From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1974C433F5 for ; Tue, 9 Nov 2021 01:02:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A01E060F5A for ; Tue, 9 Nov 2021 01:02:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238151AbhKIBEx (ORCPT ); Mon, 8 Nov 2021 20:04:53 -0500 Received: from mail.kernel.org ([198.145.29.99]:60822 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241683AbhKIBD6 (ORCPT ); Mon, 8 Nov 2021 20:03:58 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id BD3B4613A6; Tue, 9 Nov 2021 01:01:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1636419672; bh=S4LCCpzYJLPe4LBP4YPSi1HqUeJ5icw6ybAi5xgnjM8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Oai3aJfk7LOr1FnDvBNre/W7eD2+ZwxmzgYKRq8/av6f1E7Sx6GrR10BSL4qDOEFH d1BQe+S+3+VceNS04K4YhROsP+1fM5JYDz+o1aI295sLfFsQFejx/jXiZMnsc+6Y40 50LRK4oiYnbWaKTZZeA4p2AWLmHMJnPm6DB/Mwl78BJSWXwj0kyi6mwn1CH+hzWePi xGADI7EHWFpHqdPmY6Z6olY75uFWD3Hj8QOeuJyAhD+VGrtfuEgegOPZAkXFAWfG4G CUPV3gu1ST7WCbe4PFfiizedAvoFwhWFR/RDWKVsVNwNqhIte2wdCgAq5tv9n/UC43 3UR4etyQywc/Q== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Dmitriy Ulitin , Alexey Khoroshilov , Sakari Ailus , Mauro Carvalho Chehab , Sasha Levin , hugues.fruchet@foss.st.com, mchehab@kernel.org, mcoquelin.stm32@gmail.com, alexandre.torgue@foss.st.com, linux-media@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 5.15 041/146] media: stm32: Potential NULL pointer dereference in dcmi_irq_thread() Date: Mon, 8 Nov 2021 12:43:08 -0500 Message-Id: <20211108174453.1187052-41-sashal@kernel.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20211108174453.1187052-1-sashal@kernel.org> References: <20211108174453.1187052-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dmitriy Ulitin [ Upstream commit 548fa43a58696450c15b8f5564e99589c5144664 ] At the moment of enabling irq handling: 1922 ret = devm_request_threaded_irq(&pdev->dev, irq, dcmi_irq_callback, 1923 dcmi_irq_thread, IRQF_ONESHOT, 1924 dev_name(&pdev->dev), dcmi); there is still uninitialized field sd_format of struct stm32_dcmi *dcmi. If an interrupt occurs in the interval between the installation of the interrupt handler and the initialization of this field, NULL pointer dereference happens. This field is dereferenced in the handler function without any check: 457 if (dcmi->sd_format->fourcc == V4L2_PIX_FMT_JPEG && 458 dcmi->misr & IT_FRAME) { The patch moves interrupt handler installation after initialization of the sd_format field that happens in dcmi_graph_notify_complete() via dcmi_set_default_fmt(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Dmitriy Ulitin Signed-off-by: Alexey Khoroshilov Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/platform/stm32/stm32-dcmi.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c index d914ccef98317..6110718645a4f 100644 --- a/drivers/media/platform/stm32/stm32-dcmi.c +++ b/drivers/media/platform/stm32/stm32-dcmi.c @@ -128,6 +128,7 @@ struct stm32_dcmi { int sequence; struct list_head buffers; struct dcmi_buf *active; + int irq; struct v4l2_device v4l2_dev; struct video_device *vdev; @@ -1759,6 +1760,14 @@ static int dcmi_graph_notify_complete(struct v4l2_async_notifier *notifier) return ret; } + ret = devm_request_threaded_irq(dcmi->dev, dcmi->irq, dcmi_irq_callback, + dcmi_irq_thread, IRQF_ONESHOT, + dev_name(dcmi->dev), dcmi); + if (ret) { + dev_err(dcmi->dev, "Unable to request irq %d\n", dcmi->irq); + return ret; + } + return 0; } @@ -1914,6 +1923,8 @@ static int dcmi_probe(struct platform_device *pdev) if (irq <= 0) return irq ? irq : -ENXIO; + dcmi->irq = irq; + dcmi->res = platform_get_resource(pdev, IORESOURCE_MEM, 0); if (!dcmi->res) { dev_err(&pdev->dev, "Could not get resource\n"); @@ -1926,14 +1937,6 @@ static int dcmi_probe(struct platform_device *pdev) return PTR_ERR(dcmi->regs); } - ret = devm_request_threaded_irq(&pdev->dev, irq, dcmi_irq_callback, - dcmi_irq_thread, IRQF_ONESHOT, - dev_name(&pdev->dev), dcmi); - if (ret) { - dev_err(&pdev->dev, "Unable to request irq %d\n", irq); - return ret; - } - mclk = devm_clk_get(&pdev->dev, "mclk"); if (IS_ERR(mclk)) { if (PTR_ERR(mclk) != -EPROBE_DEFER) -- 2.33.0