Re: [PATCH 4/7] media: rkvdec: vdpu381: Program the read caches

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] media: rkvdec: missing device link for SRAM pool in
  rkvdec_probe() [1]
--

commit 99da5f7b908ec0166f8a92ee5d45147870aca1c8
Author: Daniel Golle <daniel@makrotopia.org>

media: rkvdec: vdpu381: Program the read caches

This commit maps the VDPU381 "cache" register block in rkvdec_probe() and
configures and clears the three read caches before starting each H.264 and
HEVC decode run.

> diff --git a/drivers/media/platform/rockchip/rkvdec/rkvdec.c b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> index ba61e373b4342..5673c5205bfcd 100644
> --- a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> +++ b/drivers/media/platform/rockchip/rkvdec/rkvdec.c

[ ... ]

> @@ -1910,6 +1924,10 @@ static int rkvdec_probe(struct platform_device *pdev)
>  		rkvdec->link = devm_platform_ioremap_resource_byname(pdev, "link");
>  		if (IS_ERR(rkvdec->link))
>  			return PTR_ERR(rkvdec->link);
> +
> +		rkvdec->cache = devm_platform_ioremap_resource_byname(pdev, "cache");
> +		if (IS_ERR(rkvdec->cache))
> +			return PTR_ERR(rkvdec->cache);
>  	}
>  
>  	ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));

[Severity: Critical]
This problem wasn't introduced by this patch, but can unbinding the SRAM
provider cause a use-after-free on rkvdec->sram_pool [1]?

Later in rkvdec_probe(), rkvdec->sram_pool is obtained via
of_gen_pool_get(pdev->dev.of_node, "sram", 0) without creating a device
link to the SRAM provider device.  of_gen_pool_get() drops its device
reference before returning, so if the SRAM provider is unbound, devres
frees the gen_pool while rkvdec retains a dangling pointer that
rkvdec_allocate_rcb() and rkvdec_free_rcb() pass to
gen_pool_dma_zalloc_align() and gen_pool_free().

[1] https://sashiko.dev/#/bug/linux-052dff48-14cb-4d3e-8996-c834344fcb16

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1794654074.git.daniel@makrotopia.org?part=4