* [PATCH v3] vcodec: mediatek: add check for NULL for vsi->frm_bufs[vsi->new_fb_idx].buf.fb in vp9_swap_frm_bufs
@ 2022-11-11 9:06 Anastasia Belova
2022-11-18 14:39 ` Hans Verkuil
0 siblings, 1 reply; 2+ messages in thread
From: Anastasia Belova @ 2022-11-11 9:06 UTC (permalink / raw)
To: Mauro Carvalho Chehab, Matthias Brugger
Cc: Anastasia Belova, Tiffany Lin, Andrew-CT Chen, Yunfei Dong,
AngeloGioacchino Del Regno, Hans Verkuil, Nicolas Dufresne,
linux-media, linux-kernel, linux-arm-kernel, linux-mediatek,
lvc-project
Any time calling vp9_is_sf_ref_fb we need fb != NULL after checks.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
---
drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
index 70b8383f7c8e..776468cd834a 100644
--- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
+++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
@@ -208,6 +208,9 @@ static bool vp9_is_sf_ref_fb(struct vdec_vp9_inst *inst, struct vdec_fb *fb)
int i;
struct vdec_vp9_vsi *vsi = inst->vsi;
+ if (!fb)
+ return true;
+
for (i = 0; i < ARRAY_SIZE(vsi->sf_ref_fb); i++) {
if (fb == &vsi->sf_ref_fb[i].fb)
return true;
--
2.30.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v3] vcodec: mediatek: add check for NULL for vsi->frm_bufs[vsi->new_fb_idx].buf.fb in vp9_swap_frm_bufs
2022-11-11 9:06 [PATCH v3] vcodec: mediatek: add check for NULL for vsi->frm_bufs[vsi->new_fb_idx].buf.fb in vp9_swap_frm_bufs Anastasia Belova
@ 2022-11-18 14:39 ` Hans Verkuil
0 siblings, 0 replies; 2+ messages in thread
From: Hans Verkuil @ 2022-11-18 14:39 UTC (permalink / raw)
To: Anastasia Belova, Mauro Carvalho Chehab, Matthias Brugger
Cc: Tiffany Lin, Andrew-CT Chen, Yunfei Dong,
AngeloGioacchino Del Regno, Nicolas Dufresne, linux-media,
linux-kernel, linux-arm-kernel, linux-mediatek, lvc-project
On 11/11/22 10:06, Anastasia Belova wrote:
> Any time calling vp9_is_sf_ref_fb we need fb != NULL after checks.
This doesn't match the subject line at all!
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver")
Drop this, it's not a fix, it just attempts to make things more robust.
>
> Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
> ---
> drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
> index 70b8383f7c8e..776468cd834a 100644
> --- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
> +++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c
> @@ -208,6 +208,9 @@ static bool vp9_is_sf_ref_fb(struct vdec_vp9_inst *inst, struct vdec_fb *fb)
> int i;
> struct vdec_vp9_vsi *vsi = inst->vsi;
>
> + if (!fb)
> + return true;
> +
> for (i = 0; i < ARRAY_SIZE(vsi->sf_ref_fb); i++) {
> if (fb == &vsi->sf_ref_fb[i].fb)
> return true;
This won't work: if fb == NULL, then depending on whether
this function returns true or false, the code in vp9_swap_frm_bufs()
will crash in either vsi->frm_bufs[vsi->new_fb_idx].buf.fb->base_y.va
or in vp9_free_sf_ref_fb().
Unless you can show there really is a path through which fb can be NULL,
I don't think it is worth continuing with this.
Regards,
Hans
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-11-18 14:41 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-11 9:06 [PATCH v3] vcodec: mediatek: add check for NULL for vsi->frm_bufs[vsi->new_fb_idx].buf.fb in vp9_swap_frm_bufs Anastasia Belova
2022-11-18 14:39 ` Hans Verkuil
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).