Re: [PATCH v3] staging: media: meson: vdec: propagate devm_clk_get() errors

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The driver holds an unpinned pointer to the `amlogic-canvas` provider, leading to a Use-After-Free vulnerability if the canvas driver is unbound.
- [High] The `vdec_isr` and `vdec_threaded_isr` interrupt handlers unconditionally dereference `core->cur_sess`. If an interrupt fires immediately upon registration (e.g., left pending by the bootloader), this will cause a fatal NULL pointer dereference because `core->cur_sess` is initialized to `NULL`.
--

--- Patch [1]: [PATCH v3] staging: media: meson: vdec: propagate devm_clk_get() errors ---
commit 9a8ffbf8f058a33cad3c2292a9632f5eb5e8f843
Author: Alfie Varghese <[email protected]>

staging: media: meson: vdec: propagate devm_clk_get() errors

vdec_probe() hardcodes -EPROBE_DEFER for all devm_clk_get() failures.
This masks the actual error code returned by the clock framework, such
as -ENOENT when a clock is not registered or -ENOMEM on allocation
failure. Return PTR_ERR() instead to propagate the real error to the
caller.

> diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
> index a039d925c0fe5..fba1e7f88d81f 100644
> --- a/drivers/staging/media/meson/vdec/vdec.c
> +++ b/drivers/staging/media/meson/vdec/vdec.c
> @@ -1026,24 +1026,24 @@ static int vdec_probe(struct platform_device *pdev)
[ ... ]
>  	core->vdec_hevc_clk = devm_clk_get(dev, "vdec_hevc");
>  	if (IS_ERR(core->vdec_hevc_clk))
> -		return -EPROBE_DEFER;
> +		return PTR_ERR(core->vdec_hevc_clk);
>  
>  	irq = platform_get_irq_byname(pdev, "vdec");
>  	if (irq < 0)

[Severity: Critical]
This is a pre-existing issue, but earlier in vdec_probe() we store a pointer
to the canvas device:

	core->canvas = meson_canvas_get(dev);

Looking at drivers/soc/amlogic/meson-canvas.c:meson_canvas_get(), the
function drops the reference to the canvas device before returning the
driver data pointer:

	canvas = dev_get_drvdata(&canvas_pdev->dev);
	put_device(&canvas_pdev->dev);
	if (!canvas)
		return ERR_PTR(-EINVAL);

	return canvas;

Since there is no device link and no reference is held, is it possible for
the amlogic-canvas device to be freely unbound via sysfs, freeing the canvas
structure? 

If the vdec driver later attempts a video decoding operation, might it access
the freed memory and result in a use-after-free?

[Severity: High]
This isn't a bug introduced by this patch, but just below the modified code we
request the interrupt without IRQF_NO_AUTOEN:

	ret = devm_request_threaded_irq(core->dev, irq, vdec_isr,
					vdec_threaded_isr, IRQF_ONESHOT,
					"vdec", core);

If there is a pending interrupt left over by the bootloader, it might fire
immediately upon registration. The interrupt handler vdec_isr()
unconditionally dereferences core->cur_sess:

	struct amvdec_session *sess = core->cur_sess;
	sess->last_irq_jiffies = get_jiffies_64();

Since core->cur_sess is initialized to NULL and only assigned later during
streaming, will this lead to a NULL pointer dereference? 

Would it be safer to add the IRQF_NO_AUTOEN flag when registering this
interrupt?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

_______________________________________________
linux-amlogic mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-amlogic