decoder: Android P hardware/amlogic/media_modules coverity issue [1/1]

PD#SWPL-11723

Problem:
media_modules coverity issue

Solution:
According to the coverity reports, fix the decoder related issues

Verify:
u212

Change-Id: I7931abe2d10ff59282d6f1148d437b09ffabe70e
Signed-off-by: apollo.ling <apollo.ling@amlogic.com>

13 files changed, 93 insertions, 94 deletions

diff --git a/drivers/frame_provider/decoder/avs2/avs2_bufmgr.c b/drivers/frame_provider/decoder/avs2/avs2_bufmgr.c
index 6862180..3da87e4 100644
--- a/drivers/frame_provider/decoder/avs2/avs2_bufmgr.c
+++ b/drivers/frame_provider/decoder/avs2/avs2_bufmgr.c
@@ -501,9 +501,9 @@ void Get_I_Picture_Header(struct avs2_decoder *avs2_dec)
 				get_param(rpm_param->p.num_to_remove_cur,
 				"num of removed picture");
 #ifdef SANITY_CHECK
-			if (hd->curr_RPS.num_to_remove > 8)	{
-				hd->curr_RPS.num_to_remove = 8;
-				pr_info("Warning, %s: num_to_remove %d beyond range, force to 8\n",
+			if (hd->curr_RPS.num_to_remove > MAXREF)	{
+				hd->curr_RPS.num_to_remove = MAXREF;
+				pr_info("Warning, %s: num_to_remove %d beyond range, force to MAXREF\n",
 					__func__, hd->curr_RPS.num_to_remove);
 			}
 #endif
@@ -691,9 +691,9 @@ void Get_PB_Picture_Header(struct avs2_decoder *avs2_dec)
 				rpm_param->p.num_to_remove_cur,
 				"num of removed picture");
 #ifdef SANITY_CHECK
-			if (hd->curr_RPS.num_to_remove > 8)	{
-				hd->curr_RPS.num_to_remove = 8;
-				pr_info("Warning, %s: num_to_remove %d beyond range, force to 8\n",
+			if (hd->curr_RPS.num_to_remove > MAXREF)	{
+				hd->curr_RPS.num_to_remove = MAXREF;
+				pr_info("Warning, %s: num_to_remove %d beyond range, force to MAXREF\n",
 					__func__, hd->curr_RPS.num_to_remove);
 			}
 #endif
diff --git a/drivers/frame_provider/decoder/avs2/vavs2.c b/drivers/frame_provider/decoder/avs2/vavs2.c
index 4b88db3..938312e 100644
--- a/drivers/frame_provider/decoder/avs2/vavs2.c
+++ b/drivers/frame_provider/decoder/avs2/vavs2.c
@@ -4136,7 +4136,7 @@ static struct vframe_s *vavs2_vf_get(void *op_arg)
 
 	if (kfifo_get(&dec->display_q, &vf)) {
 		uint8_t index = vf->index & 0xff;
-		if (index >= 0 && index < dec->used_buf_num) {
+		if (index < dec->used_buf_num) {
 			struct avs2_frame_s *pic = get_pic_by_index(dec, index);
 			if (pic == NULL &&
 				(debug & AVS2_DBG_PIC_LEAK)) {
@@ -4186,8 +4186,7 @@ static void vavs2_vf_put(struct vframe_s *vf, void *op_arg)
 		__func__, vf->index,
 		dec->vf_put_count);
 
-	if (index >= 0
-		&& index < dec->used_buf_num) {
+	if (index < dec->used_buf_num) {
 		unsigned long flags;
 		struct avs2_frame_s *pic;
 
@@ -5160,55 +5159,55 @@ static void get_picture_qos_info(struct AVS2Decoder_s *dec)
 #endif
 		picture->min_mv = mv_lo;
 
+#ifdef DEBUG_QOS
 		/* {mvy_L0_max, mvy_L0_min} */
 	    rdata32 = READ_VREG(HEVC_PIC_QUALITY_DATA);
 	    mv_hi = (rdata32>>16)&0xffff;
 	    if (mv_hi & 0x8000)
 			mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
 	    avs2_print(dec, 0, "[Picture %d Quality] MVY_L0 MAX : %d\n",
 			pic_number, mv_hi);
-#endif
+
 
 	    mv_lo = (rdata32>>0)&0xffff;
 	    if (mv_lo & 0x8000)
 			mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	    avs2_print(dec, 0, "[Picture %d Quality] MVY_L0 MIN : %d\n",
 			pic_number, mv_lo);
-#endif
+
 
 		/* {mvx_L1_max, mvx_L1_min} */
 	    rdata32 = READ_VREG(HEVC_PIC_QUALITY_DATA);
 	    mv_hi = (rdata32>>16)&0xffff;
 	    if (mv_hi & 0x8000)
 			mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
+
 	    avs2_print(dec, 0, "[Picture %d Quality] MVX_L1 MAX : %d\n",
 			pic_number, mv_hi);
-#endif
+
 
 	    mv_lo = (rdata32>>0)&0xffff;
 	    if (mv_lo & 0x8000)
 			mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	    avs2_print(dec, 0, "[Picture %d Quality] MVX_L1 MIN : %d\n",
 			pic_number, mv_lo);
-#endif
+
 
 		/* {mvy_L1_max, mvy_L1_min} */
 	    rdata32 = READ_VREG(HEVC_PIC_QUALITY_DATA);
 	    mv_hi = (rdata32>>16)&0xffff;
 	    if (mv_hi & 0x8000)
 			mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
+
 	    avs2_print(dec, 0, "[Picture %d Quality] MVY_L1 MAX : %d\n",
 			pic_number, mv_hi);
-#endif
+
 	    mv_lo = (rdata32>>0)&0xffff;
 	    if (mv_lo & 0x8000)
 			mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	    avs2_print(dec, 0, "[Picture %d Quality] MVY_L1 MIN : %d\n",
 			pic_number, mv_lo);
 #endif
@@ -5467,6 +5466,7 @@ static irqreturn_t vavs2_isr_thread_fn(int irq, void *data)
 		debug_buffer_mgr_more(dec);
 		get_frame_rate(&dec->avs2_dec.param, dec);
 
+#if 0 // The video_signal_type is type of uint16_t and result false, so comment it out.
 		if (dec->avs2_dec.param.p.video_signal_type
 				& (1<<30)) {
 			union param_u *pPara;
@@ -5539,6 +5539,7 @@ static irqreturn_t vavs2_isr_thread_fn(int irq, void *data)
 				"max_pic_average:0x%x\n",
 				dec->vf_dp.content_light_level.max_pic_average);
 		}
+#endif
 
 
 		if (dec->video_ori_signal_type !=
@@ -7342,7 +7343,7 @@ static int ammvdec_avs2_probe(struct platform_device *pdev)
 		dec->stat |= VP9_TRIGGER_FRAME_ENABLE;
 #if 1
 	if ((debug & IGNORE_PARAM_FROM_CONFIG) == 0 &&
-			pdata->config && pdata->config_len) {
+			pdata->config_len) {
 		/*use ptr config for doubel_write_mode, etc*/
 		avs2_print(dec, 0, "pdata->config=%s\n", pdata->config);
 		if (get_config_int(pdata->config, "avs2_double_write_mode",
@@ -7433,13 +7434,6 @@ static int ammvdec_avs2_probe(struct platform_device *pdev)
 	dec->first_sc_checked = 0;
 	dec->fatal_error = 0;
 	dec->show_frame_num = 0;
-	if (pdata == NULL) {
-		pr_info("\namvdec_avs2 memory resource undefined.\n");
-		uninit_mmu_buffers(dec);
-		/* devm_kfree(&pdev->dev, (void *)dec); */
-		vfree((void *)dec);
-		return -EFAULT;
-	}
 
 	if (debug) {
 		pr_info("===AVS2 decoder mem resource 0x%lx size 0x%x\n",
diff --git a/drivers/frame_provider/decoder/avs_multi/avs_multi.c b/drivers/frame_provider/decoder/avs_multi/avs_multi.c
index f717244..a9dd7fd 100644
--- a/drivers/frame_provider/decoder/avs_multi/avs_multi.c
+++ b/drivers/frame_provider/decoder/avs_multi/avs_multi.c
@@ -608,7 +608,9 @@ static int debug_print(struct vdec_avs_hw_s *hw,
 #define AVS_PRINT_BUF		256
 	unsigned char buf[AVS_PRINT_BUF];
 	int len = 0;
-	int index = hw->m_ins_flag ? DECODE_ID(hw) : 0;
+	int index = 0;
+	if (hw)
+		index = hw->m_ins_flag ? DECODE_ID(hw) : 0;
 	if (hw == NULL ||
 		(flag == 0) ||
 		((debug_mask &
@@ -631,7 +633,9 @@ static int debug_print_cont(struct vdec_avs_hw_s *hw,
 {
 	unsigned char buf[AVS_PRINT_BUF];
 	int len = 0;
-	int index = hw->m_ins_flag ? DECODE_ID(hw) : 0;
+	int index = 0;
+	if (hw)
+		index = hw->m_ins_flag ? DECODE_ID(hw) : 0;
 	if (hw == NULL ||
 		(flag == 0) ||
 		((debug_mask &
@@ -2690,7 +2694,7 @@ static s32 vavs_init(struct vdec_avs_hw_s *hw)
 	if (size < 0) {
 		amvdec_disable();
 		pr_err("get firmware fail.");
-		/*vfree(buf);*/
+		vfree(fw);
 		return -1;
 	}
 
@@ -2869,6 +2873,9 @@ static int amvdec_avs_probe(struct platform_device *pdev)
 		kfree(hw->gvs);
 		hw->gvs = NULL;
 		pdata->dec_status = NULL;
+		if (hw->fw)
+			vfree(hw->fw);
+		hw->fw = NULL;
 		return -ENODEV;
 	}
 	/*vdec = pdata;*/
diff --git a/drivers/frame_provider/decoder/h264/vh264.c b/drivers/frame_provider/decoder/h264/vh264.c
index dc774b9..3470147 100644
--- a/drivers/frame_provider/decoder/h264/vh264.c
+++ b/drivers/frame_provider/decoder/h264/vh264.c
@@ -1680,55 +1680,55 @@ static void load_qos_data(int pic_number, uint32_t b_offset)
 	node->min_mv = mv_lo;
 #endif
 
+#ifdef DEBUG_QOS
 	/* {mvy_L0_max, mvy_L0_min} */
 	rdata32 = READ_VREG(VDEC_PIC_QUALITY_DATA);
 	mv_hi = (rdata32>>16)&0xffff;
 	if (mv_hi & 0x8000)
 		mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
 	pr_info(" [Picture %d Quality] MVY_L0 MAX : %d\n",
 		pic_number, mv_hi);
-#endif
+
 
 	mv_lo = (rdata32>>0)&0xffff;
 	if (mv_lo & 0x8000)
 		mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	pr_info(" [Picture %d Quality] MVY_L0 MIN : %d\n",
 		pic_number, mv_lo);
-#endif
+
 
 	/* {mvx_L1_max, mvx_L1_min} */
 	rdata32 = READ_VREG(VDEC_PIC_QUALITY_DATA);
 	mv_hi = (rdata32>>16)&0xffff;
 	if (mv_hi & 0x8000)
 		mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
+
 	pr_info(" [Picture %d Quality] MVX_L1 MAX : %d\n",
 		pic_number, mv_hi);
-#endif
+
 
 	mv_lo = (rdata32>>0)&0xffff;
 	if (mv_lo & 0x8000)
 		mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	pr_info(" [Picture %d Quality] MVX_L1 MIN : %d\n",
 		pic_number, mv_lo);
-#endif
+
 
 	/* {mvy_L1_max, mvy_L1_min} */
 	rdata32 = READ_VREG(VDEC_PIC_QUALITY_DATA);
 	mv_hi = (rdata32>>16)&0xffff;
 	if (mv_hi & 0x8000)
 		mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
+
 	pr_info(" [Picture %d Quality] MVY_L1 MAX : %d\n",
 		pic_number, mv_hi);
-#endif
+
 	mv_lo = (rdata32>>0)&0xffff;
 	if (mv_lo & 0x8000)
 		mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	pr_info(" [Picture %d Quality] MVY_L1 MIN : %d\n",
 		pic_number, mv_lo);
 #endif
diff --git a/drivers/frame_provider/decoder/h264_multi/h264_dpb.c b/drivers/frame_provider/decoder/h264_multi/h264_dpb.c
index 314b240..06e3621 100644
--- a/drivers/frame_provider/decoder/h264_multi/h264_dpb.c
+++ b/drivers/frame_provider/decoder/h264_multi/h264_dpb.c
@@ -1568,7 +1568,7 @@ static void dpb_combine_field(struct h264_dpb_stru *p_H264_Dpb,
 	fs->frame->view_id = fs->view_id;
 #endif
 	fs->frame->iCodingType = fs->top_field->iCodingType;
-	if (fs->top_field->poc < fs->bottom_field->poc) {
+	if (fs->bottom_field && fs->top_field->poc < fs->bottom_field->poc) {
 		fs->pts = fs->top_field->pts;
 		fs->pts64 = fs->top_field->pts64;
 		/*SWPL-7105 fix */
@@ -1578,7 +1578,7 @@ static void dpb_combine_field(struct h264_dpb_stru *p_H264_Dpb,
 			fs->pts64 = 0;
 		}
 		fs->offset_delimiter = fs->top_field->offset_delimiter;
-	} else {
+	} else if (fs->bottom_field) {
 		fs->pts = fs->bottom_field->pts;
 		fs->pts64 = fs->bottom_field->pts64;
 		fs->offset_delimiter = fs->bottom_field->offset_delimiter;
diff --git a/drivers/frame_provider/decoder/h264_multi/vmh264.c b/drivers/frame_provider/decoder/h264_multi/vmh264.c
index 4dd8bf1..90fb51c 100644
--- a/drivers/frame_provider/decoder/h264_multi/vmh264.c
+++ b/drivers/frame_provider/decoder/h264_multi/vmh264.c
@@ -4454,55 +4454,55 @@ static void get_picture_qos_info(struct StorablePicture *picture)
 #endif
 		picture->min_mv = mv_lo;
 
+#ifdef DEBUG_QOS
 		/* {mvy_L0_max, mvy_L0_min} */
 	    rdata32 = READ_VREG(VDEC_PIC_QUALITY_DATA);
 	    mv_hi = (rdata32>>16)&0xffff;
 	    if (mv_hi & 0x8000)
 			mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
 	    pr_info(" [Picture %d Quality] MVY_L0 MAX : %d\n",
 			pic_number, mv_hi);
-#endif
+
 
 	    mv_lo = (rdata32>>0)&0xffff;
 	    if (mv_lo & 0x8000)
 			mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	    pr_info(" [Picture %d Quality] MVY_L0 MIN : %d\n",
 			pic_number, mv_lo);
-#endif
+
 
 		/* {mvx_L1_max, mvx_L1_min} */
 	    rdata32 = READ_VREG(VDEC_PIC_QUALITY_DATA);
 	    mv_hi = (rdata32>>16)&0xffff;
 	    if (mv_hi & 0x8000)
 			mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
+
 	    pr_info(" [Picture %d Quality] MVX_L1 MAX : %d\n",
 			pic_number, mv_hi);
-#endif
+
 
 	    mv_lo = (rdata32>>0)&0xffff;
 	    if (mv_lo & 0x8000)
 			mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	    pr_info(" [Picture %d Quality] MVX_L1 MIN : %d\n",
 			pic_number, mv_lo);
-#endif
+
 
 		/* {mvy_L1_max, mvy_L1_min} */
 	    rdata32 = READ_VREG(VDEC_PIC_QUALITY_DATA);
 	    mv_hi = (rdata32>>16)&0xffff;
 	    if (mv_hi & 0x8000)
 			mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
+
 	    pr_info(" [Picture %d Quality] MVY_L1 MAX : %d\n",
 			pic_number, mv_hi);
-#endif
+
 	    mv_lo = (rdata32>>0)&0xffff;
 	    if (mv_lo & 0x8000)
 			mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	    pr_info(" [Picture %d Quality] MVY_L1 MIN : %d\n",
 			pic_number, mv_lo);
 #endif
diff --git a/drivers/frame_provider/decoder/h265/vh265.c b/drivers/frame_provider/decoder/h265/vh265.c
index 302a96d..04fa872 100644
--- a/drivers/frame_provider/decoder/h265/vh265.c
+++ b/drivers/frame_provider/decoder/h265/vh265.c
@@ -6615,55 +6615,55 @@ static void get_picture_qos_info(struct hevc_state_s *hevc)
 #endif
 		picture->min_mv = mv_lo;
 
+#ifdef DEBUG_QOS
 		/* {mvy_L0_max, mvy_L0_min} */
 	    rdata32 = READ_VREG(HEVC_PIC_QUALITY_DATA);
 	    mv_hi = (rdata32>>16)&0xffff;
 	    if (mv_hi & 0x8000)
 			mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
 	    hevc_print(hevc, 0, "[Picture %d Quality] MVY_L0 MAX : %d\n",
 			pic_number, mv_hi);
-#endif
+
 
 	    mv_lo = (rdata32>>0)&0xffff;
 	    if (mv_lo & 0x8000)
 			mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	    hevc_print(hevc, 0, "[Picture %d Quality] MVY_L0 MIN : %d\n",
 			pic_number, mv_lo);
-#endif
+
 
 		/* {mvx_L1_max, mvx_L1_min} */
 	    rdata32 = READ_VREG(HEVC_PIC_QUALITY_DATA);
 	    mv_hi = (rdata32>>16)&0xffff;
 	    if (mv_hi & 0x8000)
 			mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
+
 	    hevc_print(hevc, 0, "[Picture %d Quality] MVX_L1 MAX : %d\n",
 			pic_number, mv_hi);
-#endif
+
 
 	    mv_lo = (rdata32>>0)&0xffff;
 	    if (mv_lo & 0x8000)
 			mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	    hevc_print(hevc, 0, "[Picture %d Quality] MVX_L1 MIN : %d\n",
 			pic_number, mv_lo);
-#endif
+
 
 		/* {mvy_L1_max, mvy_L1_min} */
 	    rdata32 = READ_VREG(HEVC_PIC_QUALITY_DATA);
 	    mv_hi = (rdata32>>16)&0xffff;
 	    if (mv_hi & 0x8000)
 			mv_hi = 0x8000 - mv_hi;
-#ifdef DEBUG_QOS
+
 	    hevc_print(hevc, 0, "[Picture %d Quality] MVY_L1 MAX : %d\n",
 			pic_number, mv_hi);
-#endif
+
 	    mv_lo = (rdata32>>0)&0xffff;
 	    if (mv_lo & 0x8000)
 			mv_lo = 0x8000 - mv_lo;
-#ifdef DEBUG_QOS
+
 	    hevc_print(hevc, 0, "[Picture %d Quality] MVY_L1 MIN : %d\n",
 			pic_number, mv_lo);
 #endif
@@ -8182,6 +8182,8 @@ static void vh265_vf_put(struct vframe_s *vf, void *op_arg)
 		return;
 	if (vf == (&hevc->vframe_dummy))
 		return;
+	if (!vf)
+		return;
 	index_top = vf->index & 0xff;
 	index_bot = (vf->index >> 8) & 0xff;
 	if (get_dbg_flag(hevc) & H265_DEBUG_PIC_STRUCT)
@@ -13123,10 +13125,11 @@ static int ammvdec_h265_remove(struct platform_device *pdev)
 	struct hevc_state_s *hevc =
 		(struct hevc_state_s *)
 		(((struct vdec_s *)(platform_get_drvdata(pdev)))->private);
-	struct vdec_s *vdec = hw_to_vdec(hevc);
+	struct vdec_s *vdec;
 
 	if (hevc == NULL)
 		return 0;
+	vdec = hw_to_vdec(hevc);
 
 	//pr_err("%s [pid=%d,tgid=%d]\n", __func__, current->pid, current->tgid);
 	if (get_dbg_flag(hevc))
diff --git a/drivers/frame_provider/decoder/mjpeg/vmjpeg_multi.c b/drivers/frame_provider/decoder/mjpeg/vmjpeg_multi.c
index 493231b..aea1346 100644
--- a/drivers/frame_provider/decoder/mjpeg/vmjpeg_multi.c
+++ b/drivers/frame_provider/decoder/mjpeg/vmjpeg_multi.c
@@ -1504,9 +1504,13 @@ static int ammvdec_mjpeg_remove(struct platform_device *pdev)
 	struct vdec_mjpeg_hw_s *hw =
 		(struct vdec_mjpeg_hw_s *)
 		(((struct vdec_s *)(platform_get_drvdata(pdev)))->private);
-	struct vdec_s *vdec = hw_to_vdec(hw);
+	struct vdec_s *vdec;
 	int i;
 
+	if (!hw)
+		return -1;
+	vdec = hw_to_vdec(hw);
+
 	vmjpeg_stop(hw);
 
 	if (vdec->parallel_dec == 1)
@@ -1521,10 +1525,8 @@ static int ammvdec_mjpeg_remove(struct platform_device *pdev)
 			vdec->free_canvas_ex(hw->buffer_spec[i].v_canvas_index, vdec->id);
 		}
 	}
-	if (hw) {
-		vfree(hw);
-		hw = NULL;
-	}
+	vfree(hw);
+
 	pr_info("%s\n", __func__);
 	return 0;
 }
diff --git a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
index 3898122..590fc51 100644
--- a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
+++ b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
@@ -1402,7 +1402,7 @@ static void userdata_push_do_work(struct work_struct *work)
 	psrc_data = (u8 *)hw->ccbuf_phyAddress_virt + hw->ucode_cc_last_wp;
 
 	pdata = hw->userdata_info.data_buf + hw->userdata_info.last_wp;
-	for (i = 0; i < data_length; i++) {
+	for (i = 0; i < data_length && psrc_data; i++) {
 		*pdata++ = *psrc_data++;
 		if (pdata >= hw->userdata_info.data_buf_end)
 			pdata = hw->userdata_info.data_buf;
@@ -1479,9 +1479,6 @@ static int prepare_display_buf(struct vdec_mpeg12_hw_s *hw,
 	u32 info = pic->buffer_info;
 	struct vdec_s *vdec = hw_to_vdec(hw);
 
-	if (hw == NULL || pic == NULL)
-		return -1;
-
 	user_data_ready_notify(hw, pic->pts, pic->pts_valid);
 #ifdef NV21
 	type = VIDTYPE_VIU_NV21;
@@ -2822,7 +2819,7 @@ void (*callback)(struct vdec_s *, void *),
 #endif
 
 	size = vdec_prepare_input(vdec, &hw->chunk);
-	if (size < 0) {
+	if (size < 0 || !hw->chunk) {
 		hw->input_empty++;
 		hw->dec_result = DEC_RESULT_AGAIN;
 		vdec_schedule_work(&hw->work);
@@ -2831,11 +2828,9 @@ void (*callback)(struct vdec_s *, void *),
 	if (vdec_frame_based(vdec) && debug_enable) {
 		u8 *data = NULL;
 
-
-		if (hw->chunk)
-			debug_print(DECODE_ID(hw), PRINT_FLAG_RUN_FLOW,
-				"run: chunk offset 0x%x, size %d\n",
-				hw->chunk->offset, hw->chunk->size);
+		debug_print(DECODE_ID(hw), PRINT_FLAG_RUN_FLOW,
+			"run: chunk offset 0x%x, size %d\n",
+			hw->chunk->offset, hw->chunk->size);
 
 		if (!hw->chunk->block->is_mapped)
 			data = codec_mm_vmap(hw->chunk->block->start +
@@ -3114,10 +3109,9 @@ static int ammvdec_mpeg12_remove(struct platform_device *pdev)
 		vfree(hw->fw);
 		hw->fw = NULL;
 	}
-	if (hw) {
-		vfree(hw);
-		hw = NULL;
-	}
+
+	vfree(hw);
+
 	pr_info("ammvdec_mpeg12 removed.\n");
 
 	return 0;
diff --git a/drivers/frame_provider/decoder/mpeg4/vmpeg4_multi.c b/drivers/frame_provider/decoder/mpeg4/vmpeg4_multi.c
index 92cea0e..aff7852 100644
--- a/drivers/frame_provider/decoder/mpeg4/vmpeg4_multi.c
+++ b/drivers/frame_provider/decoder/mpeg4/vmpeg4_multi.c
@@ -1530,13 +1530,8 @@ static int vmpeg4_canvas_init(struct vdec_mpeg4_hw_s *hw)
 			decbuf_size =
 				ALIGN(align_w * align_h * 3/2, SZ_64K);
 		} else { /*1080p*/
-			if (h > w) {
-				canvas_width = 1088;
-				canvas_height = 1920;
-			} else {
-				canvas_width = 1920;
-				canvas_height = 1088;
-			}
+			canvas_width = 1920;
+			canvas_height = 1088;
 			decbuf_y_size = 0x200000;
 			decbuf_size = 0x300000;
 		}
diff --git a/drivers/frame_provider/decoder/utils/frame_check.c b/drivers/frame_provider/decoder/utils/frame_check.c
index 95d2609..e0100d1 100644
--- a/drivers/frame_provider/decoder/utils/frame_check.c
+++ b/drivers/frame_provider/decoder/utils/frame_check.c
@@ -252,6 +252,7 @@ static struct file* file_open(int mode, const char *str, ...)
 	if (IS_ERR(fp)) {
 		fp = NULL;
 		dbg_print(FC_ERROR, "open %s failed\n", file);
+		va_end(args);
 		return fp;
 	}
 	dbg_print(FC_ERROR, "open %s success\n", file);
diff --git a/drivers/frame_provider/decoder/utils/vdec_input.c b/drivers/frame_provider/decoder/utils/vdec_input.c
index 74bbaa7..1a39cbd 100644
--- a/drivers/frame_provider/decoder/utils/vdec_input.c
+++ b/drivers/frame_provider/decoder/utils/vdec_input.c
@@ -948,7 +948,7 @@ int vdec_input_add_frame(struct vdec_input_s *input, const char *buf,
 		while (count > 0) {
 			if (count < sizeof(struct drm_info))
 				return -EIO;
-			if (copy_from_user(&drm, buf + ret, sizeof(struct drm_info)))
+			if (copy_from_user((void*)&drm, buf + ret, sizeof(struct drm_info)))
 				return -EAGAIN;
 			if (!(drm.drm_flag & TYPE_DRMINFO_V2))
 				return -EIO; /*must drm info v2 version*/
diff --git a/drivers/frame_provider/decoder/vp9/vvp9.c b/drivers/frame_provider/decoder/vp9/vvp9.c
index bd1e51a..a8725bf 100644
--- a/drivers/frame_provider/decoder/vp9/vvp9.c
+++ b/drivers/frame_provider/decoder/vp9/vvp9.c
@@ -4782,6 +4782,9 @@ static int v4l_alloc_and_config_pic(struct VP9Decoder_s *pbi,
 #endif
 	struct vdec_v4l2_buffer *fb = NULL;
 
+	if (i < 0)
+		return ret;
+
 	ret = vdec_v4l_get_buffer(pbi->v4l2_ctx, &fb);
 	if (ret < 0) {
 		vp9_print(pbi, 0, "[%d] VP9 get buffer fail.\n",