From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eugeniu Rosca <erosca@de.adit-jv.com>,
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>,
Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
Hans Verkuil <hverkuil-cisco@xs4all.nl>,
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Subject: [PATCH 4.19 24/92] media: vsp1: dl: Fix NULL pointer dereference on unbind
Date: Thu, 20 Aug 2020 11:21:09 +0200 [thread overview]
Message-ID: <20200820091538.815430584@linuxfoundation.org> (raw)
In-Reply-To: <20200820091537.490965042@linuxfoundation.org>
From: Eugeniu Rosca <erosca@de.adit-jv.com>
commit c92d30e4b78dc331909f8c6056c2792aa14e2166 upstream.
In commit f3b98e3c4d2e16 ("media: vsp1: Provide support for extended
command pools"), the vsp pointer used for referencing the VSP1 device
structure from a command pool during vsp1_dl_ext_cmd_pool_destroy() was
not populated.
Correctly assign the pointer to prevent the following
null-pointer-dereference when removing the device:
[*] h3ulcb-kf #>
echo fea28000.vsp > /sys/bus/platform/devices/fea28000.vsp/driver/unbind
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
Mem abort info:
ESR = 0x96000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000007318be000
[0000000000000028] pgd=00000007333a1003, pud=00000007333a6003, pmd=0000000000000000
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 486 Comm: sh Not tainted 5.7.0-rc6-arm64-renesas-00118-ge644645abf47 #185
Hardware name: Renesas H3ULCB Kingfisher board based on r8a77951 (DT)
pstate: 40000005 (nZcv daif -PAN -UAO)
pc : vsp1_dlm_destroy+0xe4/0x11c
lr : vsp1_dlm_destroy+0xc8/0x11c
sp : ffff800012963b60
x29: ffff800012963b60 x28: ffff0006f83fc440
x27: 0000000000000000 x26: ffff0006f5e13e80
x25: ffff0006f5e13ed0 x24: ffff0006f5e13ed0
x23: ffff0006f5e13ed0 x22: dead000000000122
x21: ffff0006f5e3a080 x20: ffff0006f5df2938
x19: ffff0006f5df2980 x18: 0000000000000003
x17: 0000000000000000 x16: 0000000000000016
x15: 0000000000000003 x14: 00000000000393c0
x13: ffff800011a5ec18 x12: ffff800011d8d000
x11: ffff0006f83fcc68 x10: ffff800011a53d70
x9 : ffff8000111f3000 x8 : 0000000000000000
x7 : 0000000000210d00 x6 : 0000000000000000
x5 : ffff800010872e60 x4 : 0000000000000004
x3 : 0000000078068000 x2 : ffff800012781000
x1 : 0000000000002c00 x0 : 0000000000000000
Call trace:
vsp1_dlm_destroy+0xe4/0x11c
vsp1_wpf_destroy+0x10/0x20
vsp1_entity_destroy+0x24/0x4c
vsp1_destroy_entities+0x54/0x130
vsp1_remove+0x1c/0x40
platform_drv_remove+0x28/0x50
__device_release_driver+0x178/0x220
device_driver_detach+0x44/0xc0
unbind_store+0xe0/0x104
drv_attr_store+0x20/0x30
sysfs_kf_write+0x48/0x70
kernfs_fop_write+0x148/0x230
__vfs_write+0x18/0x40
vfs_write+0xdc/0x1c4
ksys_write+0x68/0xf0
__arm64_sys_write+0x18/0x20
el0_svc_common.constprop.0+0x70/0x170
do_el0_svc+0x20/0x80
el0_sync_handler+0x134/0x1b0
el0_sync+0x140/0x180
Code: b40000c2 f9403a60 d2800084 a9400663 (f9401400)
---[ end trace 3875369841fb288a ]---
Fixes: f3b98e3c4d2e16 ("media: vsp1: Provide support for extended command pools")
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/vsp1/vsp1_dl.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/media/platform/vsp1/vsp1_dl.c
+++ b/drivers/media/platform/vsp1/vsp1_dl.c
@@ -431,6 +431,8 @@ vsp1_dl_cmd_pool_create(struct vsp1_devi
if (!pool)
return NULL;
+ pool->vsp1 = vsp1;
+
spin_lock_init(&pool->lock);
INIT_LIST_HEAD(&pool->free);
next prev parent reply other threads:[~2020-08-20 12:27 UTC|newest]
Thread overview: 111+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-20 9:20 [PATCH 4.19 00/92] 4.19.141-rc1 review Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 01/92] smb3: warn on confusing error scenario with sec=krb5 Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 02/92] genirq/affinity: Make affinity setting if activated opt-in Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 03/92] PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context() Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 04/92] PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 05/92] PCI: Add device even if driver attach failed Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 06/92] PCI: qcom: Define some PARF params needed for ipq8064 SoC Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 07/92] PCI: qcom: Add support for tx term offset for rev 2.1.0 Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 08/92] PCI: Probe bridge window attributes once at enumeration-time Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 09/92] btrfs: free anon block device right after subvolume deletion Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 10/92] btrfs: dont allocate anonymous block device for user invisible roots Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 11/92] btrfs: ref-verify: fix memory leak in add_block_entry Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 12/92] btrfs: dont traverse into the seed devices in show_devname Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 13/92] btrfs: open device without device_list_mutex Greg Kroah-Hartman
2020-08-20 9:20 ` [PATCH 4.19 14/92] btrfs: fix messages after changing compression level by remount Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 15/92] btrfs: only search for left_info if there is no right_info in try_merge_free_space Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 16/92] btrfs: fix memory leaks after failure to lookup checksums during inode logging Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 17/92] btrfs: fix return value mixup in btrfs_get_extent Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 18/92] dt-bindings: iio: io-channel-mux: Fix compatible string in example code Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 19/92] iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw() Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 20/92] xtensa: fix xtensa_pmu_setup prototype Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 21/92] cifs: Fix leak when handling lease break for cached root fid Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 22/92] powerpc: Allow 4224 bytes of stack expansion for the signal frame Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 23/92] powerpc: Fix circular dependency between percpu.h and mmu.h Greg Kroah-Hartman
2020-08-20 9:21 ` Greg Kroah-Hartman [this message]
2020-08-20 9:21 ` [PATCH 4.19 25/92] net: ethernet: stmmac: Disable hardware multicast filter Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 26/92] net: stmmac: dwmac1000: provide multicast filter fallback Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 27/92] net/compat: Add missing sock updates for SCM_RIGHTS Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 28/92] md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 29/92] bcache: allocate meta data pages as compound pages Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 30/92] bcache: fix overflow in offset_to_stripe() Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 31/92] mac80211: fix misplaced while instead of if Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 32/92] driver core: Avoid binding drivers to dead devices Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 33/92] MIPS: CPU#0 is not hotpluggable Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 34/92] ext2: fix missing percpu_counter_inc Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 35/92] ocfs2: change slot number type s16 to u16 Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 36/92] mm/page_counter.c: fix protection usage propagation Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 37/92] ftrace: Setup correct FTRACE_FL_REGS flags for module Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 38/92] kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler Greg Kroah-Hartman
2020-09-28 20:02 ` Naresh Kamboju
2020-09-28 22:09 ` Steven Rostedt
2020-09-28 22:15 ` Steven Rostedt
2020-09-29 5:49 ` Masami Hiramatsu
2020-09-29 6:52 ` Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 39/92] tracing/hwlat: Honor the tracing_cpumask Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 40/92] tracing: Use trace_sched_process_free() instead of exit() for pid tracing Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 41/92] watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 42/92] watchdog: f71808e_wdt: remove use of wrong watchdog_info option Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 43/92] watchdog: f71808e_wdt: clear watchdog timeout occurred flag Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 44/92] pseries: Fix 64 bit logical memory block panic Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 45/92] module: Correctly truncate sysfs sections output Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 46/92] perf intel-pt: Fix FUP packet state Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 47/92] remoteproc: qcom: q6v5: Update running state before requesting stop Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 48/92] drm/imx: imx-ldb: Disable both channels for split mode in enc->disable() Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 49/92] mfd: arizona: Ensure 32k clock is put on driver unbind and error Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 50/92] RDMA/ipoib: Return void from ipoib_ib_dev_stop() Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 51/92] RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah() Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 52/92] media: rockchip: rga: Introduce color fmt macros and refactor CSC mode logic Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 53/92] media: rockchip: rga: Only set output CSC mode for RGB input Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 54/92] USB: serial: ftdi_sio: make process-packet buffer unsigned Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 55/92] USB: serial: ftdi_sio: clean up receive processing Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 56/92] USB: serial: ftdi_sio: fix break and sysrq handling Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 57/92] mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 58/92] gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 59/92] dm rq: dont call blk_mq_queue_stopped() in dm_stop_queue() Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 60/92] selftests/powerpc: ptrace-pkey: Rename variables to make it easier to follow code Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 61/92] selftests/powerpc: ptrace-pkey: Update the test to mark an invalid pkey correctly Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 62/92] selftests/powerpc: ptrace-pkey: Dont update expected UAMOR value Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 63/92] iommu/omap: Check for failure of a call to omap_iommu_dump_ctx Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 64/92] iommu/vt-d: Enforce PASID devTLB field mask Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 65/92] i2c: rcar: slave: only send STOP event when we have been addressed Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 66/92] clk: clk-atlas6: fix return value check in atlas6_clk_init() Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 67/92] pwm: bcm-iproc: handle clk_get_rate() return Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 68/92] tools build feature: Use CC and CXX from parent Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 69/92] i2c: rcar: avoid race when unregistering slave Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 70/92] openrisc: Fix oops caused when dumping stack Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 71/92] scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 72/92] watchdog: initialize device before misc_register Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 73/92] Input: sentelic - fix error return when fsp_reg_write fails Greg Kroah-Hartman
2020-08-20 9:21 ` [PATCH 4.19 74/92] drm/vmwgfx: Use correct vmw_legacy_display_unit pointer Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 75/92] drm/vmwgfx: Fix two list_for_each loop exit tests Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 76/92] net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 77/92] nfs: Fix getxattr kernel panic and memory overflow Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 78/92] fs/minix: set s_maxbytes correctly Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 79/92] fs/minix: fix block limit check for V1 filesystems Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 80/92] fs/minix: remove expected error message in block_to_path() Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 81/92] fs/ufs: avoid potential u32 multiplication overflow Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 82/92] test_kmod: avoid potential double free in trigger_config_run_type() Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 83/92] mfd: dln2: Run event handler loop under spinlock Greg Kroah-Hartman
2020-08-21 7:21 ` Pavel Machek
2020-08-21 9:06 ` Andy Shevchenko
2020-08-21 9:14 ` Greg Kroah-Hartman
2020-08-21 9:15 ` Greg Kroah-Hartman
2020-08-21 10:54 ` Andy Shevchenko
2020-08-21 11:21 ` Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 84/92] ALSA: echoaudio: Fix potential Oops in snd_echo_resume() Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 85/92] perf bench mem: Always memset source before memcpy Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 86/92] tools build feature: Quote CC and CXX for their arguments Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 87/92] sh: landisk: Add missing initialization of sh_io_port_base Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 88/92] khugepaged: retract_page_tables() remember to test exit Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 89/92] arm64: dts: marvell: espressobin: add ethernet alias Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 90/92] drm/radeon: fix fb_div check in ni_init_smc_spll_table() Greg Kroah-Hartman
2020-08-21 7:27 ` Pavel Machek
2020-08-21 7:37 ` Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 91/92] drm: Added orientation quirk for ASUS tablet model T103HAF Greg Kroah-Hartman
2020-08-20 9:22 ` [PATCH 4.19 92/92] drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume Greg Kroah-Hartman
2020-08-20 20:03 ` [PATCH 4.19 00/92] 4.19.141-rc1 review Guenter Roeck
2020-08-20 20:05 ` Guenter Roeck
2020-08-20 23:49 ` Shuah Khan
2020-08-21 7:09 ` Naresh Kamboju
2020-08-21 7:39 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200820091538.815430584@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=erosca@de.adit-jv.com \
--cc=hverkuil-cisco@xs4all.nl \
--cc=kieran.bingham+renesas@ideasonboard.com \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab+huawei@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).