Subject: Re: [PATCH] media: saa7146: hexium_gemini: Fix a NULL pointer
 dereference in hexium_attach()
To:     Zhou Qingyang <zhou1615@umn.edu>
Cc:     kjlu@umn.edu, Mauro Carvalho Chehab <mchehab@kernel.org>,
        linux-media@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20211130161538.182313-1-zhou1615@umn.edu>
From:   Hans Verkuil <hverkuil@xs4all.nl>
Message-ID: <b0f7ee6e-f6fc-955e-92eb-013cd96f1d1d@xs4all.nl>
Date:   Thu, 2 Dec 2021 14:34:09 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Firefox/78.0 Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <20211130161538.182313-1-zhou1615@umn.edu>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 30/11/2021 17:15, Zhou Qingyang wrote:
> In hexium_attach(dev, info), saa7146_vv_init() is called to allocate
> a new memory for dev->vv_data. saa7146_vv_release() will be called on
> failure of saa7146_register_device(). There is a dereference of
> dev->vv_data in saa7146_vv_release(), which could lead to a NULL
> pointer dereference on failure of saa7146_vv_init().
> 
> Fix this bug by adding a check of saa7146_vv_init().
> 
> This bug was found by a static analyzer. The analysis employs
> differential checking to identify inconsistent security operations
> (e.g., checks or kfrees) between two code paths and confirms that the
> inconsistent operations are not recovered in the current function or
> the callers, so they constitute bugs.
> 
> Note that, as a bug found by static analysis, it can be a false
> positive or hard to trigger. Multiple researchers have cross-reviewed
> the bug.
> 
> Builds with CONFIG_VIDEO_HEXIUM_GEMINI=m show no new warnings,
> and our static analyzer no longer warns about this code.
> 
> Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
> ---
>  drivers/media/pci/saa7146/hexium_gemini.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c
> index 2214c74bbbf1..549b1ddc59b5 100644
> --- a/drivers/media/pci/saa7146/hexium_gemini.c
> +++ b/drivers/media/pci/saa7146/hexium_gemini.c
> @@ -284,7 +284,11 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d
>  	hexium_set_input(hexium, 0);
>  	hexium->cur_input = 0;
>  
> -	saa7146_vv_init(dev, &vv_data);
> +	ret = saa7146_vv_init(dev, &vv_data);
> +	if (ret) {
> +		kfree(hexium);

You need to call i2c_del_adapter(&hexium->i2c_adapter); as well.

Also, saa7146_vv_init() needs be fixed since it can return -1: that should
be -ENOMEM. Otherwise a -1 error code could be returned here, that's not
what you want.

Regards,

	Hans

> +		return ret;
> +	}
>  
>  	vv_data.vid_ops.vidioc_enum_input = vidioc_enum_input;
>  	vv_data.vid_ops.vidioc_g_input = vidioc_g_input;
>