Commit 1634b7ad authored by harperchen's avatar harperchen Committed by Mauro Carvalho Chehab
Browse files

media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish 

When the driver calls tw68_risc_buffer() to prepare the buffer, the
function call dma_alloc_coherent may fail, resulting in a empty buffer
buf->cpu. Later when we free the buffer or access the buffer, null ptr
deref is triggered.

This bug is similar to the following one:
https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71

.

We believe the bug can be also dynamically triggered from user side.
Similarly, we fix this by checking the return value of tw68_risc_buffer()
and the value of buf->cpu before buffer free.

Signed-off-by: default avatarharperchen <harperchen1110@gmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent 3af805f7

drivers/media/pci/tw68/tw68-video.c

+9 −7
Original line number Diff line number Diff line
@@ -437,6 +437,7 @@ static void tw68_buf_queue(struct vb2_buffer *vb) 
 */

static int tw68_buf_prepare(struct vb2_buffer *vb)

{

	int ret;

	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);

	struct vb2_queue *vq = vb->vb2_queue;

	struct tw68_dev *dev = vb2_get_drv_priv(vq);
@@ -452,30 +453,30 @@ static int tw68_buf_prepare(struct vb2_buffer *vb) 
	bpl = (dev->width * dev->fmt->depth) >> 3;

	switch (dev->field) {

	case V4L2_FIELD_TOP:

		tw68_risc_buffer(dev->pci, buf, dma->sgl,

		ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,

				 0, UNSET, bpl, 0, dev->height);

		break;

	case V4L2_FIELD_BOTTOM:

		tw68_risc_buffer(dev->pci, buf, dma->sgl,

		ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,

				 UNSET, 0, bpl, 0, dev->height);

		break;

	case V4L2_FIELD_SEQ_TB:

		tw68_risc_buffer(dev->pci, buf, dma->sgl,

		ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,

				 0, bpl * (dev->height >> 1),

				 bpl, 0, dev->height >> 1);

		break;

	case V4L2_FIELD_SEQ_BT:

		tw68_risc_buffer(dev->pci, buf, dma->sgl,

		ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,

				 bpl * (dev->height >> 1), 0,

				 bpl, 0, dev->height >> 1);

		break;

	case V4L2_FIELD_INTERLACED:

	default:

		tw68_risc_buffer(dev->pci, buf, dma->sgl,

		ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,

				 0, bpl, bpl, bpl, dev->height >> 1);

		break;

	}

	return 0;

	return ret;

}



static void tw68_buf_finish(struct vb2_buffer *vb)
@@ -485,6 +486,7 @@ static void tw68_buf_finish(struct vb2_buffer *vb) 
	struct tw68_dev *dev = vb2_get_drv_priv(vq);

	struct tw68_buf *buf = container_of(vbuf, struct tw68_buf, vb);



	if (buf->cpu)

		dma_free_coherent(&dev->pci->dev, buf->size, buf->cpu, buf->dma);

}