Re: [PATCH] media: imx-jpeg: avoid double free on video register failure

[Mirela Rabulea]

> [You don't often get email from lgs201920130244@xxxxxxxxx. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> Caution: This is an external email. Please take care when clicking links or opening attachments. When in doubt, report the message using the 'Report this email' button
>
>
> mxc_jpeg_probe() allocates a video_device with video_device_alloc() and
> releases it from the err_vdev_register error path if
> video_register_device() fails.
>
> This can double free the video_device when __video_register_device()
> reaches device_register() and that call fails:
>
>    video_register_device()
>      -> __video_register_device()
>         -> device_register() fails
>            -> put_device(&vdev->dev)
>               -> v4l2_device_release()
>                  -> vdev->release(vdev)
>                     -> video_device_release(vdev)
>
>    mxc_jpeg_probe()
>      -> err_vdev_register
>         -> video_device_release(jpeg->dec_vdev)
>
> Use video_device_release_empty() while registering the device so that
> registration failure paths do not free jpeg->dec_vdev through
> vdev->release(). mxc_jpeg_probe() then releases jpeg->dec_vdev exactly
> once from err_vdev_register. Restore video_device_release() after
> successful registration so the registered device keeps its normal lifetime
> handling.
>
> This issue was found by a static analysis tool I am developing.
>
> Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>

Hi Guangshuo,

sorry for the late response, so I assume this patch will be dropped in 
favor of a fix in v4l2-core, as per discussions here?:

https://lore.kernel.org/linux-media/20260519090819.1041314-1-lgs201920130244@xxxxxxxxx/

Thanks,

Mirela

> ---
>   drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> index b442dcba02e7..fe8a373576ef 100644
> --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> @@ -2943,7 +2943,7 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
>          jpeg->dec_vdev->fops = &mxc_jpeg_fops;
>          jpeg->dec_vdev->ioctl_ops = &mxc_jpeg_ioctl_ops;
>          jpeg->dec_vdev->minor = -1;
> -       jpeg->dec_vdev->release = video_device_release;
> +       jpeg->dec_vdev->release = video_device_release_empty;
>          jpeg->dec_vdev->lock = &jpeg->lock; /* lock for ioctl serialization */
>          jpeg->dec_vdev->v4l2_dev = &jpeg->v4l2_dev;
>          jpeg->dec_vdev->vfl_dir = VFL_DIR_M2M;
> @@ -2962,6 +2962,8 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
>                  dev_err(dev, "failed to register video device\n");
>                  goto err_vdev_register;
>          }
> +       jpeg->dec_vdev->release = video_device_release;
> +
>          if (mode == MXC_JPEG_ENCODE)
>                  v4l2_info(&jpeg->v4l2_dev,
>                            "encoder device registered as /dev/video%d (%d,%d)\n",
> --
> 2.43.0