* [PATCH 5.4 1/2] media: vim2m: Register video device after setting up internals
2022-05-25 8:27 [PATCH 5.4 0/2] media: vim2m: Fix potential NULL pointer dereference Mark-PK Tsai
@ 2022-05-25 8:27 ` Mark-PK Tsai
2022-05-25 8:27 ` [PATCH 5.4 2/2] media: vim2m: initialize the media device earlier Mark-PK Tsai
2022-05-26 12:24 ` [PATCH 5.4 0/2] media: vim2m: Fix potential NULL pointer dereference Greg KH
2 siblings, 0 replies; 4+ messages in thread
From: Mark-PK Tsai @ 2022-05-25 8:27 UTC (permalink / raw)
To: stable
Cc: mchehab, matthias.bgg, hverkuil-cisco, mark-pk.tsai,
sakari.ailus, linux-media, linux-kernel, linux-arm-kernel,
linux-mediatek, yj.chiang, Mauro Carvalho Chehab
commit cf7f34777a5b4100a3a44ff95f3d949c62892bdd upstream.
Prevent NULL (or close to NULL) pointer dereference in various places by
registering the video device only when the V4L2 m2m framework has been set
up.
Fixes: commit 96d8eab5d0a1 ("V4L/DVB: [v5,2/2] v4l: Add a mem-to-mem videobuf framework test device")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ backport to 5.4 LTS ]
CC: stable@vger.kernel.org
Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
---
drivers/media/platform/vim2m.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index 8d6b09623d88..02f5bc82ba46 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -1333,12 +1333,6 @@ static int vim2m_probe(struct platform_device *pdev)
vfd->lock = &dev->dev_mutex;
vfd->v4l2_dev = &dev->v4l2_dev;
- ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0);
- if (ret) {
- v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
- goto error_v4l2;
- }
-
video_set_drvdata(vfd, dev);
v4l2_info(&dev->v4l2_dev,
"Device registered as /dev/video%d\n", vfd->num);
@@ -1353,6 +1347,12 @@ static int vim2m_probe(struct platform_device *pdev)
goto error_dev;
}
+ ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0);
+ if (ret) {
+ v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
+ goto error_m2m;
+ }
+
#ifdef CONFIG_MEDIA_CONTROLLER
dev->mdev.dev = &pdev->dev;
strscpy(dev->mdev.model, "vim2m", sizeof(dev->mdev.model));
@@ -1366,7 +1366,7 @@ static int vim2m_probe(struct platform_device *pdev)
MEDIA_ENT_F_PROC_VIDEO_SCALER);
if (ret) {
v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem media controller\n");
- goto error_dev;
+ goto error_v4l2;
}
ret = media_device_register(&dev->mdev);
@@ -1381,11 +1381,13 @@ static int vim2m_probe(struct platform_device *pdev)
error_m2m_mc:
v4l2_m2m_unregister_media_controller(dev->m2m_dev);
#endif
-error_dev:
+error_v4l2:
video_unregister_device(&dev->vfd);
/* vim2m_device_release called by video_unregister_device to release various objects */
return ret;
-error_v4l2:
+error_m2m:
+ v4l2_m2m_release(dev->m2m_dev);
+error_dev:
v4l2_device_unregister(&dev->v4l2_dev);
error_free:
kfree(dev);
--
2.18.0
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH 5.4 2/2] media: vim2m: initialize the media device earlier
2022-05-25 8:27 [PATCH 5.4 0/2] media: vim2m: Fix potential NULL pointer dereference Mark-PK Tsai
2022-05-25 8:27 ` [PATCH 5.4 1/2] media: vim2m: Register video device after setting up internals Mark-PK Tsai
@ 2022-05-25 8:27 ` Mark-PK Tsai
2022-05-26 12:24 ` [PATCH 5.4 0/2] media: vim2m: Fix potential NULL pointer dereference Greg KH
2 siblings, 0 replies; 4+ messages in thread
From: Mark-PK Tsai @ 2022-05-25 8:27 UTC (permalink / raw)
To: stable
Cc: mchehab, matthias.bgg, hverkuil-cisco, mark-pk.tsai,
sakari.ailus, linux-media, linux-kernel, linux-arm-kernel,
linux-mediatek, yj.chiang, Mauro Carvalho Chehab
commit 1a28dce222a6ece725689ad58c0cf4a1b48894f4 upstream.
Before the video device node is registered, the v4l2_dev.mdev
pointer must be set in order to correctly associate the video
device with the media device. Move the initialization of the
media device up.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ backport to 5.4 LTS]
CC: stable@vger.kernel.org
Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
---
drivers/media/platform/vim2m.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index 02f5bc82ba46..6fba00e03c67 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -1347,12 +1347,6 @@ static int vim2m_probe(struct platform_device *pdev)
goto error_dev;
}
- ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0);
- if (ret) {
- v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
- goto error_m2m;
- }
-
#ifdef CONFIG_MEDIA_CONTROLLER
dev->mdev.dev = &pdev->dev;
strscpy(dev->mdev.model, "vim2m", sizeof(dev->mdev.model));
@@ -1361,7 +1355,15 @@ static int vim2m_probe(struct platform_device *pdev)
media_device_init(&dev->mdev);
dev->mdev.ops = &m2m_media_ops;
dev->v4l2_dev.mdev = &dev->mdev;
+#endif
+ ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0);
+ if (ret) {
+ v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
+ goto error_m2m;
+ }
+
+#ifdef CONFIG_MEDIA_CONTROLLER
ret = v4l2_m2m_register_media_controller(dev->m2m_dev, vfd,
MEDIA_ENT_F_PROC_VIDEO_SCALER);
if (ret) {
--
2.18.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH 5.4 0/2] media: vim2m: Fix potential NULL pointer dereference
2022-05-25 8:27 [PATCH 5.4 0/2] media: vim2m: Fix potential NULL pointer dereference Mark-PK Tsai
2022-05-25 8:27 ` [PATCH 5.4 1/2] media: vim2m: Register video device after setting up internals Mark-PK Tsai
2022-05-25 8:27 ` [PATCH 5.4 2/2] media: vim2m: initialize the media device earlier Mark-PK Tsai
@ 2022-05-26 12:24 ` Greg KH
2 siblings, 0 replies; 4+ messages in thread
From: Greg KH @ 2022-05-26 12:24 UTC (permalink / raw)
To: Mark-PK Tsai
Cc: stable, mchehab, matthias.bgg, hverkuil-cisco, sakari.ailus,
linux-media, linux-kernel, linux-arm-kernel, linux-mediatek,
yj.chiang
On Wed, May 25, 2022 at 04:27:29PM +0800, Mark-PK Tsai wrote:
> Backport upstream solution [1][2] to fix below kernel panic:
>
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208
> ...
> pc : _raw_spin_lock_irqsave+0x50/0x90
> lr : v4l2_m2m_cancel_job+0x38/0x1c4 [v4l2_mem2mem]
> sp : ffffffc012d2bcb0
> x29: ffffffc012d2bcb0 x28: ffffff8098d6bb00
> x27: 0000000000000000 x26: ffffffc01009b5c8
> x25: 00000000000e001f x24: ffffff808ff3eb50
> x23: ffffffc01009f5a0 x22: 0000000000000000
> x21: ffffff808ffef000 x20: 0000000000000208
> x19: 0000000000000000 x18: ffffffc012b51048
> x17: ffffffc011e0ef7c x16: 00000000000000c0
> x15: ffffffc010fc78f4 x14: ffffffc0119dd790
> x13: 0000000000001b26 x12: 0000000053555555
> x11: 0000000000000002 x10: 0000000000000001
> x9 : 0000000000000000 x8 : 0000000000000208
> x7 : 2020202020202020 x6 : ffffffc011e313a6
> x5 : 0000000000000000 x4 : 0000000000000008
> x3 : 000000000000002e x2 : 0000000000000001
> x1 : 0000000000000000 x0 : 0000000000000208
> Call trace:
> _raw_spin_lock_irqsave+0x50/0x90
> v4l2_m2m_cancel_job+0x38/0x1c4 [v4l2_mem2mem]
> v4l2_m2m_ctx_release+0x38/0x60 [v4l2_mem2mem]
> vim2m_release+0x5c/0xe0 [vim2m]
> v4l2_release+0x90/0x18c
> __fput+0xdc/0x2cc
> ____fput+0x10/0x1c
> task_work_run+0xc4/0x130
> do_notify_resume+0xdc/0x158
> work_pending+0x8/0x10
>
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cf7f34777a5b4100a3a44ff95f3d949c62892bdd
> [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1a28dce222a6ece725689ad58c0cf4a1b48894f4
>
> Mark-PK Tsai (2):
> media: vim2m: Register video device after setting up internals
> media: vim2m: initialize the media device earlier
>
> drivers/media/platform/vim2m.c | 22 +++++++++++++---------
> 1 file changed, 13 insertions(+), 9 deletions(-)
>
> --
> 2.18.0
>
All now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread