media: dvb-core: Fix coding errors in broadcast drivers

Added Check to verify TSPP channel input source is valid.
Initialize return variables to return correct values in fail conditions.
Move deferencing of input pointer arguments after NULL checking.

CR's-Fixed: 2043689
Change-Id: I7febdb0e0f499846cfcf8836ea35c8547a5074fb
Signed-off-by: Udaya Bhaskara Reddy Mallavarapu <udaym@codeaurora.org>

3 files changed, 18 insertions, 9 deletions

diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index a9c4237d631a..9b743f5fdcf8 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -1615,7 +1615,7 @@ static int dvb_dvr_get_event(struct dmxdev *dmxdev,
 				unsigned int f_flags,
 				struct dmx_filter_event *event)
 {
-	int res;
+	int res = 0;
 
 	if (!((f_flags & O_ACCMODE) == O_RDONLY))
 		return -EINVAL;
@@ -2402,8 +2402,10 @@ static int dvb_dmxdev_set_playback_mode(struct dmxdev_filter *dmxdevfilter,
 		(playback_mode != DMX_PB_MODE_PULL))
 		return -EINVAL;
 
+	if (dmxdev->demux->set_playback_mode == NULL)
+		return -EINVAL;
+
 	if (((dmxdev->source < DMX_SOURCE_DVR0) ||
-		 !dmxdev->demux->set_playback_mode ||
 		 !(caps.caps & DMX_CAP_PULL_MODE)) &&
 		 (playback_mode == DMX_PB_MODE_PULL))
 		return -EPERM;
@@ -2520,7 +2522,7 @@ static int dvb_dmxdev_release_data(struct dmxdev_filter *dmxdevfilter,
 static int dvb_dmxdev_get_event(struct dmxdev_filter *dmxdevfilter,
 					struct dmx_filter_event *event)
 {
-	int res;
+	int res = 0;
 
 	spin_lock_irq(&dmxdevfilter->dev->lock);
 
diff --git a/drivers/media/platform/msm/broadcast/tspp.c b/drivers/media/platform/msm/broadcast/tspp.c
index b706d598e6b8..fa566ad01d99 100644
--- a/drivers/media/platform/msm/broadcast/tspp.c
+++ b/drivers/media/platform/msm/broadcast/tspp.c
@@ -2210,7 +2210,13 @@ int tspp_remove_filter(u32 dev, u32 channel_id,
 	channel = &pdev->channels[channel_id];
 
 	src = channel->src;
-	tspp_filter = &(pdev->filters[src]->filter[filter->priority]);
+	if ((src == TSPP_SOURCE_TSIF0) || (src == TSPP_SOURCE_TSIF1))
+		tspp_filter = &(pdev->filters[src]->filter[filter->priority]);
+	else {
+		pr_err("tspp_remove: wrong source type %d", src);
+		return -EINVAL;
+	}
+
 
 	/* disable pipe (channel) */
 	val = readl_relaxed(pdev->base + TSPP_PS_DISABLE);
diff --git a/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c b/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c
index 2fc3ce406c27..2d2296893140 100644
--- a/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c
+++ b/drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c
@@ -6536,10 +6536,8 @@ static int mpq_sdmx_write(struct mpq_demux *mpq_demux,
 	const char *buf,
 	size_t count)
 {
-	struct ion_handle *ion_handle =
-		mpq_demux->demux.dmx.dvr_input.priv_handle;
-	struct dvb_ringbuffer *rbuf = (struct dvb_ringbuffer *)
-		mpq_demux->demux.dmx.dvr_input.ringbuff;
+	struct ion_handle *ion_handle;
+	struct dvb_ringbuffer *rbuf;
 	struct sdmx_buff_descr buf_desc;
 	u32 read_offset;
 	int ret;
@@ -6549,10 +6547,13 @@ static int mpq_sdmx_write(struct mpq_demux *mpq_demux,
 		return -EINVAL;
 	}
 
+	ion_handle = mpq_demux->demux.dmx.dvr_input.priv_handle;
+	rbuf = (struct dvb_ringbuffer *)mpq_demux->demux.dmx.dvr_input.ringbuff;
+
 	ret = mpq_sdmx_dvr_buffer_desc(mpq_demux, &buf_desc);
 	if (ret) {
 		MPQ_DVB_ERR_PRINT(
-			"%s: Failed to init input buffer descriptor. ret = %d\n",
+		"%s: Failed to init input buffer descriptor. ret = %d\n",
 			__func__, ret);
 		return ret;
 	}