[PATCH 10/13] media: imx7-media-csi: Don't use GFP_DMA when calling dma_alloc_coherent()

[PATCH 10/13] media: imx7-media-csi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: imx@lists.linux.dev
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/media/platform/nxp/imx7-media-csi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/nxp/imx7-media-csi.c b/drivers/media/platform/nxp/imx7-media-csi.c
index 7ddc7ba06e3d..22c0cbdc92bf 100644
--- a/drivers/media/platform/nxp/imx7-media-csi.c
+++ b/drivers/media/platform/nxp/imx7-media-csi.c
@@ -466,7 +466,7 @@ static int imx7_csi_alloc_dma_buf(struct imx7_csi *csi,
 
 	buf->len = PAGE_ALIGN(size);
 	buf->virt = dma_alloc_coherent(csi->dev, buf->len, &buf->dma_addr,
-				       GFP_DMA | GFP_KERNEL);
+				       GFP_KERNEL);
 	if (!buf->virt)
 		return -ENOMEM;
 
-- 
2.54.0

[PATCH 11/13] media: nxp: imx8-isi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: imx@lists.linux.dev
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
index f45c2aae59ce..fc907d357149 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
@@ -773,7 +773,7 @@ static int mxc_isi_video_alloc_discard_buffers(struct mxc_isi_video *video)
 
 		buf->size = PAGE_ALIGN(video->pix.plane_fmt[i].sizeimage);
 		buf->addr = dma_alloc_coherent(video->pipe->isi->dev, buf->size,
-					       &buf->dma, GFP_DMA | GFP_KERNEL);
+					       &buf->dma, GFP_KERNEL);
 		if (!buf->addr) {
 			mxc_isi_video_free_discard_buffers(video);
 			return -ENOMEM;
-- 
2.54.0

Re: [PATCH 10/13] media: imx7-media-csi: Don't use GFP_DMA when calling dma_alloc_coherent()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Integer overflow in `sizeimage` calculation and signedness truncation in `imx7_csi_alloc_dma_buf()` allow userspace to trigger a massive out-of-bounds DMA write, corrupting kernel memory.
--

commit 007baffc77bd7059db343099782a06610465cf12
Author: Baoquan He <hebaoquan@kylinos.cn>
Subject: media: imx7-media-csi: Don't use GFP_DMA when calling dma_alloc_coherent()

This commit removes the redundant GFP_DMA flag from the dma_alloc_coherent()
call in imx7_csi_alloc_dma_buf(). The DMA core already handles device
addressing limitations and ignores GFP_DMA.

> diff --git a/drivers/media/platform/nxp/imx7-media-csi.c b/drivers/media/platform/nxp/imx7-media-csi.c
> index 7ddc7ba06e3d4..22c0cbdc92bfb 100644
> --- a/drivers/media/platform/nxp/imx7-media-csi.c
> +++ b/drivers/media/platform/nxp/imx7-media-csi.c
> @@ -466,7 +466,7 @@ static int imx7_csi_alloc_dma_buf(struct imx7_csi *csi,
>  
>  	buf->len = PAGE_ALIGN(size);
>  	buf->virt = dma_alloc_coherent(csi->dev, buf->len, &buf->dma_addr,
> -				       GFP_DMA | GFP_KERNEL);
> +				       GFP_KERNEL);
[Severity: Critical]
This isn't a bug introduced by this patch, but could this allocation lead to
arbitrary kernel memory corruption?

The size parameter in imx7_csi_alloc_dma_buf() is a signed int. This allows
large unsigned 32-bit sizeimage values (e.g., between 2 GB and 4 GB) to be
interpreted as negative, subverting the PAGE_ALIGN macro.

This seems to be reachable from userspace because imx7_csi_try_fmt() lacks
bounds checking for width and height in the IMX7_CSI_PAD_SINK case:

drivers/media/platform/nxp/imx7-media-csi.c:imx7_csi_try_fmt() {
    ...
    case IMX7_CSI_PAD_SINK:
        *cc = imx7_csi_find_mbus_format(sdformat->format.code);
    ...
}

This allows massive dimensions to bypass validation. When passed to
__imx7_csi_video_try_fmt(), the 32-bit multiplication overflows without
prior bounds checking on the total pixel volume:

drivers/media/platform/nxp/imx7-media-csi.c:__imx7_csi_video_try_fmt() {
    ...
    pixfmt->sizeimage = pixfmt->bytesperline * pixfmt->height;
    ...
}

If a user calls VIDIOC_S_FMT with large dimensions (e.g., width=32896,
height=65281, and a 16-bpp format), the product wraps around modulo 2^32,
producing a very small positive sizeimage, or a negative size when passed
as a signed int to imx7_csi_alloc_dma_buf().

As a result, a tiny buffer is allocated here, but the CSI hardware could
capture the massive frame and DMA up to 4 GB of data into it, seamlessly
crossing the buffer boundary.

>  	if (!buf->virt)
>  		return -ENOMEM;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903111836.1777265-1-hebaoquan@kylinos.cn?part=10

Re: [PATCH 11/13] media: nxp: imx8-isi: Don't use GFP_DMA when calling dma_alloc_coherent()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Teardown symmetry violation in `mxc_isi_remove()` causing a NULL pointer dereference / Use-After-Free.
--

commit 846491721093e7e929fd40da0be5709669dc9e9f
Author: Baoquan He <hebaoquan@kylinos.cn>

media: nxp: imx8-isi: Don't use GFP_DMA when calling dma_alloc_coherent()

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind. The DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
This commit removes the redundant GFP_DMA flag.

> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> index f45c2aae59ce9..fc907d357149e 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> @@ -773,7 +773,7 @@ static int mxc_isi_video_alloc_discard_buffers(struct mxc_isi_video *video)
>  
>  		buf->size = PAGE_ALIGN(video->pix.plane_fmt[i].sizeimage);
>  		buf->addr = dma_alloc_coherent(video->pipe->isi->dev, buf->size,
> -					       &buf->dma, GFP_DMA | GFP_KERNEL);
> +					       &buf->dma, GFP_KERNEL);
>  		if (!buf->addr) {
>  			mxc_isi_video_free_discard_buffers(video);
>  			return -ENOMEM;

[Severity: High]
This isn't a bug introduced by this patch, but looking at the teardown
sequence in drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:

drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:mxc_isi_remove() {
	...
	for (i = 0; i < isi->pdata->num_channels; ++i) {
		struct mxc_isi_pipe *pipe = &isi->pipes[i];

		mxc_isi_pipe_cleanup(pipe);
	}

	mxc_isi_v4l2_cleanup(isi);
	...
}

Does this code have a teardown symmetry violation causing a use-after-free or
NULL pointer dereference?

mxc_isi_pipe_cleanup(pipe) is called before mxc_isi_v4l2_cleanup(isi), freeing
the subdevice active state and setting it to NULL before the user-space
interfaces are unregistered.

Because mxc_isi_v4l2_cleanup() has not yet run, the video device nodes are
still fully registered.

Could a concurrent ioctl from user-space, such as VIDIOC_STREAMON, call
mxc_isi_vb2_prepare_streaming() -> mxc_isi_pipe_acquire() ->
v4l2_subdev_lock_and_get_active_state() and dereference the now-NULL
active_state?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903111836.1777265-1-hebaoquan@kylinos.cn?part=11

Re: [PATCH 11/13] media: nxp: imx8-isi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Frank Li]

On Thu, Sep 03, 2026 at 07:18:34PM +0800, Baoquan He wrote:
> [You don't often get email from hebaoquan@kylinos.cn. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> dma_alloc_coherent() allocates the DMA buffer with the device's
> addressing limitation in mind; the DMA core picks the zone from the
> device's coherent DMA mask and ignores GFP_DMA passed by the caller.
> Remove the redundant GFP_DMA flag.
>
> Cc: imx@lists.linux.dev
> Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> index f45c2aae59ce..fc907d357149 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> @@ -773,7 +773,7 @@ static int mxc_isi_video_alloc_discard_buffers(struct mxc_isi_video *video)
>
>                 buf->size = PAGE_ALIGN(video->pix.plane_fmt[i].sizeimage);
>                 buf->addr = dma_alloc_coherent(video->pipe->isi->dev, buf->size,
> -                                              &buf->dma, GFP_DMA | GFP_KERNEL);
> +                                              &buf->dma, GFP_KERNEL);
>                 if (!buf->addr) {
>                         mxc_isi_video_free_discard_buffers(video);
>                         return -ENOMEM;
> --
> 2.54.0
>
>

Re: [PATCH 10/13] media: imx7-media-csi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Frank Li]

On Thu, Sep 03, 2026 at 07:18:33PM +0800, Baoquan He wrote:
> [You don't often get email from hebaoquan@kylinos.cn. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> dma_alloc_coherent() allocates the DMA buffer with the device's
> addressing limitation in mind; the DMA core picks the zone from the
> device's coherent DMA mask and ignores GFP_DMA passed by the caller.
> Remove the redundant GFP_DMA flag.
>
> Cc: imx@lists.linux.dev
> Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/media/platform/nxp/imx7-media-csi.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/nxp/imx7-media-csi.c b/drivers/media/platform/nxp/imx7-media-csi.c
> index 7ddc7ba06e3d..22c0cbdc92bf 100644
> --- a/drivers/media/platform/nxp/imx7-media-csi.c
> +++ b/drivers/media/platform/nxp/imx7-media-csi.c
> @@ -466,7 +466,7 @@ static int imx7_csi_alloc_dma_buf(struct imx7_csi *csi,
>
>         buf->len = PAGE_ALIGN(size);
>         buf->virt = dma_alloc_coherent(csi->dev, buf->len, &buf->dma_addr,
> -                                      GFP_DMA | GFP_KERNEL);
> +                                      GFP_KERNEL);
>         if (!buf->virt)
>                 return -ENOMEM;
>
> --
> 2.54.0
>
>