| Message ID | 20221028125811.11340-1-abelova@astralinux.ru (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | vcodec: mediatek: add check for NULL for vsi->frm_bufs[vsi->new_fb_idx].buf.fb in vp9_swap_frm_bufs | expand |
Hi, Le vendredi 28 octobre 2022 à 15:58 +0300, Anastasia Belova a écrit : > If vsi->frm_bufs[vsi->new_fb_idx].buf.fb == NULL while cleaning > fb_free_list NULL-pointer is dereferenced. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver") > > Signed-off-by: Anastasia Belova <abelova@astralinux.ru> > --- > drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c > index 70b8383f7c8e..b0679aaf6192 100644 > --- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c > +++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c > @@ -512,7 +512,7 @@ static void vp9_swap_frm_bufs(struct vdec_vp9_inst *inst) > * clean fb_free_list > */ > if (vsi->frm_bufs[vsi->new_fb_idx].ref_cnt == 0) { > - if (!vp9_is_sf_ref_fb( > + if (vsi->frm_bufs[vsi->new_fb_idx].buf.fb != NULL && !vp9_is_sf_ref_fb( > inst, vsi->frm_bufs[vsi->new_fb_idx].buf.fb)) { > struct vdec_fb *fb; Perhaps we could try and maintain some readability ? I'd suggest to move the check into vp9_is_sf_ref_fb() as an early return. Nicolas
Il 28/10/22 15:02, Nicolas Dufresne ha scritto: > Hi, > > Le vendredi 28 octobre 2022 à 15:58 +0300, Anastasia Belova a écrit : >> If vsi->frm_bufs[vsi->new_fb_idx].buf.fb == NULL while cleaning >> fb_free_list NULL-pointer is dereferenced. >> >> Found by Linux Verification Center (linuxtesting.org) with SVACE. >> >> Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver") >> >> Signed-off-by: Anastasia Belova <abelova@astralinux.ru> >> --- >> drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c >> index 70b8383f7c8e..b0679aaf6192 100644 >> --- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c >> +++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c >> @@ -512,7 +512,7 @@ static void vp9_swap_frm_bufs(struct vdec_vp9_inst *inst) >> * clean fb_free_list >> */ >> if (vsi->frm_bufs[vsi->new_fb_idx].ref_cnt == 0) { >> - if (!vp9_is_sf_ref_fb( >> + if (vsi->frm_bufs[vsi->new_fb_idx].buf.fb != NULL && !vp9_is_sf_ref_fb( >> inst, vsi->frm_bufs[vsi->new_fb_idx].buf.fb)) { >> struct vdec_fb *fb; > > Perhaps we could try and maintain some readability ? I'd suggest to move the > check into vp9_is_sf_ref_fb() as an early return. > I don't think that this will ever happen, as the check was omitted because of being totally sure that vsi->frm_bufs[vsi->new_fb_idx].buf.fb is not NULL. In any case, it doesn't really cost anything to add a check... in which case, I agree with Nicolas about moving that to vp9_is_sf_ref_fb(). if (!fb) return false for ..... Regards, Angelo
diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c index 70b8383f7c8e..b0679aaf6192 100644 --- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c +++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c @@ -512,7 +512,7 @@ static void vp9_swap_frm_bufs(struct vdec_vp9_inst *inst) * clean fb_free_list */ if (vsi->frm_bufs[vsi->new_fb_idx].ref_cnt == 0) { - if (!vp9_is_sf_ref_fb( + if (vsi->frm_bufs[vsi->new_fb_idx].buf.fb != NULL && !vp9_is_sf_ref_fb( inst, vsi->frm_bufs[vsi->new_fb_idx].buf.fb)) { struct vdec_fb *fb;
If vsi->frm_bufs[vsi->new_fb_idx].buf.fb == NULL while cleaning fb_free_list NULL-pointer is dereferenced. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver") Signed-off-by: Anastasia Belova <abelova@astralinux.ru> --- drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)