linux-kernel - Re: [PATCH v6 2/2] media: i2c: Add driver for ST VD56G3 camera sensor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aBPzucFjWvN8crSs@kekkonen.localdomain>
Date: Thu, 1 May 2025 22:20:41 +0000
From: Sakari Ailus <sakari.ailus@...ux.intel.com>
To: Sylvain Petinot <sylvain.petinot@...s.st.com>
Cc: benjamin.mugnier@...s.st.com, mchehab@...nel.org, robh@...nel.org,
	krzysztof.kozlowski+dt@...aro.org, conor+dt@...nel.org,
	laurent.pinchart@...asonboard.com, linux-media@...r.kernel.org,
	devicetree@...r.kernel.org, linux-kernel@...r.kernel.org,
	tomm.merciai@...il.com
Subject: Re: [PATCH v6 2/2] media: i2c: Add driver for ST VD56G3 camera sensor

Hi Sylvain,

On Wed, Apr 30, 2025 at 04:19:14PM +0200, Sylvain Petinot wrote:
> > > +static int vd56g3_subdev_init(struct vd56g3 *sensor)
> > > +{
> > > +	int ret;
> > > +
> > > +	/* Init remaining sub device ops */
> > > +	sensor->sd.internal_ops = &vd56g3_internal_ops;
> > > +	sensor->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
> > > +	sensor->sd.entity.ops = &vd56g3_subdev_entity_ops;
> > > +
> > > +	/* Init source pad */
> > > +	sensor->pad.flags = MEDIA_PAD_FL_SOURCE;
> > > +	sensor->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
> > > +	ret = media_entity_pads_init(&sensor->sd.entity, 1, &sensor->pad);
> > > +	if (ret) {
> > > +		dev_err(sensor->dev, "Failed to init media entity : %d", ret);
> > > +		return ret;
> > > +	}
> > > +
> > > +	/* Init controls */
> > > +	ret = vd56g3_init_controls(sensor);
> > > +	if (ret) {
> > > +		dev_err(sensor->dev, "Controls initialization failed %d", ret);
> > > +		goto err_media;
> > > +	}
> > > +
> > > +	/* Init vd56g3 struct : default resolution + raw8 */
> > > +	sensor->sd.state_lock = sensor->ctrl_handler.lock;
> > > +	ret = v4l2_subdev_init_finalize(&sensor->sd);
> > > +	if (ret) {
> > > +		dev_err(sensor->dev, "subdev init error: %d", ret);
> > > +		goto err_ctrls;
> > > +	}
> > > +
> > > +	return vd56g3_update_controls(sensor);
> > 
> > You're not holding the control handler's lock in the above call.
> 
> If your comment is related to the fact that 'vd56g3_update_controls() can
> fail and that we do not free control handler not cleanup media entity, it's
> fixed in V7.

It's not. The access to the control handler is serialised by a mutex and
you're not holding that mutex whilst calling vd56g3_update_controls() here.
The same issue exists in accessing sub-device state.

...

> > > +	ret = vd56g3_parse_dt(sensor);
> > > +	if (ret)
> > > +		return dev_err_probe(dev, ret, "Failed to parse Device Tree.");
> > 
> > No need for the trailing dot in these messages. Same elsewhere.
> 
> You're right, Fixed in V7.
> I took the opportunity to harmonize the error messages (Capital letter, no
> space before ':', no trailing dot, missing '\n').

Ack, sounds good!

-- 
Regards,

Sakari Ailus