linux-kernel - [PATCH] media: i2c: ov5648: Plug runtime pm counter leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 11 May 2021 18:14:37 +0530
From:   Pratyush Yadav <p.yadav@...com>
To:     Mauro Carvalho Chehab <mchehab@...nel.org>,
        Sakari Ailus <sakari.ailus@...ux.intel.com>,
        Paul Kocialkowski <paul.kocialkowski@...tlin.com>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        <linux-media@...r.kernel.org>, <linux-kernel@...r.kernel.org>
CC:     Pratyush Yadav <p.yadav@...com>
Subject: [PATCH] media: i2c: ov5648: Plug runtime pm counter leak

When the stream is being enabled, the runtime pm usage counter is
incremented. Then if ov5648_sw_standby() fails, the function returns
error without decrementing the counter, leaking it.

Signed-off-by: Pratyush Yadav <p.yadav@...com>
---

Hi,

I spotted this when converting OV5640 driver to use runtime PM using
this driver as reference. I only have a very surface level understanding
of runtime PM system as of now so please review with that in mind.

This patch is only compile-tested since I don't have the hardware with
me.

 drivers/media/i2c/ov5648.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/media/i2c/ov5648.c b/drivers/media/i2c/ov5648.c
index 3ecb4a3e8773..6aa2c950f505 100644
--- a/drivers/media/i2c/ov5648.c
+++ b/drivers/media/i2c/ov5648.c
@@ -2143,8 +2143,12 @@ static int ov5648_s_stream(struct v4l2_subdev *subdev, int enable)
 	ret = ov5648_sw_standby(sensor, !enable);
 	mutex_unlock(&sensor->mutex);

-	if (ret)
+	if (ret) {
+		if (enable)
+			pm_runtime_put(sensor->dev);
+
 		return ret;
+	}

 	state->streaming = !!enable;

--
2.30.0