lkml.org 
[lkml]   [2022]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 0296/1017] media: meson: vdec: potential dereference of null pointer
    Date
    From: Jiasheng Jiang <jiasheng@iscas.ac.cn>

    [ Upstream commit c8c80c996182239ff9b05eda4db50184cf3b2e99 ]

    As the possible failure of the kzalloc(), the 'new_ts' could be NULL
    pointer.
    Therefore, it should be better to check it in order to avoid the
    dereference of the NULL pointer.
    Also, the caller esparser_queue() needs to deal with the return value of
    the amvdec_add_ts().

    Fixes: 876f123b8956 ("media: meson: vdec: bring up to compliance")
    Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
    Suggested-by: Neil Armstrong <narmstrong@baylibre.com>
    Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/staging/media/meson/vdec/esparser.c | 7 ++++++-
    drivers/staging/media/meson/vdec/vdec_helpers.c | 8 ++++++--
    drivers/staging/media/meson/vdec/vdec_helpers.h | 4 ++--
    3 files changed, 14 insertions(+), 5 deletions(-)

    diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/media/meson/vdec/esparser.c
    index db7022707ff8..86ccc8937afc 100644
    --- a/drivers/staging/media/meson/vdec/esparser.c
    +++ b/drivers/staging/media/meson/vdec/esparser.c
    @@ -328,7 +328,12 @@ esparser_queue(struct amvdec_session *sess, struct vb2_v4l2_buffer *vbuf)

    offset = esparser_get_offset(sess);

    - amvdec_add_ts(sess, vb->timestamp, vbuf->timecode, offset, vbuf->flags);
    + ret = amvdec_add_ts(sess, vb->timestamp, vbuf->timecode, offset, vbuf->flags);
    + if (ret) {
    + v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR);
    + return ret;
    + }
    +
    dev_dbg(core->dev, "esparser: ts = %llu pld_size = %u offset = %08X flags = %08X\n",
    vb->timestamp, payload_size, offset, vbuf->flags);

    diff --git a/drivers/staging/media/meson/vdec/vdec_helpers.c b/drivers/staging/media/meson/vdec/vdec_helpers.c
    index b9125c295d1d..06fd66539797 100644
    --- a/drivers/staging/media/meson/vdec/vdec_helpers.c
    +++ b/drivers/staging/media/meson/vdec/vdec_helpers.c
    @@ -227,13 +227,16 @@ int amvdec_set_canvases(struct amvdec_session *sess,
    }
    EXPORT_SYMBOL_GPL(amvdec_set_canvases);

    -void amvdec_add_ts(struct amvdec_session *sess, u64 ts,
    - struct v4l2_timecode tc, u32 offset, u32 vbuf_flags)
    +int amvdec_add_ts(struct amvdec_session *sess, u64 ts,
    + struct v4l2_timecode tc, u32 offset, u32 vbuf_flags)
    {
    struct amvdec_timestamp *new_ts;
    unsigned long flags;

    new_ts = kzalloc(sizeof(*new_ts), GFP_KERNEL);
    + if (!new_ts)
    + return -ENOMEM;
    +
    new_ts->ts = ts;
    new_ts->tc = tc;
    new_ts->offset = offset;
    @@ -242,6 +245,7 @@ void amvdec_add_ts(struct amvdec_session *sess, u64 ts,
    spin_lock_irqsave(&sess->ts_spinlock, flags);
    list_add_tail(&new_ts->list, &sess->timestamps);
    spin_unlock_irqrestore(&sess->ts_spinlock, flags);
    + return 0;
    }
    EXPORT_SYMBOL_GPL(amvdec_add_ts);

    diff --git a/drivers/staging/media/meson/vdec/vdec_helpers.h b/drivers/staging/media/meson/vdec/vdec_helpers.h
    index 88137d15aa3a..4bf3e61d081b 100644
    --- a/drivers/staging/media/meson/vdec/vdec_helpers.h
    +++ b/drivers/staging/media/meson/vdec/vdec_helpers.h
    @@ -56,8 +56,8 @@ void amvdec_dst_buf_done_offset(struct amvdec_session *sess,
    * @offset: offset in the VIFIFO where the associated packet was written
    * @flags: the vb2_v4l2_buffer flags
    */
    -void amvdec_add_ts(struct amvdec_session *sess, u64 ts,
    - struct v4l2_timecode tc, u32 offset, u32 flags);
    +int amvdec_add_ts(struct amvdec_session *sess, u64 ts,
    + struct v4l2_timecode tc, u32 offset, u32 flags);
    void amvdec_remove_ts(struct amvdec_session *sess, u64 ts);

    /**
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-04-05 14:32    [W:4.023 / U:0.704 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site