* [PATCH v2] staging: media: meson: vdec: propagate devm_clk_get() errors
@ 2026-07-14 14:04 ` Alfie Varghese
0 siblings, 0 replies; 7+ messages in thread
From: Alfie Varghese @ 2026-07-14 14:04 UTC (permalink / raw)
To: neil.armstrong
Cc: gregkh, linux-media, linux-staging, linux-kernel, linux-amlogic,
dan.carpenter, error27, alfievarghese22
vdec_probe() hardcodes -EPROBE_DEFER for all devm_clk_get() failures.
This masks the actual error code returned by the clock framework, such
as -ENOENT when a clock is not registered or -ENOMEM on allocation
failure.
Return PTR_ERR() instead to propagate the real error to the caller.
Fixes: 4f75e7dfa6dc ("media: meson: vdec: add driver")
Signed-off-by: Alfie Varghese <alfievarghese22@gmail.com>
---
drivers/staging/media/meson/vdec/vdec.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index a039d925c0fe..fba1e7f88d81 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -1026,24 +1026,24 @@ static int vdec_probe(struct platform_device *pdev)
core->platform->revision == VDEC_REVISION_SM1) {
core->vdec_hevcf_clk = devm_clk_get(dev, "vdec_hevcf");
if (IS_ERR(core->vdec_hevcf_clk))
- return -EPROBE_DEFER;
+ return PTR_ERR(core->vdec_hevcf_clk);
}
core->dos_parser_clk = devm_clk_get(dev, "dos_parser");
if (IS_ERR(core->dos_parser_clk))
- return -EPROBE_DEFER;
+ return PTR_ERR(core->dos_parser_clk);
core->dos_clk = devm_clk_get(dev, "dos");
if (IS_ERR(core->dos_clk))
- return -EPROBE_DEFER;
+ return PTR_ERR(core->dos_clk);
core->vdec_1_clk = devm_clk_get(dev, "vdec_1");
if (IS_ERR(core->vdec_1_clk))
- return -EPROBE_DEFER;
+ return PTR_ERR(core->vdec_1_clk);
core->vdec_hevc_clk = devm_clk_get(dev, "vdec_hevc");
if (IS_ERR(core->vdec_hevc_clk))
- return -EPROBE_DEFER;
+ return PTR_ERR(core->vdec_hevc_clk);
irq = platform_get_irq_byname(pdev, "vdec");
if (irq < 0)
--
2.54.0.windows.1
_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH v2] staging: media: meson: vdec: propagate devm_clk_get() errors
2026-07-14 14:04 ` Alfie Varghese
@ 2026-07-14 14:28 ` Nicolas Dufresne
-1 siblings, 0 replies; 7+ messages in thread
From: Nicolas Dufresne @ 2026-07-14 14:28 UTC (permalink / raw)
To: Alfie Varghese, neil.armstrong
Cc: gregkh, linux-media, linux-staging, linux-kernel, linux-amlogic,
dan.carpenter, error27
[-- Attachment #1.1: Type: text/plain, Size: 2003 bytes --]
Le mardi 14 juillet 2026 à 19:34 +0530, Alfie Varghese a écrit :
> vdec_probe() hardcodes -EPROBE_DEFER for all devm_clk_get() failures.
> This masks the actual error code returned by the clock framework, such
> as -ENOENT when a clock is not registered or -ENOMEM on allocation
> failure.
>
> Return PTR_ERR() instead to propagate the real error to the caller.
>
> Fixes: 4f75e7dfa6dc ("media: meson: vdec: add driver")
> Signed-off-by: Alfie Varghese <alfievarghese22@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
> ---
> drivers/staging/media/meson/vdec/vdec.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
> index a039d925c0fe..fba1e7f88d81 100644
> --- a/drivers/staging/media/meson/vdec/vdec.c
> +++ b/drivers/staging/media/meson/vdec/vdec.c
> @@ -1026,24 +1026,24 @@ static int vdec_probe(struct platform_device *pdev)
> core->platform->revision == VDEC_REVISION_SM1) {
> core->vdec_hevcf_clk = devm_clk_get(dev, "vdec_hevcf");
> if (IS_ERR(core->vdec_hevcf_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->vdec_hevcf_clk);
> }
>
> core->dos_parser_clk = devm_clk_get(dev, "dos_parser");
> if (IS_ERR(core->dos_parser_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->dos_parser_clk);
>
> core->dos_clk = devm_clk_get(dev, "dos");
> if (IS_ERR(core->dos_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->dos_clk);
>
> core->vdec_1_clk = devm_clk_get(dev, "vdec_1");
> if (IS_ERR(core->vdec_1_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->vdec_1_clk);
>
> core->vdec_hevc_clk = devm_clk_get(dev, "vdec_hevc");
> if (IS_ERR(core->vdec_hevc_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->vdec_hevc_clk);
>
> irq = platform_get_irq_byname(pdev, "vdec");
> if (irq < 0)
[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
[-- Attachment #2: Type: text/plain, Size: 167 bytes --]
_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] staging: media: meson: vdec: propagate devm_clk_get() errors
@ 2026-07-14 14:28 ` Nicolas Dufresne
0 siblings, 0 replies; 7+ messages in thread
From: Nicolas Dufresne @ 2026-07-14 14:28 UTC (permalink / raw)
To: Alfie Varghese, neil.armstrong
Cc: gregkh, linux-media, linux-staging, linux-kernel, linux-amlogic,
dan.carpenter, error27
[-- Attachment #1: Type: text/plain, Size: 2003 bytes --]
Le mardi 14 juillet 2026 à 19:34 +0530, Alfie Varghese a écrit :
> vdec_probe() hardcodes -EPROBE_DEFER for all devm_clk_get() failures.
> This masks the actual error code returned by the clock framework, such
> as -ENOENT when a clock is not registered or -ENOMEM on allocation
> failure.
>
> Return PTR_ERR() instead to propagate the real error to the caller.
>
> Fixes: 4f75e7dfa6dc ("media: meson: vdec: add driver")
> Signed-off-by: Alfie Varghese <alfievarghese22@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
> ---
> drivers/staging/media/meson/vdec/vdec.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
> index a039d925c0fe..fba1e7f88d81 100644
> --- a/drivers/staging/media/meson/vdec/vdec.c
> +++ b/drivers/staging/media/meson/vdec/vdec.c
> @@ -1026,24 +1026,24 @@ static int vdec_probe(struct platform_device *pdev)
> core->platform->revision == VDEC_REVISION_SM1) {
> core->vdec_hevcf_clk = devm_clk_get(dev, "vdec_hevcf");
> if (IS_ERR(core->vdec_hevcf_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->vdec_hevcf_clk);
> }
>
> core->dos_parser_clk = devm_clk_get(dev, "dos_parser");
> if (IS_ERR(core->dos_parser_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->dos_parser_clk);
>
> core->dos_clk = devm_clk_get(dev, "dos");
> if (IS_ERR(core->dos_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->dos_clk);
>
> core->vdec_1_clk = devm_clk_get(dev, "vdec_1");
> if (IS_ERR(core->vdec_1_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->vdec_1_clk);
>
> core->vdec_hevc_clk = devm_clk_get(dev, "vdec_hevc");
> if (IS_ERR(core->vdec_hevc_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->vdec_hevc_clk);
>
> irq = platform_get_irq_byname(pdev, "vdec");
> if (irq < 0)
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] staging: media: meson: vdec: propagate devm_clk_get() errors
2026-07-14 14:04 ` Alfie Varghese
(?)
(?)
@ 2026-07-14 14:37 ` sashiko-bot
-1 siblings, 0 replies; 7+ messages in thread
From: sashiko-bot @ 2026-07-14 14:37 UTC (permalink / raw)
To: Alfie Varghese; +Cc: neil.armstrong, linux-amlogic
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] The interrupt handlers `vdec_isr` and `vdec_threaded_isr` will dereference a NULL `core->cur_sess` if triggered early.
- [High] `meson_canvas_get()` does not establish a device link, leading to a potential Use-After-Free if the canvas driver is unbound.
--
--- Patch [1]: [PATCH v2] staging: media: meson: vdec: propagate devm_clk_get() errors ---
commit 7a1b822824f968330db11f53c7acb92d01abc7a0
Author: Alfie Varghese <alfievarghese22@gmail.com>
staging: media: meson: vdec: propagate devm_clk_get() errors
vdec_probe() hardcodes -EPROBE_DEFER for all devm_clk_get() failures.
This masks the actual error code returned by the clock framework, such
as -ENOENT when a clock is not registered or -ENOMEM on allocation
failure.
> diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
> index a039d925c0fe5..fba1e7f88d81f 100644
> --- a/drivers/staging/media/meson/vdec/vdec.c
> +++ b/drivers/staging/media/meson/vdec/vdec.c
> @@ -1026,24 +1026,24 @@ static int vdec_probe(struct platform_device *pdev)
[Severity: High]
This isn't a bug introduced by this patch, but does the canvas handling
risk a use-after-free?
In vdec_probe(), the driver retrieves the canvas provider via
meson_canvas_get() slightly earlier in the function. Looking at
meson_canvas_get() in meson-canvas.c:
drivers/soc/amlogic/meson-canvas.c:meson_canvas_get() {
...
canvas = dev_get_drvdata(&canvas_pdev->dev);
put_device(&canvas_pdev->dev);
return canvas;
}
Since the device reference is dropped immediately before returning and no
device link is established using device_link_add(), couldn't a user unbind
the amlogic-canvas driver via sysfs, freeing the canvas memory while the
active vdec driver still relies on core->canvas?
> core->platform->revision == VDEC_REVISION_SM1) {
> core->vdec_hevcf_clk = devm_clk_get(dev, "vdec_hevcf");
> if (IS_ERR(core->vdec_hevcf_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->vdec_hevcf_clk);
> }
[ ... ]
> core->vdec_hevc_clk = devm_clk_get(dev, "vdec_hevc");
> if (IS_ERR(core->vdec_hevc_clk))
> - return -EPROBE_DEFER;
> + return PTR_ERR(core->vdec_hevc_clk);
>
> irq = platform_get_irq_byname(pdev, "vdec");
> if (irq < 0)
[Severity: High]
This is a pre-existing issue, but can this code trigger a NULL pointer
dereference in the interrupt handler?
Right after retrieving the IRQ in vdec_probe(), the hardware interrupt is
registered via devm_request_threaded_irq() before explicitly masking
interrupts on the device hardware and before allocating a session.
If the bootloader left the video decoder active, or if a spurious interrupt
fires immediately after registration, vdec_isr() would execute:
drivers/staging/media/meson/vdec/vdec.c:vdec_isr() {
...
sess = core->cur_sess;
sess->last_irq_jiffies = get_jiffies_64();
...
}
Since core->cur_sess remains NULL until a userspace client opens the device
and starts streaming, wouldn't this crash the kernel? Is it possible to
disable hardware interrupts prior to IRQ registration, or check for a NULL
session in the ISR?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260714140458.1276-1-alfievarghese22@gmail.com?part=1
_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] staging: media: meson: vdec: propagate devm_clk_get() errors
2026-07-14 14:04 ` Alfie Varghese
@ 2026-07-14 14:48 ` Dan Carpenter
-1 siblings, 0 replies; 7+ messages in thread
From: Dan Carpenter @ 2026-07-14 14:48 UTC (permalink / raw)
To: Alfie Varghese
Cc: neil.armstrong, gregkh, linux-media, linux-staging, linux-kernel,
linux-amlogic, dan.carpenter
On Tue, Jul 14, 2026 at 07:34:58PM +0530, Alfie Varghese wrote:
> vdec_probe() hardcodes -EPROBE_DEFER for all devm_clk_get() failures.
> This masks the actual error code returned by the clock framework, such
> as -ENOENT when a clock is not registered or -ENOMEM on allocation
> failure.
>
> Return PTR_ERR() instead to propagate the real error to the caller.
>
> Fixes: 4f75e7dfa6dc ("media: meson: vdec: add driver")
> Signed-off-by: Alfie Varghese <alfievarghese22@gmail.com>
> ---
Thanks!
Reviewed-by: Dan Carpenter <error27@gmail.com>
regards,
dan carpenter
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] staging: media: meson: vdec: propagate devm_clk_get() errors
@ 2026-07-14 14:48 ` Dan Carpenter
0 siblings, 0 replies; 7+ messages in thread
From: Dan Carpenter @ 2026-07-14 14:48 UTC (permalink / raw)
To: Alfie Varghese
Cc: neil.armstrong, gregkh, linux-media, linux-staging, linux-kernel,
linux-amlogic, dan.carpenter
On Tue, Jul 14, 2026 at 07:34:58PM +0530, Alfie Varghese wrote:
> vdec_probe() hardcodes -EPROBE_DEFER for all devm_clk_get() failures.
> This masks the actual error code returned by the clock framework, such
> as -ENOENT when a clock is not registered or -ENOMEM on allocation
> failure.
>
> Return PTR_ERR() instead to propagate the real error to the caller.
>
> Fixes: 4f75e7dfa6dc ("media: meson: vdec: add driver")
> Signed-off-by: Alfie Varghese <alfievarghese22@gmail.com>
> ---
Thanks!
Reviewed-by: Dan Carpenter <error27@gmail.com>
regards,
dan carpenter
_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic
^ permalink raw reply [flat|nested] 7+ messages in thread