• Mauro Carvalho Chehab's avatar
    media: venus: don't de-reference NULL pointers at IRQ time · 686ee9b6
    Mauro Carvalho Chehab authored
    Smatch is warning that:
    	drivers/media/platform/qcom/venus/hfi_venus.c:1100 venus_isr() warn: variable dereferenced before check 'hdev' (see line 1097)
    
    The logic basically does:
    	hdev = to_hfi_priv(core);
    
    with is translated to:
    	hdev = core->priv;
    
    If the IRQ code can receive a NULL pointer for hdev, there's
    a bug there, as it will first try to de-reference the pointer,
    and then check if it is null.
    
    After looking at the code, it seems that this indeed can happen:
    Basically, the venus IRQ thread is started with:
    	devm_request_threaded_irq()
    So, it will only be freed after the driver unbinds.
    
    In order to prevent the IRQ code to work with freed data,
    the logic at venus_hfi_destroy() sets core->priv to NULL,
    which would make the IRQ code to ignore any pending IRQs.
    
    There is, however a race condition, as core->priv is set
    to NULL only after being freed. So, we need also to move the
    core->priv = NULL to happen earlier.
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
    686ee9b6
hfi_venus.c 39.5 KB