linux-kernel - Re: [PATCH v2] media: mtk-mdp: Fix some issues in mtk_mdp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e22a74d0298d7318c59841f706f6f731c77241db.camel@ndufresne.ca>
Date: Fri, 03 Oct 2025 11:44:45 -0400
From: Nicolas Dufresne <nicolas@...fresne.ca>
To: Haoxiang Li <haoxiang_li2024@....com>, minghsiu.tsai@...iatek.com, 
	houlong.wei@...iatek.com, andrew-ct.chen@...iatek.com, mchehab@...nel.org, 
	matthias.bgg@...il.com, angelogioacchino.delregno@...labora.com, 
	hans.verkuil@...co.com
Cc: linux-media@...r.kernel.org, linux-kernel@...r.kernel.org, 
	linux-arm-kernel@...ts.infradead.org, linux-mediatek@...ts.infradead.org, 
	stable@...r.kernel.org
Subject: Re: [PATCH v2] media: mtk-mdp: Fix some issues in mtk_mdp_core.c

Hi,


Le mercredi 17 septembre 2025 à 17:40 +0800, Haoxiang Li a écrit :
> Add check for the return value of vpu_get_plat_device() to prevent null
> pointer dereference. And vpu_get_plat_device() increases the reference
> count of the returned platform device. Add platform_device_put() to
> prevent reference leak. Also add platform_device_put() in mtk_mdp_remove().

I think we should improve the subject a little. What about ?

  media: mtk-mdp: Fix error handling in probe function


Nicolas

> 
> Add mtk_mdp_unregister_m2m_device() on the error handling path.
> 
> Fixes: c8eb2d7e8202 ("[media] media: Add Mediatek MDP Driver")
> Cc: stable@...r.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@....com>
> ---
> Changes in v2:
> - Add check for vpu_get_plat_device()
> - Add platform_device_put() in mtk_mdp_remove()
> - Add mtk_mdp_unregister_m2m_device() on the error handling path.
> - Modify the patch title and description. I think you are right.
>   Thanks, CJ!
> ---
>  .../media/platform/mediatek/mdp/mtk_mdp_core.c  | 17 +++++++++++++++--
>  1 file changed, 15 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
> b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
> index 80fdc6ff57e0..8432833814f3 100644
> --- a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
> +++ b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
> @@ -194,11 +194,17 @@ static int mtk_mdp_probe(struct platform_device *pdev)
>  	}
>  
>  	mdp->vpu_dev = vpu_get_plat_device(pdev);
> +	if (!mdp->vpu_dev) {
> +		dev_err(&pdev->dev, "Failed to get vpu device\n");
> +		ret = -ENODEV;
> +		goto err_vpu_get_dev;
> +	}
> +
>  	ret = vpu_wdt_reg_handler(mdp->vpu_dev, mtk_mdp_reset_handler, mdp,
>  				  VPU_RST_MDP);
>  	if (ret) {
>  		dev_err(&pdev->dev, "Failed to register reset handler\n");
> -		goto err_m2m_register;
> +		goto err_reg_handler;
>  	}
>  
>  	platform_set_drvdata(pdev, mdp);
> @@ -206,7 +212,7 @@ static int mtk_mdp_probe(struct platform_device *pdev)
>  	ret = vb2_dma_contig_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
>  	if (ret) {
>  		dev_err(&pdev->dev, "Failed to set vb2 dma mag seg size\n");
> -		goto err_m2m_register;
> +		goto err_reg_handler;
>  	}
>  
>  	pm_runtime_enable(dev);
> @@ -214,6 +220,12 @@ static int mtk_mdp_probe(struct platform_device *pdev)
>  
>  	return 0;
>  
> +err_reg_handler:
> +	platform_device_put(mdp->vpu_dev);
> +
> +err_vpu_get_dev:
> +	mtk_mdp_unregister_m2m_device(mdp);
> +
>  err_m2m_register:
>  	v4l2_device_unregister(&mdp->v4l2_dev);
>  
> @@ -242,6 +254,7 @@ static void mtk_mdp_remove(struct platform_device *pdev)
>  
>  	pm_runtime_disable(&pdev->dev);
>  	vb2_dma_contig_clear_max_seg_size(&pdev->dev);
> +	platform_device_put(mdp->vpu_dev);
>  	mtk_mdp_unregister_m2m_device(mdp);
>  	v4l2_device_unregister(&mdp->v4l2_dev);
>  

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)