* [PATCH] vcodec: mediatek: add check for NULL for vsi->frm_bufs[vsi->new_fb_idx].buf.fb in vp9_swap_frm_bufs
@ 2022-10-28 12:58 Anastasia Belova
2022-10-28 13:02 ` Nicolas Dufresne
0 siblings, 1 reply; 3+ messages in thread
From: Anastasia Belova @ 2022-10-28 12:58 UTC (permalink / raw)
To: Mauro Carvalho Chehab, Matthias Brugger
Cc: Anastasia Belova, Tiffany Lin, Andrew-CT Chen, Yunfei Dong,
AngeloGioacchino Del Regno, Hans Verkuil, Nicolas Dufresne,
linux-media, linux-kernel, linux-arm-kernel, linux-mediatek,
lvc-project
If vsi->frm_bufs[vsi->new_fb_idx].buf.fb == NULL while cleaning
fb_free_list NULL-pointer is dereferenced.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
---
drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
index 70b8383f7c8e..b0679aaf6192 100644
--- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
+++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
@@ -512,7 +512,7 @@ static void vp9_swap_frm_bufs(struct vdec_vp9_inst *inst)
* clean fb_free_list
*/
if (vsi->frm_bufs[vsi->new_fb_idx].ref_cnt == 0) {
- if (!vp9_is_sf_ref_fb(
+ if (vsi->frm_bufs[vsi->new_fb_idx].buf.fb != NULL && !vp9_is_sf_ref_fb(
inst, vsi->frm_bufs[vsi->new_fb_idx].buf.fb)) {
struct vdec_fb *fb;
--
2.30.2
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] vcodec: mediatek: add check for NULL for vsi->frm_bufs[vsi->new_fb_idx].buf.fb in vp9_swap_frm_bufs
2022-10-28 12:58 [PATCH] vcodec: mediatek: add check for NULL for vsi->frm_bufs[vsi->new_fb_idx].buf.fb in vp9_swap_frm_bufs Anastasia Belova
@ 2022-10-28 13:02 ` Nicolas Dufresne
2022-10-31 12:48 ` AngeloGioacchino Del Regno
0 siblings, 1 reply; 3+ messages in thread
From: Nicolas Dufresne @ 2022-10-28 13:02 UTC (permalink / raw)
To: Anastasia Belova, Mauro Carvalho Chehab, Matthias Brugger
Cc: Tiffany Lin, Andrew-CT Chen, Yunfei Dong,
AngeloGioacchino Del Regno, Hans Verkuil, linux-media,
linux-kernel, linux-arm-kernel, linux-mediatek, lvc-project
Hi,
Le vendredi 28 octobre 2022 à 15:58 +0300, Anastasia Belova a écrit :
> If vsi->frm_bufs[vsi->new_fb_idx].buf.fb == NULL while cleaning
> fb_free_list NULL-pointer is dereferenced.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver")
>
> Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
> ---
> drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
> index 70b8383f7c8e..b0679aaf6192 100644
> --- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
> +++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
> @@ -512,7 +512,7 @@ static void vp9_swap_frm_bufs(struct vdec_vp9_inst *inst)
> * clean fb_free_list
> */
> if (vsi->frm_bufs[vsi->new_fb_idx].ref_cnt == 0) {
> - if (!vp9_is_sf_ref_fb(
> + if (vsi->frm_bufs[vsi->new_fb_idx].buf.fb != NULL && !vp9_is_sf_ref_fb(
> inst, vsi->frm_bufs[vsi->new_fb_idx].buf.fb)) {
> struct vdec_fb *fb;
Perhaps we could try and maintain some readability ? I'd suggest to move the
check into vp9_is_sf_ref_fb() as an early return.
Nicolas
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] vcodec: mediatek: add check for NULL for vsi->frm_bufs[vsi->new_fb_idx].buf.fb in vp9_swap_frm_bufs
2022-10-28 13:02 ` Nicolas Dufresne
@ 2022-10-31 12:48 ` AngeloGioacchino Del Regno
0 siblings, 0 replies; 3+ messages in thread
From: AngeloGioacchino Del Regno @ 2022-10-31 12:48 UTC (permalink / raw)
To: Nicolas Dufresne, Anastasia Belova, Mauro Carvalho Chehab,
Matthias Brugger
Cc: Tiffany Lin, Andrew-CT Chen, Yunfei Dong, Hans Verkuil,
linux-media, linux-kernel, linux-arm-kernel, linux-mediatek,
lvc-project
Il 28/10/22 15:02, Nicolas Dufresne ha scritto:
> Hi,
>
> Le vendredi 28 octobre 2022 à 15:58 +0300, Anastasia Belova a écrit :
>> If vsi->frm_bufs[vsi->new_fb_idx].buf.fb == NULL while cleaning
>> fb_free_list NULL-pointer is dereferenced.
>>
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>>
>> Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver")
>>
>> Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
>> ---
>> drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
>> index 70b8383f7c8e..b0679aaf6192 100644
>> --- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
>> +++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
>> @@ -512,7 +512,7 @@ static void vp9_swap_frm_bufs(struct vdec_vp9_inst *inst)
>> * clean fb_free_list
>> */
>> if (vsi->frm_bufs[vsi->new_fb_idx].ref_cnt == 0) {
>> - if (!vp9_is_sf_ref_fb(
>> + if (vsi->frm_bufs[vsi->new_fb_idx].buf.fb != NULL && !vp9_is_sf_ref_fb(
>> inst, vsi->frm_bufs[vsi->new_fb_idx].buf.fb)) {
>> struct vdec_fb *fb;
>
> Perhaps we could try and maintain some readability ? I'd suggest to move the
> check into vp9_is_sf_ref_fb() as an early return.
>
I don't think that this will ever happen, as the check was omitted because of being
totally sure that vsi->frm_bufs[vsi->new_fb_idx].buf.fb is not NULL.
In any case, it doesn't really cost anything to add a check... in which case, I
agree with Nicolas about moving that to vp9_is_sf_ref_fb().
if (!fb)
return false
for .....
Regards,
Angelo
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-10-31 12:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-28 12:58 [PATCH] vcodec: mediatek: add check for NULL for vsi->frm_bufs[vsi->new_fb_idx].buf.fb in vp9_swap_frm_bufs Anastasia Belova
2022-10-28 13:02 ` Nicolas Dufresne
2022-10-31 12:48 ` AngeloGioacchino Del Regno
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®