From patchwork Thu Mar 14 05:03:44 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kangjie Lu X-Patchwork-Id: 10852135 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9388F6C2 for ; Thu, 14 Mar 2019 05:04:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7A29A29A62 for ; Thu, 14 Mar 2019 05:04:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6B6A129CEF; Thu, 14 Mar 2019 05:04:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 0493D29A93 for ; Thu, 14 Mar 2019 05:04:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=cAbgld0e8OIS6lCcO+RJGK+qq5ooULOrnnqdbvfyqT8=; b=u/2aXOIESi7jRcKLRWYFbWPb68 vyByNVY0aJ0IztmSfryr1x2Jt1U3eDM/BvNoI2LQ+U0GnWFYQ36b38wvRoEKMSRHSTEplh0oBDpcL aYwlXpo3pcgZGc6KZb/X9kwavlkzb9Wcs/k2fs3Xmh2K4vgLERRLrwW4kE+mOJ5aMsHpjg7ICEJEA eRxDwB0RTSuxbLFhJCH6p9jUyh4qMYmT8nDcu+IxPHH2J1DnCjnuBc5EAugHTT1BtZEoVWmqNqNbr HTh2uqAtnUNB3hyQ2Gtshv9K+8pBE+T7hrcsCR6dkCxv2ghAU6zs7oq2+KKabUXhrA1FS6FT/e+ld tL+SGgig==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1h4IX6-0001qM-4G; Thu, 14 Mar 2019 05:03:56 +0000 Received: from mta-p7.oit.umn.edu ([134.84.196.207]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1h4IX3-0001pe-15 for linux-rockchip@lists.infradead.org; Thu, 14 Mar 2019 05:03:54 +0000 Received: from localhost (unknown [127.0.0.1]) by mta-p7.oit.umn.edu (Postfix) with ESMTP id 37199B02 for ; Thu, 14 Mar 2019 05:03:52 +0000 (UTC) X-Virus-Scanned: amavisd-new at umn.edu Received: from mta-p7.oit.umn.edu ([127.0.0.1]) by localhost (mta-p7.oit.umn.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EIoFMDw1QrGu for ; Thu, 14 Mar 2019 00:03:52 -0500 (CDT) Received: from mail-io1-f71.google.com (mail-io1-f71.google.com [209.85.166.71]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta-p7.oit.umn.edu (Postfix) with ESMTPS id 007EEAEF for ; Thu, 14 Mar 2019 00:03:52 -0500 (CDT) Received: by mail-io1-f71.google.com with SMTP id 68so3357701iov.7 for ; Wed, 13 Mar 2019 22:03:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=umn.edu; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=6wTZ28phD5H5Nm9ztxpdzsm6xuR9rHIlsvJgNcIGMFQ=; b=EMRxK/nhAXuWpYA3J/OuPmeHwja9NtuHrdrIwZi0lqCj/txu4A4S1qMCqOLhT7G8nU g8jzKgaYRO4OFVfsnCjjB8XH+Q9MYFfV0IkuNnmZ5nL6PVAjIa3PETidRoYOuZYAhIxv P+n+8+ndbbIWmCIOWT4a1Kd15P9Ry4FMbyeQ/taYWCYjXNRn3m8bdv7ujOjghxV2Pkl6 ZDhZrA0YwG1qgqL9lY1IIdTRZ7ElUEsswOcibLGPTV+HxR2gNrFgmXQF02DOmA3EmGZY fnI6rFOZ4cMdDJb4uMx/gyRfuuqkaTkYcIl83rwokQymdEsUUWuMIliVilfngwwlSIVs vcGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=6wTZ28phD5H5Nm9ztxpdzsm6xuR9rHIlsvJgNcIGMFQ=; b=DN+AlgOR6DLTMDEhzIdqgRzt/GO9joeDe8fyiqo0hDpG5V9yv9cR09G/3sOthViR+Q oUQflvNd47Poa4v4TqceTxEZsWIBcWopeIFxfhHa7951muMlXqgEn9s4Q2hWiGvdJ4Ez KQAjRlReSLInC23REjhS4fg6rheJ76W3vkUL1jt30EMgMFFKF8sWzZSy/uX9P1vN/1BM a2+Pr1Jk19F8V2miNnHETVVG/po/BvYV+I1N500w+66MyGU2TGjJJlMFtTDl6og15bQ5 VpM6eiyFJqCkbS4iIxXzcFx88mFYCwcFk7PKdO6JjDRaE96+P8jq/ukk+09jGGfs3LdC HwUg== X-Gm-Message-State: APjAAAXmEnV0OUQWb6+P3G5DWYzO4fpGc+DDo2utqiCscgEKURBeu0/l NxJAf6S3s7TauXx6WIBQCps2Wl8bdAUt0kM+Tmcg3HoGLDpblx0RK76lVFCuA6Ud2H2j7kG6bOl oDX65uMAhIJ+qNf4YdU+ObVgIFv26sJja0Om0 X-Received: by 2002:a24:4650:: with SMTP id j77mr994442itb.6.1552539831605; Wed, 13 Mar 2019 22:03:51 -0700 (PDT) X-Google-Smtp-Source: APXvYqxdE/kGCSXJXdCdl99ka4Ci9GdEmTkYJkI3muOhy0yHBSp6TjUeum+o2ZBJAVPyc0riinNmTA== X-Received: by 2002:a24:4650:: with SMTP id j77mr994432itb.6.1552539831282; Wed, 13 Mar 2019 22:03:51 -0700 (PDT) Received: from bee.dtc.umn.edu (cs-bee-u.cs.umn.edu. [128.101.106.63]) by smtp.gmail.com with ESMTPSA id f26sm4593802ioh.55.2019.03.13.22.03.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 13 Mar 2019 22:03:50 -0700 (PDT) From: Kangjie Lu To: kjlu@umn.edu Subject: [PATCH v3] media: rga: fix NULL pointer dereferences, use-after-free, memory leak Date: Thu, 14 Mar 2019 00:03:44 -0500 Message-Id: <20190314050344.29790-1-kjlu@umn.edu> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190313_220353_157941_9361358D X-CRM114-Status: GOOD ( 13.31 ) X-BeenThere: linux-rockchip@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Upstream kernel work for Rockchip platforms List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Heiko Stuebner , Jacob chen , linux-kernel@vger.kernel.org, linux-rockchip@lists.infradead.org, pakki001@umn.edu, Mauro Carvalho Chehab , linux-arm-kernel@lists.infradead.org, linux-media@vger.kernel.org MIME-Version: 1.0 Sender: "Linux-rockchip" Errors-To: linux-rockchip-bounces+patchwork-linux-rockchip=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP 1. dma_alloc_attrs, __get_free_pages can fail and return NULL. Further uses of their return values lead to NULL pointer dereferences 2. In the error-handling path, video_unregister_device uses "rga->vfd" which has been freed by video_device_release 3. The error handling for v4l2_m2m_init and video_register_device has memory-leak issues The patch fixes the above issues. Signed-off-by: Kangjie Lu Reviewed-by: Steven Price --- drivers/media/platform/rockchip/rga/rga.c | 26 ++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c index 5c653287185f..468365ceb99d 100644 --- a/drivers/media/platform/rockchip/rga/rga.c +++ b/drivers/media/platform/rockchip/rga/rga.c @@ -889,11 +889,24 @@ static int rga_probe(struct platform_device *pdev) rga->cmdbuf_virt = dma_alloc_attrs(rga->dev, RGA_CMDBUF_SIZE, &rga->cmdbuf_phy, GFP_KERNEL, DMA_ATTR_WRITE_COMBINE); + if (!rga->cmdbuf_virt) { + ret = -ENOMEM; + goto unreg_video_dev; + } rga->src_mmu_pages = (unsigned int *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 3); + if (!rga->src_mmu_pages) { + ret = -ENOMEM; + goto free_dma_attrs; + } + rga->dst_mmu_pages = (unsigned int *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 3); + if (!rga->dst_mmu_pages) { + ret = -ENOMEM; + goto free_dst_pages; + } def_frame.stride = (def_frame.width * def_frame.fmt->depth) >> 3; def_frame.size = def_frame.stride * def_frame.height; @@ -901,7 +914,7 @@ static int rga_probe(struct platform_device *pdev) ret = video_register_device(vfd, VFL_TYPE_GRABBER, -1); if (ret) { v4l2_err(&rga->v4l2_dev, "Failed to register video device\n"); - goto rel_vdev; + goto free_pages; } v4l2_info(&rga->v4l2_dev, "Registered %s as /dev/%s\n", @@ -909,10 +922,17 @@ static int rga_probe(struct platform_device *pdev) return 0; -rel_vdev: - video_device_release(vfd); +free_pages: + free_pages((unsigned long)rga->src_mmu_pages, 3); +free_dst_pages: + free_pages((unsigned long)rga->dst_mmu_pages, 3); +free_dma_attrs: + dma_free_attrs(rga->dev, RGA_CMDBUF_SIZE, rga->cmdbuf_virt, + rga->cmdbuf_phy, + DMA_ATTR_WRITE_COMBINE); unreg_video_dev: video_unregister_device(rga->vfd); + video_device_release(vfd); unreg_v4l2_dev: v4l2_device_unregister(&rga->v4l2_dev); err_put_clk: