linux-kernel - [POTENTIAL BUG] stm32: Potential NULL pointer dereference in dcmi_irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210527150627.12995-1-ulitin@ispras.ru>
Date:   Thu, 27 May 2021 18:06:25 +0300
From:   Dmitriy Ulitin <ulitin@...ras.ru>
To:     Hugues Fruchet <hugues.fruchet@...s.st.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Maxime Coquelin <mcoquelin.stm32@...il.com>,
        Alexandre Torgue <alexandre.torgue@...s.st.com>
Cc:     Dmitriy Ulitin <ulitin@...ras.ru>, linux-media@...r.kernel.org,
        linux-stm32@...md-mailman.stormreply.com,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        ldv-project@...uxtesting.org
Subject: [POTENTIAL BUG] stm32: Potential NULL pointer dereference in dcmi_irq_thread()

At the moment of enabling irq handling:

1922 ret = devm_request_threaded_irq(&pdev->dev, irq, dcmi_irq_callback,
1923			dcmi_irq_thread, IRQF_ONESHOT,
1924			dev_name(&pdev->dev), dcmi);

there is still uninitialized field sd_format of struct stm32_dcmi *dcmi.
If an interrupt occurs in the interval between the installation of the
interrupt handler and the initialization of this field, NULL pointer
dereference happens.

This field is dereferenced in the handler function without any check:

457 if (dcmi->sd_format->fourcc == V4L2_PIX_FMT_JPEG &&
458	    dcmi->misr & IT_FRAME) {

The initialization of the sd_format field happens in
dcmi_graph_notify_complete() via dcmi_set_default_fmt().

Is it guaranteed that an interrupt does not occur in this interval?
If it is not, is it better to move interrupt handler installation
after initialization of this field has been completed?

Found by Linux Driver Verification project (linuxtesting.org).