tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

media: venus: Fix OPP table error handling

The venus driver fails to check if dev_pm_opp_find_freq_{ceil,floor}()
returns an error pointer before calling dev_pm_opp_put(). This causes
a crash when OPP tables are not present in device tree.

Unable to handle kernel access to user memory outside uaccess routines
at virtual address 000000000000002e
...
pc : dev_pm_opp_put+0x1c/0x4c
lr : core_clks_enable+0x4c/0x16c [venus_core]

Add IS_ERR() checks before calling dev_pm_opp_put() to avoid
dereferencing error pointers.

Fixes: b179234b5e59 ("media: venus: pm_helpers: use opp-table for the frequency")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Sasha Levin and committed by
Linus Torvalds 7881cd68 adf12a39

+8 -4
+8 -4
drivers/media/platform/qcom/venus/pm_helpers.c
··· 48 48 int ret; 49 49 50 50 opp = dev_pm_opp_find_freq_ceil(dev, &freq); 51 - dev_pm_opp_put(opp); 51 + if (!IS_ERR(opp)) 52 + dev_pm_opp_put(opp); 52 53 53 54 for (i = 0; i < res->clks_num; i++) { 54 55 if (IS_V6(core)) { ··· 661 660 /*TODO : divide this inst->load by work_route */ 662 661 663 662 opp = dev_pm_opp_find_freq_floor(dev, &max_freq); 664 - dev_pm_opp_put(opp); 663 + if (!IS_ERR(opp)) 664 + dev_pm_opp_put(opp); 665 665 666 666 min_loaded_core(inst, &min_coreid, &min_load, false); 667 667 min_loaded_core(inst, &min_lp_coreid, &min_lp_load, true); ··· 1123 1121 freq = max(freq_core1, freq_core2); 1124 1122 1125 1123 opp = dev_pm_opp_find_freq_floor(dev, &max_freq); 1126 - dev_pm_opp_put(opp); 1124 + if (!IS_ERR(opp)) 1125 + dev_pm_opp_put(opp); 1127 1126 1128 1127 if (freq > max_freq) { 1129 1128 dev_dbg(dev, VDBGL "requested clock rate: %lu scaling clock rate : %lu\n", ··· 1134 1131 } 1135 1132 1136 1133 opp = dev_pm_opp_find_freq_ceil(dev, &freq); 1137 - dev_pm_opp_put(opp); 1134 + if (!IS_ERR(opp)) 1135 + dev_pm_opp_put(opp); 1138 1136 1139 1137 set_freq: 1140 1138