Re: [PATCH v1 1/3] media: sun4i-csi: fix video device and subdev leak in notify_complete()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver embeds `struct video_device` inside a `devm`-managed structure and uses `video_device_release_empty`, causing a Use-After-Free (UAF) vulnerability. This problem wasn't introduced by this patch, but the patch fails to resolve the underlying race condition when unwinding registrations.
- [Medium] Missing `v4l2_async_nf_cleanup()` in the `sun4i_csi_probe()` error path causes a memory and fwnode reference leak of async connections. This problem wasn't introduced by this patch.
--

--- Patch [1]: [PATCH v1 1/3] media: sun4i-csi: fix video device and subdev leak in notify_complete() ---
commit 1bfbebedd93671de734cc0e7671a5f4e99b9ff15
Author: Cong Nguyen <congnt264@gmail.com>

media: sun4i-csi: fix video device and subdev leak in notify_complete()

This patch fixes an issue in sun4i_csi_notify_complete() where the video
device and bridge subdev were left registered if later initialization steps
failed. It unwinds the registrations in reverse order to avoid leaving the
driver in a half-registered state.

> diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c
> index e53a07b770b7e..a8711336a7540 100644
> --- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c
> +++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c

[ ... ]

> @@ -114,6 +114,10 @@ static int sun4i_csi_notify_complete(struct v4l2_async_notifier *notifier)
>  
>  err_clean_media:
>  	media_device_unregister(&csi->mdev);
> +err_unregister_video:
> +	vb2_video_unregister_device(&csi->vdev);

[Severity: High]
This is a pre-existing issue, but could this error handling path lead to a
use-after-free regression if userspace races to open the device?

Because the csi structure is allocated with devm_kzalloc() in
sun4i_csi_probe(), it will be automatically freed when probe fails.
Meanwhile, sun4i_csi_v4l2_register() sets vdev->release to
video_device_release_empty.

If media_device_register() fails, this new error path calls
vb2_video_unregister_device(), which unregisters the sysfs node but cannot
revoke file descriptors if userspace has already opened /dev/videoX.

When the file descriptor is eventually closed, could this lead to a
dereference of the freed csi structure in sun4i_csi_release() and when
the V4L2 core attempts to put the device?

> +err_unregister_subdev:
> +	v4l2_device_unregister_subdev(subdev);
>  
>  	return ret;
>  }

[Severity: Medium]
This isn't a bug introduced by this patch, but does the error path in
sun4i_csi_probe() cause a memory leak regression for async connection
structures and fwnode references?

When sun4i_csi_notifier_init() succeeds, it allocates an async connection
and grabs a fwnode reference. If the subsequent v4l2_async_nf_register()
call fails, the error path exits without calling v4l2_async_nf_cleanup():

drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c:sun4i_csi_probe() {
    ...
err_unregister_media:
	media_device_unregister(&csi->mdev);
    ...
}

Could this result in abandoning those allocations and leaking fwnode
references since the cleanup isn't performed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786184456.git.congnt264@gmail.com?part=1