On Tue, Jan 25, 2022 at 01:06:10AM +0800, Zhou Qingyang wrote:
> In cx23885_417_register(), the return value of cx23885_video_dev_alloc()
> is assigned to dev->v4l_device() and there is a dereference of it after
> that. the return value of cx23885_video_dev_alloc() could be NULL on
> failure of allocation, which could lead to a NULL pointer dereference.
>
> Fix this bug by adding a NULL check of dev->v4l_device.
>
> This bug was found by a static analyzer.
>
> Builds with 'make allyesconfig' show no new warnings,
> and our static analyzer no longer warns about this code.
>
> Fixes: 453afdd9ce33 ("[media] cx23885: convert to vb2")
> Signed-off-by: Zhou Qingyang <zhou1615@xxxxxxx>
> ---
> The analysis employs differential checking to identify inconsistent
> security operations (e.g., checks or kfrees) between two code paths
> and confirms that the inconsistent operations are not recovered in the
> current function or the callers, so they constitute bugs.
>
> Note that, as a bug found by static analysis, it can be a false
> positive or hard to trigger. Multiple researchers have cross-reviewed
> the bug.
>
> drivers/media/pci/cx23885/cx23885-417.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/media/pci/cx23885/cx23885-417.c b/drivers/media/pci/cx23885/cx23885-417.c
> index 434677bd4ad1..fcc9c1117ed1 100644
> --- a/drivers/media/pci/cx23885/cx23885-417.c
> +++ b/drivers/media/pci/cx23885/cx23885-417.c
> @@ -1521,6 +1521,8 @@ int cx23885_417_register(struct cx23885_dev *dev)
> /* Allocate and initialize V4L video device */
> dev->v4l_device = cx23885_video_dev_alloc(tsport,
> dev->pci, &cx23885_mpeg_template, "mpeg");
> + if (!dev->v4l_device)
> + return -ENOMEM;
> q = &dev->vb2_mpegq;
> q->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
> q->io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ;
> --
> 2.25.1
>
As stated before, umn.edu is still not allowed to contribute to the
Linux kernel. Please work with your administration to resolve this
issue.
