[2/4] media: davinci: vpif: fix unbalanced runtime PM enable

Message ID 20211222142025.30364-3-johan@kernel.org (mailing list archive)
State Accepted, archived
Delegated to: Hans Verkuil
Headers
Series media: davinci: vpif: fix use-after-free on driver unbind |

Commit Message

Johan Hovold Dec. 22, 2021, 2:20 p.m. UTC
  Make sure to disable runtime PM before returning on probe errors.

Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support")
Cc: stable@vger.kernel.org      # 4.12: 4024d6f601e3c
Cc: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/media/platform/davinci/vpif.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)
  

Comments

Prabhakar Jan. 4, 2022, 6:11 p.m. UTC | #1
Hi Johan,

Thank you for the patch.

On Wed, Dec 22, 2021 at 2:20 PM Johan Hovold <johan@kernel.org> wrote:
>
> Make sure to disable runtime PM before returning on probe errors.
>
> Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support")
> Cc: stable@vger.kernel.org      # 4.12: 4024d6f601e3c
> Cc: Kevin Hilman <khilman@baylibre.com>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
>  drivers/media/platform/davinci/vpif.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c
> index 9752a5ec36f7..1f5eacf48580 100644
> --- a/drivers/media/platform/davinci/vpif.c
> +++ b/drivers/media/platform/davinci/vpif.c
> @@ -428,6 +428,7 @@ static int vpif_probe(struct platform_device *pdev)
>         static struct resource *res_irq;
>         struct platform_device *pdev_capture, *pdev_display;
>         struct device_node *endpoint = NULL;
> +       int ret;
>
>         vpif_base = devm_platform_ioremap_resource(pdev, 0);
>         if (IS_ERR(vpif_base))
> @@ -456,8 +457,8 @@ static int vpif_probe(struct platform_device *pdev)
>         res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
>         if (!res_irq) {
>                 dev_warn(&pdev->dev, "Missing IRQ resource.\n");
> -               pm_runtime_put(&pdev->dev);
Maybe just add pm_runtime_disable(&pdev->dev); here, rest diff won't
be required.

Cheers,
Prabhakar

> -               return -EINVAL;
> +               ret = -EINVAL;
> +               goto err_put_rpm;
>         }
>
>         pdev_capture = devm_kzalloc(&pdev->dev, sizeof(*pdev_capture),
> @@ -491,6 +492,12 @@ static int vpif_probe(struct platform_device *pdev)
>         }
>
>         return 0;
> +
> +err_put_rpm:
> +       pm_runtime_put(&pdev->dev);
> +       pm_runtime_disable(&pdev->dev);
> +
> +       return ret;
>  }
>
>  static int vpif_remove(struct platform_device *pdev)
> --
> 2.32.0
>
  
Johan Hovold Jan. 31, 2022, 10:20 a.m. UTC | #2
Hi Lad,

and sorry about the late reply.

On Tue, Jan 04, 2022 at 06:11:08PM +0000, Lad, Prabhakar wrote:
> Hi Johan,
> 
> Thank you for the patch.
> 
> On Wed, Dec 22, 2021 at 2:20 PM Johan Hovold <johan@kernel.org> wrote:
> >
> > Make sure to disable runtime PM before returning on probe errors.
> >
> > Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support")
> > Cc: stable@vger.kernel.org      # 4.12: 4024d6f601e3c
> > Cc: Kevin Hilman <khilman@baylibre.com>
> > Signed-off-by: Johan Hovold <johan@kernel.org>
> > ---
> >  drivers/media/platform/davinci/vpif.c | 11 +++++++++--
> >  1 file changed, 9 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c
> > index 9752a5ec36f7..1f5eacf48580 100644
> > --- a/drivers/media/platform/davinci/vpif.c
> > +++ b/drivers/media/platform/davinci/vpif.c
> > @@ -428,6 +428,7 @@ static int vpif_probe(struct platform_device *pdev)
> >         static struct resource *res_irq;
> >         struct platform_device *pdev_capture, *pdev_display;
> >         struct device_node *endpoint = NULL;
> > +       int ret;
> >
> >         vpif_base = devm_platform_ioremap_resource(pdev, 0);
> >         if (IS_ERR(vpif_base))
> > @@ -456,8 +457,8 @@ static int vpif_probe(struct platform_device *pdev)
> >         res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
> >         if (!res_irq) {
> >                 dev_warn(&pdev->dev, "Missing IRQ resource.\n");
> > -               pm_runtime_put(&pdev->dev);
> Maybe just add pm_runtime_disable(&pdev->dev); here, rest diff won't
> be required.

I chose to do it this way in order to make the following patches
smaller and easier to review.

Thanks for reviewing.

Johan
  

Patch

diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c
index 9752a5ec36f7..1f5eacf48580 100644
--- a/drivers/media/platform/davinci/vpif.c
+++ b/drivers/media/platform/davinci/vpif.c
@@ -428,6 +428,7 @@  static int vpif_probe(struct platform_device *pdev)
 	static struct resource *res_irq;
 	struct platform_device *pdev_capture, *pdev_display;
 	struct device_node *endpoint = NULL;
+	int ret;
 
 	vpif_base = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(vpif_base))
@@ -456,8 +457,8 @@  static int vpif_probe(struct platform_device *pdev)
 	res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
 	if (!res_irq) {
 		dev_warn(&pdev->dev, "Missing IRQ resource.\n");
-		pm_runtime_put(&pdev->dev);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_put_rpm;
 	}
 
 	pdev_capture = devm_kzalloc(&pdev->dev, sizeof(*pdev_capture),
@@ -491,6 +492,12 @@  static int vpif_probe(struct platform_device *pdev)
 	}
 
 	return 0;
+
+err_put_rpm:
+	pm_runtime_put(&pdev->dev);
+	pm_runtime_disable(&pdev->dev);
+
+	return ret;
 }
 
 static int vpif_remove(struct platform_device *pdev)