Re: [PATCH] media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()

[Hans Verkuil]

On 30/11/2021 17:15, Zhou Qingyang wrote:
> In hexium_attach(dev, info), saa7146_vv_init() is called to allocate
> a new memory for dev->vv_data. saa7146_vv_release() will be called on
> failure of saa7146_register_device(). There is a dereference of
> dev->vv_data in saa7146_vv_release(), which could lead to a NULL
> pointer dereference on failure of saa7146_vv_init().
> 
> Fix this bug by adding a check of saa7146_vv_init().
> 
> This bug was found by a static analyzer. The analysis employs
> differential checking to identify inconsistent security operations
> (e.g., checks or kfrees) between two code paths and confirms that the
> inconsistent operations are not recovered in the current function or
> the callers, so they constitute bugs.
> 
> Note that, as a bug found by static analysis, it can be a false
> positive or hard to trigger. Multiple researchers have cross-reviewed
> the bug.
> 
> Builds with CONFIG_VIDEO_HEXIUM_GEMINI=m show no new warnings,
> and our static analyzer no longer warns about this code.
> 
> Signed-off-by: Zhou Qingyang <zhou1615@xxxxxxx>
> ---
>  drivers/media/pci/saa7146/hexium_gemini.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c
> index 2214c74bbbf1..549b1ddc59b5 100644
> --- a/drivers/media/pci/saa7146/hexium_gemini.c
> +++ b/drivers/media/pci/saa7146/hexium_gemini.c
> @@ -284,7 +284,11 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d
>  	hexium_set_input(hexium, 0);
>  	hexium->cur_input = 0;
>  
> -	saa7146_vv_init(dev, &vv_data);
> +	ret = saa7146_vv_init(dev, &vv_data);
> +	if (ret) {
> +		kfree(hexium);

You need to call i2c_del_adapter(&hexium->i2c_adapter); as well.

Also, saa7146_vv_init() needs be fixed since it can return -1: that should
be -ENOMEM. Otherwise a -1 error code could be returned here, that's not
what you want.

Regards,

	Hans

> +		return ret;
> +	}
>  
>  	vv_data.vid_ops.vidioc_enum_input = vidioc_enum_input;
>  	vv_data.vid_ops.vidioc_g_input = vidioc_g_input;
>