• Zhou Qingyang's avatar
    media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() · 3af86b04
    Zhou Qingyang authored
    In hexium_attach(dev, info), saa7146_vv_init() is called to allocate
    a new memory for dev->vv_data. saa7146_vv_release() will be called on
    failure of saa7146_register_device(). There is a dereference of
    dev->vv_data in saa7146_vv_release(), which could lead to a NULL
    pointer dereference on failure of saa7146_vv_init().
    
    Fix this bug by adding a check of saa7146_vv_init().
    
    This bug was found by a static analyzer. The analysis employs
    differential checking to identify inconsistent security operations
    (e.g., checks or kfrees) between two code paths and confirms that the
    inconsistent operations are not recovered in the current function or
    the callers, so they constitute bugs.
    
    Note that, as a bug found by static analysis, it can be a false
    positive or hard to trigger. Multiple researchers have cross-reviewed
    the bug.
    
    Builds with CONFIG_VIDEO_HEXIUM_GEMINI=m show no new warnings,
    and our static analyzer no longer warns about this code.
    
    Link: https://lore.kernel.org/linux-media/20211203154030.111210-1-zhou1615@umn.eduSigned-off-by: default avatarZhou Qingyang <zhou1615@umn.edu>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
    3af86b04
hexium_gemini.c 11.4 KB