media: venus: core: Fix a potential NULL pointer dereference in an error handling path
Commit Message
The normal path of the function makes the assumption that
'pm_ops->core_power' may be NULL.
We should make the same assumption in the error handling path or a NULL
pointer dereference may occur.
Add the missing test before calling 'pm_ops->core_power'
Fixes: 9e8efdb57879 ("media: venus: core: vote for video-mem path")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
drivers/media/platform/qcom/venus/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
Comments
Le 12/08/2021 à 07:14, Christophe JAILLET a écrit :
> The normal path of the function makes the assumption that
> 'pm_ops->core_power' may be NULL.
> We should make the same assumption in the error handling path or a NULL
> pointer dereference may occur.
>
> Add the missing test before calling 'pm_ops->core_power'
>
> Fixes: 9e8efdb57879 ("media: venus: core: vote for video-mem path")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> ---
> drivers/media/platform/qcom/venus/core.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
> index 91b15842c555..84cd92628cfd 100644
> --- a/drivers/media/platform/qcom/venus/core.c
> +++ b/drivers/media/platform/qcom/venus/core.c
> @@ -472,7 +472,8 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)
> err_video_path:
> icc_set_bw(core->cpucfg_path, kbps_to_icc(1000), 0);
> err_cpucfg_path:
> - pm_ops->core_power(core, POWER_ON);
> + if (pm_ops->core_power)
> + pm_ops->core_power(core, POWER_ON);
>
> return ret;
> }
>
Hi,
this was sent duing the summer holidays. Since then, a few other patches
have been merged in linux-next for this file.
So, this is a polite reminder.
CJ
@@ -472,7 +472,8 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)
err_video_path:
icc_set_bw(core->cpucfg_path, kbps_to_icc(1000), 0);
err_cpucfg_path:
- pm_ops->core_power(core, POWER_ON);
+ if (pm_ops->core_power)
+ pm_ops->core_power(core, POWER_ON);
return ret;
}