[PATCH v7 17/19] media: meson: canvas: Fix Use-After-Free by linking canvas provider device

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between retrieving the supplier's driver data and establishing the device link, which allows the supplier to unbind and free the data before the link can protect it.

Pre-existing issues:
- [High] The device link fails to prevent the Use-After-Free in the `vdec` driver because V4L2 file descriptors outlive the consumer's driver unbind sequence.
--

--- Patch [17]: [PATCH v7 17/19] media: meson: canvas: Fix Use-After-Free by linking canvas provider device ---
commit bf6a22d368b30413921052e4cb659c5a279efaea
Author: Anand Moon <linux.amoon at gmail.com>

media: meson: canvas: Fix Use-After-Free by linking canvas provider device

This commit attempts to fix a Use-After-Free by establishing a device link
between the vdec consumer and the canvas provider. The link aims to
automatically unbind the consumer driver when the provider unbinds.

Closes: https://lore.kernel.org/all/20260530111022.9C6D71F00893@smtp.kernel.org

> diff --git a/drivers/soc/amlogic/meson-canvas.c b/drivers/soc/amlogic/meson-canvas.c
> index 79681afea8c61..5102a491bf778 100644
> --- a/drivers/soc/amlogic/meson-canvas.c
> +++ b/drivers/soc/amlogic/meson-canvas.c

[ ... ]

> @@ -70,9 +71,18 @@ struct meson_canvas *meson_canvas_get(struct device *dev)
>  	 * current state, this driver probe cannot return -EPROBE_DEFER
>  	 */
>  	canvas = dev_get_drvdata(&canvas_pdev->dev);

[Severity: High]
Is there a race condition between retrieving the driver data and creating
the device link?

If the canvas provider unbinds immediately after dev_get_drvdata() but
before device_link_add(), devres_release_all() will free the canvas data.

Because the driver core allows links to unbound suppliers, device_link_add()
would still succeed and create a dormant link, and then meson_canvas_get()
would return a freed pointer to the caller.

> -	put_device(&canvas_pdev->dev);
> -	if (!canvas)
> +	if (!canvas) {
> +		put_device(&canvas_pdev->dev);
>  		return ERR_PTR(-EINVAL);
> +	}
> +
> +	/* Establish device link to prevent Use-After-Free */
> +	link = device_link_add(dev, &canvas_pdev->dev,
> +			       DL_FLAG_AUTOREMOVE_CONSUMER);

[Severity: High]
This is a pre-existing issue, but does this device link fully resolve the
use-after-free for the vdec driver?

Because vdec is a V4L2 driver, userspace file descriptors can outlive the
consumer driver's unbind sequence. If a user holds the video device open:

1. The canvas provider unbinds.
2. The device link forces the vdec driver to unbind.
3. devres_release_all() frees the devm-managed canvas and vdec core contexts.
4. Userspace later closes the file descriptor.

When the file descriptor is closed, vdec_close() calls vdec_free_canvas(),
which attempts to dereference the already freed sess->core->canvas pointer.

> +	put_device(&canvas_pdev->dev);
> +	if (!link)
> +		return ERR_PTR(dev_err_probe(dev, -EINVAL,
> +				     "Failed to create device link canvas\n"));
>  
>  	return canvas;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713120840.17427-1-linux.amoon@gmail.com?part=17