Re: [PATCH 10/17] media: rockchip: rga: move rockchip_rga allocation to master probe

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing IS_ERR() check on the `match` pointer after `component_match_add_release()` can lead to a kernel panic.
--

commit 7be0968d7d9ce3f1b58fa4c450d0c7a606ff6014
Author: Sven Püschel <s.pueschel@pengutronix.de>

media: rockchip: rga: move rockchip_rga allocation to master probe

Move the rockchip_rga struct allocation to the master component probe
function in preparation of enabling all cores. This also adjusts the
allocation to use the actual number of cores found in the of tree
instead of being fixed to one core.

> diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
> index 178f45b8da940..11912bf5b6906 100644
> --- a/drivers/media/platform/rockchip/rga/rga.c
> +++ b/drivers/media/platform/rockchip/rga/rga.c

[ ... ]

> @@ -985,6 +977,7 @@ static int rga_probe(struct platform_device *pdev)
>  		of_node_get(core_node);
>  		component_match_add_release(dev, &match, component_release_of,
>  					    component_compare_of, core_node);
> +		num_cores++;
>  
>  		/*
>  		 * As multi core is not implemented yet,
> @@ -1000,6 +993,19 @@ static int rga_probe(struct platform_device *pdev)
>  			dev, -ENODEV,
>  			"no matching available component devices found\n");

[Severity: High]
If component_match_add_release() fails to allocate memory internally, it can
update the match pointer to ERR_PTR(-ENOMEM).

Since this code only checks if (!match), the error pointer bypasses the check
and is passed into component_master_add_with_match() at the end of rga_probe().

Could this lead to an invalid page fault when component_master_add_with_match()
unconditionally dereferences the match pointer?

> +	rga = devm_kzalloc(dev, sizeof(*rga) + num_cores * sizeof(*rga->cores), GFP_KERNEL);
> +	if (!rga)
> +		return -ENOMEM;

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260606-spu-rga3multicore-v1-0-3ec2b15675f7@pengutronix.de?part=10