Linux Samsung SOC development
 help / color / mirror / Atom feed
From: kernel test robot <lkp@intel.com>
To: Lv Yunlong <lyl2019@mail.ustc.edu.cn>,
	s.nawrocki@samsung.com, mchehab@kernel.org, krzk@kernel.org
Cc: kbuild-all@lists.01.org, linux-media@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org,
	linux-samsung-soc@vger.kernel.org, linux-kernel@vger.kernel.org,
	Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Subject: Re: [PATCH] media:exynos4-is: Fix a use after free in isp_video_release
Date: Tue, 27 Apr 2021 13:07:37 +0800	[thread overview]
Message-ID: <202104271335.gNNaJrxh-lkp@intel.com> (raw)
In-Reply-To: <20210427023315.4537-1-lyl2019@mail.ustc.edu.cn>

[-- Attachment #1: Type: text/plain, Size: 4058 bytes --]

Hi Lv,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on linuxtv-media/master]
[also build test ERROR on v5.12 next-20210426]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Lv-Yunlong/media-exynos4-is-Fix-a-use-after-free-in-isp_video_release/20210427-103518
base:   git://linuxtv.org/media_tree.git master
config: m68k-allmodconfig (attached as .config)
compiler: m68k-linux-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/be22db53410320e33e9e471a8a15f14904b5e801
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Lv-Yunlong/media-exynos4-is-Fix-a-use-after-free-in-isp_video_release/20210427-103518
        git checkout be22db53410320e33e9e471a8a15f14904b5e801
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross W=1 ARCH=m68k 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   In file included from include/linux/build_bug.h:5,
                    from include/linux/bits.h:22,
                    from include/linux/bitops.h:6,
                    from drivers/media/platform/exynos4-is/fimc-isp-video.c:14:
   include/linux/scatterlist.h: In function 'sg_set_buf':
   arch/m68k/include/asm/page_mm.h:174:49: warning: ordered comparison of pointer with null pointer [-Wextra]
     174 | #define virt_addr_valid(kaddr) ((void *)(kaddr) >= (void *)PAGE_OFFSET && (void *)(kaddr) < high_memory)
         |                                                 ^~
   include/linux/compiler.h:78:42: note: in definition of macro 'unlikely'
      78 | # define unlikely(x) __builtin_expect(!!(x), 0)
         |                                          ^
   include/linux/scatterlist.h:137:2: note: in expansion of macro 'BUG_ON'
     137 |  BUG_ON(!virt_addr_valid(buf));
         |  ^~~~~~
   include/linux/scatterlist.h:137:10: note: in expansion of macro 'virt_addr_valid'
     137 |  BUG_ON(!virt_addr_valid(buf));
         |          ^~~~~~~~~~~~~~~
   drivers/media/platform/exynos4-is/fimc-isp-video.c: In function 'isp_video_release':
>> drivers/media/platform/exynos4-is/fimc-isp-video.c:318:2: error: 'filp' undeclared (first use in this function); did you mean 'file'?
     318 |  filp->private_data = NULL;
         |  ^~~~
         |  file
   drivers/media/platform/exynos4-is/fimc-isp-video.c:318:2: note: each undeclared identifier is reported only once for each function it appears in


vim +318 drivers/media/platform/exynos4-is/fimc-isp-video.c

   302	
   303	static int isp_video_release(struct file *file)
   304	{
   305		struct fimc_isp *isp = video_drvdata(file);
   306		struct fimc_is_video *ivc = &isp->video_capture;
   307		struct media_entity *entity = &ivc->ve.vdev.entity;
   308		struct media_device *mdev = entity->graph_obj.mdev;
   309	
   310		mutex_lock(&isp->video_lock);
   311	
   312		if (v4l2_fh_is_singular_file(file) && ivc->streaming) {
   313			media_pipeline_stop(entity);
   314			ivc->streaming = 0;
   315		}
   316	
   317		_vb2_fop_release(file, NULL);
 > 318		filp->private_data = NULL;
   319	
   320		if (v4l2_fh_is_singular_file(file)) {
   321			fimc_pipeline_call(&ivc->ve, close);
   322	
   323			mutex_lock(&mdev->graph_mutex);
   324			entity->use_count--;
   325			mutex_unlock(&mdev->graph_mutex);
   326		}
   327	
   328		pm_runtime_put(&isp->pdev->dev);
   329		mutex_unlock(&isp->video_lock);
   330	
   331		return 0;
   332	}
   333	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 59843 bytes --]

      reply	other threads:[~2021-04-27  5:08 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-27  2:33 [PATCH] media:exynos4-is: Fix a use after free in isp_video_release Lv Yunlong
2021-04-27  5:07 ` kernel test robot [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=202104271335.gNNaJrxh-lkp@intel.com \
    --to=lkp@intel.com \
    --cc=kbuild-all@lists.01.org \
    --cc=krzk@kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=linux-samsung-soc@vger.kernel.org \
    --cc=lyl2019@mail.ustc.edu.cn \
    --cc=mchehab@kernel.org \
    --cc=s.nawrocki@samsung.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox