media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish

[ Upstream commit 1634b7adcc5bef645b3666fdd564e5952a9e24e0 ]

When the driver calls tw68_risc_buffer() to prepare the buffer, the
function call dma_alloc_coherent may fail, resulting in a empty buffer
buf->cpu. Later when we free the buffer or access the buffer, null ptr
deref is triggered.

This bug is similar to the following one:
https://git.linuxtv.org/media_stage.git/commit/?id=c9360be25d30cc6d9d4a9c66331ec95df483aa0b.

We believe the bug can be also dynamically triggered from user side.
Similarly, we fix this by checking the return value of tw68_risc_buffer()
and the value of buf->cpu before buffer free.

Signed-off-by: harperchen <harperchen1110@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/media/pci/tw68/tw68-video.c b/drivers/media/pci/tw68/tw68-video.c
index 0cbc5b038073bc3b052d1acf6ba4d3220c99ceeb..773a18702d36967ecd2fd7d6d8b6ab784de329fd 100644 (file)
--- a/drivers/media/pci/tw68/tw68-video.c
+++ b/drivers/media/pci/tw68/tw68-video.c
@@ -437,6 +437,7 @@ static void tw68_buf_queue(struct vb2_buffer *vb)
  */
 static int tw68_buf_prepare(struct vb2_buffer *vb)
 {
+       int ret;
        struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
        struct vb2_queue *vq = vb->vb2_queue;
        struct tw68_dev *dev = vb2_get_drv_priv(vq);
@@ -452,30 +453,30 @@ static int tw68_buf_prepare(struct vb2_buffer *vb)
        bpl = (dev->width * dev->fmt->depth) >> 3;
        switch (dev->field) {
        case V4L2_FIELD_TOP:
-               tw68_risc_buffer(dev->pci, buf, dma->sgl,
+               ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,
                                 0, UNSET, bpl, 0, dev->height);
                break;
        case V4L2_FIELD_BOTTOM:
-               tw68_risc_buffer(dev->pci, buf, dma->sgl,
+               ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,
                                 UNSET, 0, bpl, 0, dev->height);
                break;
        case V4L2_FIELD_SEQ_TB:
-               tw68_risc_buffer(dev->pci, buf, dma->sgl,
+               ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,
                                 0, bpl * (dev->height >> 1),
                                 bpl, 0, dev->height >> 1);
                break;
        case V4L2_FIELD_SEQ_BT:
-               tw68_risc_buffer(dev->pci, buf, dma->sgl,
+               ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,
                                 bpl * (dev->height >> 1), 0,
                                 bpl, 0, dev->height >> 1);
                break;
        case V4L2_FIELD_INTERLACED:
        default:
-               tw68_risc_buffer(dev->pci, buf, dma->sgl,
+               ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,
                                 0, bpl, bpl, bpl, dev->height >> 1);
                break;
        }
-       return 0;
+       return ret;
 }
 
 static void tw68_buf_finish(struct vb2_buffer *vb)
@@ -485,7 +486,8 @@ static void tw68_buf_finish(struct vb2_buffer *vb)
        struct tw68_dev *dev = vb2_get_drv_priv(vq);
        struct tw68_buf *buf = container_of(vbuf, struct tw68_buf, vb);
 
-       dma_free_coherent(&dev->pci->dev, buf->size, buf->cpu, buf->dma);
+       if (buf->cpu)
+               dma_free_coherent(&dev->pci->dev, buf->size, buf->cpu, buf->dma);
 }
 
 static int tw68_start_streaming(struct vb2_queue *q, unsigned int count)