Commit 7881cd68 authored by Sasha Levin's avatar Sasha Levin Committed by Linus Torvalds
Browse files

media: venus: Fix OPP table error handling 



The venus driver fails to check if dev_pm_opp_find_freq_{ceil,floor}()
returns an error pointer before calling dev_pm_opp_put(). This causes
a crash when OPP tables are not present in device tree.

Unable to handle kernel access to user memory outside uaccess routines
at virtual address 000000000000002e
...
pc : dev_pm_opp_put+0x1c/0x4c
lr : core_clks_enable+0x4c/0x16c [venus_core]

Add IS_ERR() checks before calling dev_pm_opp_put() to avoid
dereferencing error pointers.

Fixes: b179234b ("media: venus: pm_helpers: use opp-table for the frequency")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent adf12a39

drivers/media/platform/qcom/venus/pm_helpers.c

+8 −4
Original line number Diff line number Diff line
@@ -48,6 +48,7 @@ static int core_clks_enable(struct venus_core *core) 
	int ret;



	opp = dev_pm_opp_find_freq_ceil(dev, &freq);

	if (!IS_ERR(opp))

		dev_pm_opp_put(opp);



	for (i = 0; i < res->clks_num; i++) {
@@ -660,6 +661,7 @@ static int decide_core(struct venus_inst *inst) 
	/*TODO : divide this inst->load by work_route */



	opp = dev_pm_opp_find_freq_floor(dev, &max_freq);

	if (!IS_ERR(opp))

		dev_pm_opp_put(opp);



	min_loaded_core(inst, &min_coreid, &min_load, false);
@@ -1121,6 +1123,7 @@ static int load_scale_v4(struct venus_inst *inst) 
	freq = max(freq_core1, freq_core2);



	opp = dev_pm_opp_find_freq_floor(dev, &max_freq);

	if (!IS_ERR(opp))

		dev_pm_opp_put(opp);



	if (freq > max_freq) {
@@ -1131,6 +1134,7 @@ static int load_scale_v4(struct venus_inst *inst) 
	}



	opp = dev_pm_opp_find_freq_ceil(dev, &freq);

	if (!IS_ERR(opp))

		dev_pm_opp_put(opp);



set_freq: