On 30/11/2021 17:15, Zhou Qingyang wrote:
> In hexium_attach(dev, info), saa7146_vv_init() is called to allocate
> a new memory for dev->vv_data. saa7146_vv_release() will be called on
> failure of saa7146_register_device(). There is a dereference of
> dev->vv_data in saa7146_vv_release(), which could lead to a NULL
> pointer dereference on failure of saa7146_vv_init().
>
> Fix this bug by adding a check of saa7146_vv_init().
>
> This bug was found by a static analyzer. The analysis employs
> differential checking to identify inconsistent security operations
> (e.g., checks or kfrees) between two code paths and confirms that the
> inconsistent operations are not recovered in the current function or
> the callers, so they constitute bugs.
>
> Note that, as a bug found by static analysis, it can be a false
> positive or hard to trigger. Multiple researchers have cross-reviewed
> the bug.
>
> Builds with CONFIG_VIDEO_HEXIUM_GEMINI=m show no new warnings,
> and our static analyzer no longer warns about this code.
>
> Signed-off-by: Zhou Qingyang <zhou1615@xxxxxxx>
> ---
> drivers/media/pci/saa7146/hexium_gemini.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c
> index 2214c74bbbf1..549b1ddc59b5 100644
> --- a/drivers/media/pci/saa7146/hexium_gemini.c
> +++ b/drivers/media/pci/saa7146/hexium_gemini.c
> @@ -284,7 +284,11 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d
> hexium_set_input(hexium, 0);
> hexium->cur_input = 0;
>
> - saa7146_vv_init(dev, &vv_data);
> + ret = saa7146_vv_init(dev, &vv_data);
> + if (ret) {
> + kfree(hexium);
You need to call i2c_del_adapter(&hexium->i2c_adapter); as well.
Also, saa7146_vv_init() needs be fixed since it can return -1: that should
be -ENOMEM. Otherwise a -1 error code could be returned here, that's not
what you want.
Regards,
Hans
> + return ret;
> + }
>
> vv_data.vid_ops.vidioc_enum_input = vidioc_enum_input;
> vv_data.vid_ops.vidioc_g_input = vidioc_g_input;
>
