[PATCH 5.10] media: mtk-vcodec: potential null pointer deference in SCP

[PATCH 5.10] media: mtk-vcodec: potential null pointer deference in SCP

[Andrey Troshin]

From: Fullway Wang <fullwaywang@outlook.com>

[ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ]

The return value of devm_kzalloc() needs to be checked to avoid
NULL pointer deference. This is similar to CVE-2022-3113.

Link: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com
Signed-off-by: Fullway Wang <fullwaywang@outlook.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
[Andrey Troshin: backport fixs from
 drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c 
 to drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c]
Signed-off-by: Andrey Troshin <drtrosh@yandex-team.ru>
---
Backport fix for CVE-2024-40973
Link: https://nvd.nist.gov/vuln/detail/CVE-2024-40973
---
 drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c
index d8e66b645bd8..27f08b1d34d1 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c
@@ -65,6 +65,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(struct mtk_vcodec_dev *dev)
 	}
 
 	fw = devm_kzalloc(&dev->plat_dev->dev, sizeof(*fw), GFP_KERNEL);
+	if (!fw)
+		return ERR_PTR(-ENOMEM);
 	fw->type = SCP;
 	fw->ops = &mtk_vcodec_rproc_msg;
 	fw->scp = scp;
-- 
2.34.1

Re: [PATCH 5.10] media: mtk-vcodec: potential null pointer deference in SCP

[Sasha Levin]

>  	fw = devm_kzalloc(&dev->plat_dev->dev, sizeof(*fw), GFP_KERNEL);
> +	if (!fw)
> +		return ERR_PTR(-ENOMEM);

The backport itself is faithful, but the error path it adds returns
without dropping the scp reference taken just above it. That leak is
fixed upstream by 4936cd5817af ("media: mediatek: vcodec: Fix a resource
leak related to the scp device in FW initialization") (Fixes:
53dbe0850444, Cc: stable), and every tree carrying 53dbe0850444 already
carries the follow-up as well - taking this one alone would leave 5.10 as
the only stable tree in the leaky state.

Could you resend it as a 2-patch series covering both commits, targeting
5.15 as well as 5.10? 5.15 is missing both and holds the file at the same
path with an identical blob, so the same two patches apply there
unchanged.

-- 
Thanks,
Sasha