linux-kernel - [RFC PATCH] media: venus: Fix NULL pointer dereference in core selection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200601150314.RFC.1.I1e40623bbe8fa43ff1415fc273cba66503b9b048@changeid>
Date:   Mon,  1 Jun 2020 15:03:22 -0700
From:   Douglas Anderson <dianders@...omium.org>
To:     amasule@...eaurora.org, stanimir.varbanov@...aro.org
Cc:     swboyd@...omium.org, jkardatzke@...gle.com, mka@...omium.org,
        Douglas Anderson <dianders@...omium.org>,
        Andy Gross <agross@...nel.org>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-media@...r.kernel.org
Subject: [RFC PATCH] media: venus: Fix NULL pointer dereference in core selection

The newly-introduced function min_loaded_core() iterates over all of
the venus instances an tries to figure out how much load each instance
is putting on each core.  Not all instances, however, might be fully
initialized.  Specifically the "codec_freq_data" is initialized as
part of vdec_queue_setup(), but an instance may already be in the list
of all instances before that time.

Let's band-aid this by checking to see if codec_freq_data is NULL
before dereferencing.

NOTE: without this fix I was running into a crash.  Specifically there
were two venus instances.  One was doing start_streaming.  The other
was midway through queue_setup but hadn't yet gotten to initting
"codec_freq_data".

Fixes: eff82f79c562 ("media: venus: introduce core selection")
Signed-off-by: Douglas Anderson <dianders@...omium.org>
---
I'm not massively happy about this commit but it's the best I could
come up with without being much more of an expert in the venus codec.
If someone has a better patch then please just consider this one to be
a bug report and feel free to submit a better fix!  :-)

In general I wonder a little bit about whether it's safe to be peeking
at all the instances without grabbing the "inst->lock" on each one.  I
guess it is since we do it both here and in load_scale_v4() but I
don't know why.

One thought I had was that we could fully avoid accessing the other
instances, at least in min_loaded_core(), by just keeping track of
"core1_load" and "core2_load" in "struct venus_core".  Whenever we add
a new instance we could add to the relevant variables and whenever we
release an instance we could remove.  Such a change seems cleaner but
would require someone to test to make sure we didn't miss any case
(AKA we always properly added/removed our load from the globals).

 drivers/media/platform/qcom/venus/pm_helpers.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/qcom/venus/pm_helpers.c b/drivers/media/platform/qcom/venus/pm_helpers.c
index abf93158857b..a1d998f62cf2 100644
--- a/drivers/media/platform/qcom/venus/pm_helpers.c
+++ b/drivers/media/platform/qcom/venus/pm_helpers.c
@@ -496,6 +496,8 @@ min_loaded_core(struct venus_inst *inst, u32 *min_coreid, u32 *min_load)
 	list_for_each_entry(inst_pos, &core->instances, list) {
 		if (inst_pos == inst)
 			continue;
+		if (!inst_pos->clk_data.codec_freq_data)
+			continue;
 		vpp_freq = inst_pos->clk_data.codec_freq_data->vpp_freq;
 		coreid = inst_pos->clk_data.core_id;

-- 
2.27.0.rc2.251.g90737beb825-goog