From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Fullway Wang <fullwaywang@outlook.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Sasha Levin <sashal@kernel.org>,
tiffany.lin@mediatek.com, andrew-ct.chen@mediatek.com,
yunfei.dong@mediatek.com, matthias.bgg@gmail.com,
angelogioacchino.delregno@collabora.com,
hverkuil-cisco@xs4all.nl, nicolas.dufresne@collabora.com,
colin.i.king@gmail.com, linux-media@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-mediatek@lists.infradead.org
Subject: [PATCH AUTOSEL 6.8 18/20] media: mtk-vcodec: potential null pointer deference in SCP
Date: Mon, 27 May 2024 11:53:01 -0400 [thread overview]
Message-ID: <20240527155349.3864778-18-sashal@kernel.org> (raw)
In-Reply-To: <20240527155349.3864778-1-sashal@kernel.org>
From: Fullway Wang <fullwaywang@outlook.com>
[ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ]
The return value of devm_kzalloc() needs to be checked to avoid
NULL pointer deference. This is similar to CVE-2022-3113.
Link: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com
Signed-off-by: Fullway Wang <fullwaywang@outlook.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c
index 6bbe55de6ce9a..ff23b225db705 100644
--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c
+++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c
@@ -79,6 +79,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(void *priv, enum mtk_vcodec_fw_use
}
fw = devm_kzalloc(&plat_dev->dev, sizeof(*fw), GFP_KERNEL);
+ if (!fw)
+ return ERR_PTR(-ENOMEM);
fw->type = SCP;
fw->ops = &mtk_vcodec_rproc_msg;
fw->scp = scp;
--
2.43.0
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Fullway Wang <fullwaywang@outlook.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Sasha Levin <sashal@kernel.org>,
tiffany.lin@mediatek.com, andrew-ct.chen@mediatek.com,
yunfei.dong@mediatek.com, matthias.bgg@gmail.com,
angelogioacchino.delregno@collabora.com,
hverkuil-cisco@xs4all.nl, nicolas.dufresne@collabora.com,
colin.i.king@gmail.com, linux-media@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-mediatek@lists.infradead.org
Subject: [PATCH AUTOSEL 6.8 18/20] media: mtk-vcodec: potential null pointer deference in SCP
Date: Mon, 27 May 2024 11:53:01 -0400 [thread overview]
Message-ID: <20240527155349.3864778-18-sashal@kernel.org> (raw)
In-Reply-To: <20240527155349.3864778-1-sashal@kernel.org>
From: Fullway Wang <fullwaywang@outlook.com>
[ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ]
The return value of devm_kzalloc() needs to be checked to avoid
NULL pointer deference. This is similar to CVE-2022-3113.
Link: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com
Signed-off-by: Fullway Wang <fullwaywang@outlook.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c
index 6bbe55de6ce9a..ff23b225db705 100644
--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c
+++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c
@@ -79,6 +79,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(void *priv, enum mtk_vcodec_fw_use
}
fw = devm_kzalloc(&plat_dev->dev, sizeof(*fw), GFP_KERNEL);
+ if (!fw)
+ return ERR_PTR(-ENOMEM);
fw->type = SCP;
fw->ops = &mtk_vcodec_rproc_msg;
fw->scp = scp;
--
2.43.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2024-05-27 15:55 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-27 15:52 [PATCH AUTOSEL 6.8 01/20] drm/amd/display: Exit idle optimizations before HDCP execution Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 02/20] drm/amd/display: Workaround register access in idle race with cursor Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 03/20] ima: Fix use-after-free on a dentry's dname.name Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 04/20] platform/x86: toshiba_acpi: Add quirk for buttons on Z830 Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 05/20] cgroup/cpuset: Make cpuset hotplug processing synchronous Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 06/20] drm/amd/display: add root clock control function pointer to fix display corruption Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 07/20] ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14 Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 08/20] ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 09/20] drm/lima: add mask irq callback to gp and pp Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 10/20] drm/lima: mask irqs in timeout path before hard reset Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 11/20] platform/x86: x86-android-tablets: Unregister devices in reverse order Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 12/20] platform/x86: x86-android-tablets: Add Lenovo Yoga Tablet 2 Pro 1380F/L data Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 13/20] ALSA: hda/realtek: Add quirks for Lenovo 13X Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 14/20] media: lgdt3306a: Add a check against null-pointer-def Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 15/20] powerpc: make fadump resilient with memory add/remove events Sasha Levin
2024-05-27 15:52 ` Sasha Levin
2024-05-27 15:52 ` [PATCH AUTOSEL 6.8 16/20] powerpc/pseries: Enforce hcall result buffer validity and size Sasha Levin
2024-05-27 15:52 ` Sasha Levin
2024-05-27 15:53 ` [PATCH AUTOSEL 6.8 17/20] media: intel/ipu6: Fix build with !ACPI Sasha Levin
2024-05-27 15:53 ` Sasha Levin [this message]
2024-05-27 15:53 ` [PATCH AUTOSEL 6.8 18/20] media: mtk-vcodec: potential null pointer deference in SCP Sasha Levin
2024-05-27 15:53 ` [PATCH AUTOSEL 6.8 19/20] powerpc/io: Avoid clang null pointer arithmetic warnings Sasha Levin
2024-05-27 15:53 ` Sasha Levin
2024-05-27 15:53 ` [PATCH AUTOSEL 6.8 20/20] platform/x86: p2sb: Don't init until unassigned resources have been assigned Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240527155349.3864778-18-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=andrew-ct.chen@mediatek.com \
--cc=angelogioacchino.delregno@collabora.com \
--cc=colin.i.king@gmail.com \
--cc=fullwaywang@outlook.com \
--cc=hverkuil-cisco@xs4all.nl \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=matthias.bgg@gmail.com \
--cc=mchehab@kernel.org \
--cc=nicolas.dufresne@collabora.com \
--cc=stable@vger.kernel.org \
--cc=tiffany.lin@mediatek.com \
--cc=yunfei.dong@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.