linux-kernel - RE: [EXT] [PATCH v2 next] media: imx-jpeg: Fix potential error pointer dereference in detach

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <PAXPR04MB825417A4E1A4B9A9381BA791E7402@PAXPR04MB8254.eurprd04.prod.outlook.com>
Date: Fri, 18 Oct 2024 01:18:59 +0000
From: Ming Qian <ming.qian@....com>
To: Dan Carpenter <dan.carpenter@...aro.org>
CC: Mirela Rabulea <mirela.rabulea@....com>, Mauro Carvalho Chehab
	<mchehab@...nel.org>, Shawn Guo <shawnguo@...nel.org>, Sascha Hauer
	<s.hauer@...gutronix.de>, Pengutronix Kernel Team <kernel@...gutronix.de>,
	Fabio Estevam <festevam@...il.com>, Hans Verkuil <hverkuil@...all.nl>, Tao
 Jiang <tao.jiang_2@....com>, "imx@...ts.linux.dev" <imx@...ts.linux.dev>,
	"linux-media@...r.kernel.org" <linux-media@...r.kernel.org>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "kernel-janitors@...r.kernel.org"
	<kernel-janitors@...r.kernel.org>
Subject: RE: [EXT] [PATCH v2 next] media: imx-jpeg: Fix potential error
 pointer dereference in detach_pm()

>The proble is on the first line:
>
>        if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i]))
>
>If jpeg->pd_dev[i] is an error pointer, then passing it to
>pm_runtime_suspended() will lead to an Oops.  The other conditions check for
>both error pointers and NULL, but it would be more clear to use the
>IS_ERR_OR_NULL() check for that.
>
>Fixes: fd0af4cd35da ("media: imx-jpeg: Ensure power suppliers be suspended
>before detach them")
>Cc: <stable@...r.kernel.org>
>Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>

Reviewed-by: Ming Qian <ming.qian@....com>

>---
>v2: The buggy patch hasn't hit Linus's tree yet, but it's destined for stable so
>    add a stable tag to this too.
>
> drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
>diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
>b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
>index d8e946aebba2..918ab12edc9e 100644
>--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
>+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
>@@ -2679,11 +2679,12 @@ static void mxc_jpeg_detach_pm_domains(struct
>mxc_jpeg_dev *jpeg)
>        int i;
>
>        for (i = 0; i < jpeg->num_domains; i++) {
>-               if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i]))
>+               if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]) &&
>+                   !pm_runtime_suspended(jpeg->pd_dev[i]))
>                        pm_runtime_force_suspend(jpeg->pd_dev[i]);
>-               if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i]))
>+               if (!IS_ERR_OR_NULL(jpeg->pd_link[i]))
>                        device_link_del(jpeg->pd_link[i]);
>-               if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i]))
>+               if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]))
>                        dev_pm_domain_detach(jpeg->pd_dev[i], true);
>                jpeg->pd_dev[i] = NULL;
>                jpeg->pd_link[i] = NULL;
>--
>2.45.2