kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers/staging/media
History
Zhipeng Lu cc20c87b04 media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries 
[ Upstream commit 3b621e9e9e ]

The allocation failure of mycs->yuv_scaler_binary in load_video_binaries()
is followed with a dereference of mycs->yuv_scaler_binary after the
following call chain:

sh_css_pipe_load_binaries()
  |-> load_video_binaries(mycs->yuv_scaler_binary == NULL)
  |
  |-> sh_css_pipe_unload_binaries()
        |-> unload_video_binaries()

In unload_video_binaries(), it calls to ia_css_binary_unload with argument
&pipe->pipe_settings.video.yuv_scaler_binary[i], which refers to the
same memory slot as mycs->yuv_scaler_binary. Thus, a null-pointer
dereference is triggered.

Link: https://lore.kernel.org/r/20240118151303.3828292-1-alexious@zju.edu.cn

Fixes: a49d25364d ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-06-12 11:12:02 +02:00
..
atomisp media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries 2024-06-12 11:12:02 +02:00
av7110 media: dvb: symbol fixup for dvb_attach() 2023-09-09 08:15:11 +01:00
deprecated/atmel media: v4l: async: Set v4l2_device and subdev in async notifier init 2023-08-10 07:58:32 +02:00
imx media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak 2024-03-26 18:19:49 -04:00
ipu3 media: staging: ipu3-imgu: Set fields before media_entity_pads_init() 2024-04-03 15:28:15 +02:00
max96712 media: staging: max96712: Switch i2c driver back to use .probe() 2023-05-26 10:56:13 +01:00
meson/vdec media updates for v6.6-rc1 2023-09-01 12:21:32 -07:00
omap4iss media: staging: media: omap4iss: Convert to platform remove callback returning void 2023-04-15 08:11:41 +01:00
rkvdec media: rkvdec: Hook the (TRY_)DECODER_CMD stateless ioctls 2024-01-25 15:35:32 -08:00
sunxi media: cedrus: h265: Fix configuring bitstream size 2024-03-26 18:19:48 -04:00
tegra-video staging: media: tegra-video: fix infinite recursion regression 2023-10-02 10:02:53 +02:00
Kconfig media: Revert "media: saa7146: deprecate hexium_gemini/orion, mxb and ttpci" 2023-02-09 09:22:36 +01:00
Makefile media: Revert "media: saa7146: deprecate hexium_gemini/orion, mxb and ttpci" 2023-02-09 09:22:36 +01:00