From: Dmitriy Ulitin <ulitin@ispras.ru>
To: Hugues Fruchet <hugues.fruchet@foss.st.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Maxime Coquelin <mcoquelin.stm32@gmail.com>,
Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: Dmitriy Ulitin <ulitin@ispras.ru>,
linux-media@vger.kernel.org,
linux-stm32@st-md-mailman.stormreply.com,
linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org
Subject: [POTENTIAL BUG] stm32: Potential NULL pointer dereference in dcmi_irq_thread()
Date: Thu, 27 May 2021 18:06:25 +0300 [thread overview]
Message-ID: <20210527150627.12995-1-ulitin@ispras.ru> (raw)
At the moment of enabling irq handling:
1922 ret = devm_request_threaded_irq(&pdev->dev, irq, dcmi_irq_callback,
1923 dcmi_irq_thread, IRQF_ONESHOT,
1924 dev_name(&pdev->dev), dcmi);
there is still uninitialized field sd_format of struct stm32_dcmi *dcmi.
If an interrupt occurs in the interval between the installation of the
interrupt handler and the initialization of this field, NULL pointer
dereference happens.
This field is dereferenced in the handler function without any check:
457 if (dcmi->sd_format->fourcc == V4L2_PIX_FMT_JPEG &&
458 dcmi->misr & IT_FRAME) {
The initialization of the sd_format field happens in
dcmi_graph_notify_complete() via dcmi_set_default_fmt().
Is it guaranteed that an interrupt does not occur in this interval?
If it is not, is it better to move interrupt handler installation
after initialization of this field has been completed?
Found by Linux Driver Verification project (linuxtesting.org).
next reply other threads:[~2021-05-27 15:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-27 15:06 Dmitriy Ulitin [this message]
2021-05-27 15:06 ` Dmitriy Ulitin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210527150627.12995-1-ulitin@ispras.ru \
--to=ulitin@ispras.ru \
--cc=alexandre.torgue@foss.st.com \
--cc=hugues.fruchet@foss.st.com \
--cc=ldv-project@linuxtesting.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-stm32@st-md-mailman.stormreply.com \
--cc=mchehab@kernel.org \
--cc=mcoquelin.stm32@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®