| Message ID | 20211222142025.30364-3-johan@kernel.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | media: davinci: vpif: fix use-after-free on driver unbind | expand |
Hi Johan, Thank you for the patch. On Wed, Dec 22, 2021 at 2:20 PM Johan Hovold <johan@kernel.org> wrote: > > Make sure to disable runtime PM before returning on probe errors. > > Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support") > Cc: stable@vger.kernel.org # 4.12: 4024d6f601e3c > Cc: Kevin Hilman <khilman@baylibre.com> > Signed-off-by: Johan Hovold <johan@kernel.org> > --- > drivers/media/platform/davinci/vpif.c | 11 +++++++++-- > 1 file changed, 9 insertions(+), 2 deletions(-) > > diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c > index 9752a5ec36f7..1f5eacf48580 100644 > --- a/drivers/media/platform/davinci/vpif.c > +++ b/drivers/media/platform/davinci/vpif.c > @@ -428,6 +428,7 @@ static int vpif_probe(struct platform_device *pdev) > static struct resource *res_irq; > struct platform_device *pdev_capture, *pdev_display; > struct device_node *endpoint = NULL; > + int ret; > > vpif_base = devm_platform_ioremap_resource(pdev, 0); > if (IS_ERR(vpif_base)) > @@ -456,8 +457,8 @@ static int vpif_probe(struct platform_device *pdev) > res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); > if (!res_irq) { > dev_warn(&pdev->dev, "Missing IRQ resource.\n"); > - pm_runtime_put(&pdev->dev); Maybe just add pm_runtime_disable(&pdev->dev); here, rest diff won't be required. Cheers, Prabhakar > - return -EINVAL; > + ret = -EINVAL; > + goto err_put_rpm; > } > > pdev_capture = devm_kzalloc(&pdev->dev, sizeof(*pdev_capture), > @@ -491,6 +492,12 @@ static int vpif_probe(struct platform_device *pdev) > } > > return 0; > + > +err_put_rpm: > + pm_runtime_put(&pdev->dev); > + pm_runtime_disable(&pdev->dev); > + > + return ret; > } > > static int vpif_remove(struct platform_device *pdev) > -- > 2.32.0 >
Hi Lad, and sorry about the late reply. On Tue, Jan 04, 2022 at 06:11:08PM +0000, Lad, Prabhakar wrote: > Hi Johan, > > Thank you for the patch. > > On Wed, Dec 22, 2021 at 2:20 PM Johan Hovold <johan@kernel.org> wrote: > > > > Make sure to disable runtime PM before returning on probe errors. > > > > Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support") > > Cc: stable@vger.kernel.org # 4.12: 4024d6f601e3c > > Cc: Kevin Hilman <khilman@baylibre.com> > > Signed-off-by: Johan Hovold <johan@kernel.org> > > --- > > drivers/media/platform/davinci/vpif.c | 11 +++++++++-- > > 1 file changed, 9 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c > > index 9752a5ec36f7..1f5eacf48580 100644 > > --- a/drivers/media/platform/davinci/vpif.c > > +++ b/drivers/media/platform/davinci/vpif.c > > @@ -428,6 +428,7 @@ static int vpif_probe(struct platform_device *pdev) > > static struct resource *res_irq; > > struct platform_device *pdev_capture, *pdev_display; > > struct device_node *endpoint = NULL; > > + int ret; > > > > vpif_base = devm_platform_ioremap_resource(pdev, 0); > > if (IS_ERR(vpif_base)) > > @@ -456,8 +457,8 @@ static int vpif_probe(struct platform_device *pdev) > > res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); > > if (!res_irq) { > > dev_warn(&pdev->dev, "Missing IRQ resource.\n"); > > - pm_runtime_put(&pdev->dev); > Maybe just add pm_runtime_disable(&pdev->dev); here, rest diff won't > be required. I chose to do it this way in order to make the following patches smaller and easier to review. Thanks for reviewing. Johan
diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c index 9752a5ec36f7..1f5eacf48580 100644 --- a/drivers/media/platform/davinci/vpif.c +++ b/drivers/media/platform/davinci/vpif.c @@ -428,6 +428,7 @@ static int vpif_probe(struct platform_device *pdev) static struct resource *res_irq; struct platform_device *pdev_capture, *pdev_display; struct device_node *endpoint = NULL; + int ret; vpif_base = devm_platform_ioremap_resource(pdev, 0); if (IS_ERR(vpif_base)) @@ -456,8 +457,8 @@ static int vpif_probe(struct platform_device *pdev) res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); if (!res_irq) { dev_warn(&pdev->dev, "Missing IRQ resource.\n"); - pm_runtime_put(&pdev->dev); - return -EINVAL; + ret = -EINVAL; + goto err_put_rpm; } pdev_capture = devm_kzalloc(&pdev->dev, sizeof(*pdev_capture), @@ -491,6 +492,12 @@ static int vpif_probe(struct platform_device *pdev) } return 0; + +err_put_rpm: + pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + + return ret; } static int vpif_remove(struct platform_device *pdev)
Make sure to disable runtime PM before returning on probe errors. Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support") Cc: stable@vger.kernel.org # 4.12: 4024d6f601e3c Cc: Kevin Hilman <khilman@baylibre.com> Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/media/platform/davinci/vpif.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)