kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Ruslan Valiyev f0f5a1d705 media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si 
commit 7d8bf3d8f9 upstream.

syzbot reported a general protection fault in
vidtv_psi_ts_psi_write_into [1].

vidtv_mux_get_pid_ctx() can return NULL, but vidtv_mux_push_si() does
not check for this before dereferencing the returned pointer to access
the continuity counter. This leads to a general protection fault when
accessing a near-NULL address.

The root cause is that vidtv_mux_pid_ctx_init() does not check the
return value of vidtv_mux_create_pid_ctx_once() for PMT section PIDs.
If the allocation fails, the PID context is never created, but init
returns success. The subsequent vidtv_mux_push_si() call then gets
NULL from vidtv_mux_get_pid_ctx() and crashes.

Fix both the root cause (add error check in vidtv_mux_pid_ctx_init
for PMT PIDs) and add defensive NULL checks in vidtv_mux_push_si for
all vidtv_mux_get_pid_ctx() calls.

[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Workqueue: events vidtv_mux_tick
RIP: 0010:vidtv_psi_ts_psi_write_into+0x54a/0xbc0 drivers/media/test-drivers/vidtv/vidtv_psi.c:197
Call Trace:
 <TASK>
 vidtv_psi_table_header_write_into drivers/media/test-drivers/vidtv/vidtv_psi.c:799 [inline]
 vidtv_psi_pmt_write_into+0x3b2/0xa70 drivers/media/test-drivers/vidtv/vidtv_psi.c:1231
 vidtv_mux_push_si+0x932/0xe80 drivers/media/test-drivers/vidtv/vidtv_mux.c:196
 vidtv_mux_tick+0xe9b/0x1480 drivers/media/test-drivers/vidtv/vidtv_mux.c:408

Fixes: f90cf6079b ("media: vidtv: add a bridge driver")
Cc: stable@vger.kernel.org
Reported-by: syzbot+814c351d094f4f1a1b86@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=814c351d094f4f1a1b86
Signed-off-by: Ruslan Valiyev <linuxoid@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-07-04 13:39:37 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-16 13:39:11 +02:00
acpi ACPI: video: force native backlight on HP OMEN 16 (8A44) 2026-06-01 17:35:19 +02:00
amba amba: tegra-ahb: Fix device leak on SMMU enable 2026-01-19 13:09:54 +01:00
android binder: don't use %pK through printk 2026-03-04 07:20:16 -05:00
ata ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 2026-06-01 17:35:01 +02:00
atm atm: fore200e: fix use-after-free in tasklets during device removal 2026-03-04 07:20:36 -05:00
auxdisplay auxdisplay: arm-charlcd: fix release_mem_region() size 2026-03-04 07:19:20 -05:00
base pmdomain: core: Fix detach procedure for virtual devices in genpd 2026-06-19 13:33:44 +02:00
bcma Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
block use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
bluetooth Bluetooth: hci_qca: Convert timeout from jiffies to ms 2026-06-19 13:33:45 +02:00
bus fsl-mc: Use driver_set_override() instead of open-coding 2026-06-01 17:35:05 +02:00
cdrom cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() 2026-06-01 17:35:41 +02:00
char agp/amd64: Fix broken error propagation in agp_amd64_probe() 2026-07-04 13:39:37 +02:00
clk clk: qcom: dispcc-sc7180: Add missing MDSS resets 2026-06-01 17:35:37 +02:00
clocksource clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF 2026-03-04 07:20:00 -05:00
comedi comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() 2026-06-19 13:33:29 +02:00
connector net/connector: Add const qualifier to cb_id 2020-12-16 11:06:49 -08:00
counter counter: interrupt-cnt: Drop IRQF_NO_THREAD flag 2026-01-19 13:10:18 +01:00
cpufreq cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path 2026-06-01 17:35:11 +02:00
cpuidle cpuidle: powerpc: avoid double clear when breaking snooze 2026-06-01 17:35:22 +02:00
crypto crypto: caam - guard HMAC key hex dumps in hash_digest_key 2026-06-19 13:33:42 +02:00
cxl cxl/mem: Fix shutdown order 2023-11-20 11:08:27 +01:00
dax dax/kmem: Pass valid argument to memory_group_register_static 2023-07-23 13:47:17 +02:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() 2025-08-28 16:24:17 +02:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:14:27 +01:00
dma dmaengine: idxd: Fix not releasing workqueue on .release() 2026-06-19 13:33:22 +02:00
dma-buf dma-buf: insert memory barrier before updating num_fences 2025-09-09 18:50:23 +02:00
edac EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() 2026-03-04 07:19:27 -05:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: ptn5150: handle pending IRQ events during system resume 2026-06-01 17:35:22 +02:00
firewire firewire: nosy: Fix dma_free_coherent() size 2026-01-19 13:09:57 +01:00
firmware firmware: arm_ffa: Skip free_pages on RX buffer alloc failure 2026-06-01 17:35:49 +02:00
fpga fpga: dfl: use subsys_initcall to allow built-in drivers to be added 2026-03-04 07:20:25 -05:00
fsi use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpio: rockchip: convert bank->clk to devm_clk_get_enabled() 2026-06-19 13:33:24 +02:00
gpu drm/v3d: Skip CSD when it has zeroed workgroups 2026-07-04 13:39:37 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-07-05 09:14:23 +02:00
hid HID: core: Fix size_t specifier in hid_report_raw_event() 2026-06-19 13:33:32 +02:00
hsi HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition 2025-05-02 07:44:06 +02:00
hv Drivers: hv: vmbus: Add utility function for querying ring size 2025-07-10 15:57:36 +02:00
hwmon hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors 2026-06-01 17:35:49 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-12 11:07:41 +02:00
hwtracing coresight: etm3x: Fix cpulocked warning on cpuhp 2026-03-04 07:19:46 -05:00
i2c i2c: stub: Reject I2C block transfers with invalid length 2026-07-04 13:39:37 +02:00
i3c i3c: mipi-i3c-hci: fix IBI payload length calculation for final status 2026-06-01 17:35:35 +02:00
idle intel_idle: Allow loading ACPI tables for any family 2025-08-28 16:24:16 +02:00
iio iio: light: bh1780: fix PM runtime leak on error path 2026-07-04 13:39:37 +02:00
infiniband RDMA/bnxt_re: zero shared page before exposing to userspace 2026-07-04 13:39:37 +02:00
input Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard 2026-06-19 13:33:38 +02:00
interconnect interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node 2025-08-28 16:24:03 +02:00
iommu iommu, debugobjects: avoid gcc-16.1 section mismatch warnings 2026-06-19 13:33:28 +02:00
ipack ipack: ipoctal: fix module reference leak 2021-09-27 17:38:49 +02:00
irqchip irqchip/ath79-cpu: Remove unused function 2026-06-01 17:35:50 +02:00
isdn use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
leds leds: lgm-sso: Remove duplicate assignments for priv->mmap 2026-06-01 17:35:35 +02:00
macintosh macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse 2026-01-19 13:09:28 +01:00
mailbox mailbox: mailbox-test: make data_ready a per-instance variable 2026-06-01 17:35:41 +02:00
mcb mcb: fix a double free bug in chameleon_parse_gdd() 2025-05-02 07:44:31 +02:00
md dm cache policy smq: check allocation under invalidate lock 2026-06-19 13:33:33 +02:00
media media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si 2026-07-04 13:39:37 +02:00
memory memory: tegra30-emc: Fix dll_change check 2026-06-01 17:35:33 +02:00
memstick memstick: Add timeout to prevent indefinite waiting 2025-12-07 06:09:16 +09:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:51:02 +01:00
mfd mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() 2026-06-01 17:35:36 +02:00
misc use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
mmc mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration 2026-06-19 13:33:42 +02:00
most most: usb: fix double free on late probe failure 2025-12-07 06:09:35 +09:00
mtd mtd: spi-nor: sst: Fix write enable before AAI sequence 2026-06-19 13:33:42 +02:00
mux mux: gpio: Simplify code by using dev_err_probe() 2021-04-02 16:28:53 +02:00
net net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() 2026-07-04 13:39:37 +02:00
nfc nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems 2026-06-19 13:33:22 +02:00
ntb NTB: ntb_transport: Fix too small buffer for debugfs_name 2026-03-04 07:20:37 -05:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:25:05 +01:00
nvdimm nvdimm/bus: Fix potential use after free in asynchronous initialization 2026-04-18 10:33:17 +02:00
nvme use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
nvmem nvmem: core: improve range check for nvmem_cell_write() 2025-03-13 12:50:32 +01:00
of device property: Make modifications of fwnode "flags" thread safe 2026-06-01 17:35:13 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:21:23 -04:00
parisc parisc: Fix IRQ leak in LASI driver 2026-06-01 17:35:21 +02:00
parport parport: Fix race between port and client registration 2026-06-19 13:33:26 +02:00
pci PCI: tegra194: Disable direct speed change for Endpoint mode 2026-06-01 17:35:32 +02:00
pcmcia PCMCIA: Fix garbled log messages for KERN_CONT 2026-06-01 17:35:37 +02:00
perf perf: arm_spe: Prevent overflow in PERF_IDX2OFF() 2025-10-19 16:21:29 +02:00
phy phy: tegra: xusb: Fix per-pad high-speed termination calibration 2026-06-19 13:33:47 +02:00
pinctrl pinctrl: abx500: Fix type of 'argument' variable 2026-06-01 17:35:35 +02:00
platform platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL 2026-06-01 17:35:51 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-23 08:54:38 +01:00
power power: supply: max17042: avoid overflow when determining health 2026-06-01 17:35:23 +02:00
powercap powercap: fix sscanf() error return value handling 2026-01-19 13:10:19 +01:00
pps pps: fix warning in pps_register_cdev when register device fail 2025-10-19 16:21:33 +02:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. 2026-02-06 16:41:51 +01:00
pwm pwm: stm32: Always program polarity 2026-01-19 13:10:12 +01:00
rapidio rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() 2026-03-04 07:20:32 -05:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-07 11:52:26 +02:00
regulator regulator: core: fix locking in regulator_resolve_supply() error path 2026-07-04 13:39:37 +02:00
remoteproc remoteproc: mediatek: Unprepare SCP clock during system suspend 2026-04-18 10:33:11 +02:00
reset reset: brcmstb: Enable reset drivers for ARCH_BCM2835 2025-08-28 16:24:18 +02:00
rpmsg rpmsg: core: fix race in driver_override_show() and use core helper 2026-03-04 07:20:25 -05:00
rtc rtc: abx80x: Disable alarm feature if no interrupt attached 2026-06-01 17:35:40 +02:00
s390 Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" 2026-06-01 17:35:46 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2025-01-09 13:28:34 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-26 09:24:36 +01:00
slimbus slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock 2026-06-19 13:33:39 +02:00
soc soc: qcom: aoss: compare against normalized cooling state 2026-06-01 17:35:34 +02:00
soundwire soundwire: stream: restore params when prepare ports fail 2025-08-28 16:24:10 +02:00
spi spi: qup: fix error pointer deref after DMA setup failure 2026-06-19 13:33:47 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-07-05 09:14:20 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-09-04 13:23:20 +02:00
staging HID: pass the buffer size to hid_report_raw_event 2026-06-19 13:33:31 +02:00
target scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() 2026-06-19 13:33:49 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: prevent use-after-free when the client exits before the supplicant 2026-06-19 13:33:32 +02:00
thermal thermal: core: Fix thermal zone governor cleanup issues 2026-06-19 13:33:40 +02:00
thunderbolt thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() 2026-06-19 13:33:48 +02:00
tty vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write 2026-07-04 13:39:37 +02:00
uio uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe 2026-01-19 13:09:23 +01:00
usb xhci: fix memory leak regression when freeing xhci vdev devices depth first 2026-07-04 13:39:37 +02:00
vdpa vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check 2026-06-01 17:35:11 +02:00
vfio vfio/iommu_type1: replace kfree with kvfree 2026-07-04 13:39:37 +02:00
vhost use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
video fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter 2026-06-19 13:33:50 +02:00
virt minmax: add in_range() macro 2025-10-19 16:21:28 +02:00
virtio mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() 2026-01-19 13:10:10 +01:00
visorbus visorbus: fix error return code in visorchipset_init() 2021-06-04 15:27:26 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
vme vme: Fix error not catched in fake_init() 2022-12-31 13:14:30 +01:00
w1 w1: therm: Fix off-by-one buffer overflow in alarms_store 2026-02-06 16:42:02 +01:00
watchdog fix it87_wdt early reboot by reporting running timer 2026-03-04 07:20:16 -05:00
xen use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
zorro zorro: Drop useless (and hardly used) .driver member in struct zorro_dev 2021-08-05 14:37:04 +02:00
Kconfig firmware: include drivers/firmware/Kconfig unconditionally 2021-10-07 16:51:26 +02:00
Makefile virtio: always enter drivers/virtio/ 2021-12-22 09:32:39 +01:00