) {
   497                  dev_err(isp->dev, "%s: update stream failed.\n", __func__);
   498                  goto error;

But if we hit this goto then "i" is non-zero and "acc_fw" is a bogus
pointer.

   499          }
   500  
   501          asd->acc.extension_mode = true;
   502          return 0;
   503  
   504  error:
   505          while (--i >= 0) {
   506                  if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
                            ^^^^^^^^^^^^^

Don't we need to check:

	if (!continuous &&
	    acc_flag_to_pipe[i].flag == ATOMISP_ACC_FW_LOAD_FL_ACC)

?

   507                          atomisp_css_unload_acc_extension(asd, acc_fw->fw,
   508                                                           acc_flag_to_pipe[i].pipe_id);
   509                  }
   510          }
   511  
   512          list_for_each_entry_continue_reverse(acc_fw, &asd->acc.fw, list) {
   513                  if (acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_OUTPUT &&
   514                      acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_VIEWFINDER)
   515                          continue;
   516  
   517                  for (i = ARRAY_SIZE(acc_flag_to_pipe) - 1; i >= 0; i--) {
   518                          if (!continuous &&
   519                              acc_flag_to_pipe[i].flag ==
   520                              ATOMISP_ACC_FW_LOAD_FL_ACC)
   521                                  continue;
   522                          if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
   523                                  atomisp_css_unload_acc_extension(asd,
   524                                                                   acc_fw->fw,
   525                                                                   acc_flag_to_pipe[i].pipe_id);
   526                          }
   527                  }
   528          }
   529          return ret;
   530  }

regards,
dan carpenter