linux-kernel - [PATCH] media: v4l: async: Fix NULL pointer when v4l2 flash subdev binding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <e2f9f2b7b7de956d70b8567a2ab285409fff988b.1715136478.git.cy_huang@richtek.com>
Date: Wed, 8 May 2024 10:51:49 +0800
From: <cy_huang@...htek.com>
To: Sakari Ailus <sakari.ailus@...ux.intel.com>, Mauro Carvalho Chehab
	<mchehab@...nel.org>
CC: Daniel Scally <djrscally@...il.com>, Laurent Pinchart
	<laurent.pinchart@...asonboard.com>, Jean-Michel Hautbois
	<jeanmichel.hautbois@...asonboard.com>, <linux-media@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, ChiYuan Huang <cy_huang@...htek.com>
Subject: [PATCH] media: v4l: async: Fix NULL pointer when v4l2 flash subdev binding

From: ChiYuan Huang <cy_huang@...htek.com>

In v4l2_async_create_ancillary_links(), if v4l2 async notifier is
created from v4l2 device, the v4l2 flash subdev async binding will enter
the logic to create media link. Due to the subdev of notifier is NULL,
this will cause NULL pointer to access the subdev entity. Therefore, add
the check to bypass it.

Fixes: aa4faf6eb271 ("media: v4l2-async: Create links during v4l2_async_match_notify()")
Signed-off-by: ChiYuan Huang <cy_huang@...htek.com>
---
Hi,

  I'm trying to bind the v4l2 subdev for flashlight testing. It seems
some logic in v4l2 asynd binding is incorrect.

>From the change, I modified vim2m as the test driver to bind mt6370 flashlight.

Here's the backtrace log.

 vim2m soc:vim2m: bound [white:flash-2]
 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058
 ......skipping
 Call trace:
  media_create_ancillary_link+0x48/0xd8 [mc]
  v4l2_async_match_notify+0x17c/0x208 [v4l2_async]
  v4l2_async_register_subdev+0xb8/0x1d0 [v4l2_async]
  __v4l2_flash_init.part.0+0x3b4/0x4b0 [v4l2_flash_led_class]
  v4l2_flash_init+0x28/0x48 [v4l2_flash_led_class]
  mt6370_led_probe+0x348/0x690 [leds_mt6370_flash]

After tracing the code, it will let the subdev labeled as F_LENS or
F_FLASH function to create media link. To prevent the NULL pointer
issue, the simplest way is add a check when 'n->sd' is NULL and bypass
the later media link creataion.
---
 drivers/media/v4l2-core/v4l2-async.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
index 3ec323bd528b..9d3161c51954 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -324,6 +324,9 @@ static int v4l2_async_create_ancillary_links(struct v4l2_async_notifier *n,
 	    sd->entity.function != MEDIA_ENT_F_FLASH)
 		return 0;
 
+	if (!n->sd)
+		return 0;
+
 	link = media_create_ancillary_link(&n->sd->entity, &sd->entity);
 
 #endif
-- 
2.34.1