* [PATCH] media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
@ 2025-12-27 8:40 Alper Ak
2026-01-06 14:33 ` Michael Tretter
0 siblings, 1 reply; 2+ messages in thread
From: Alper Ak @ 2025-12-27 8:40 UTC (permalink / raw)
To: hverkuil, mchehab
Cc: Alper Ak, Jacob Chen, Ezequiel Garcia, Heiko Stuebner,
Michael Tretter, linux-media, linux-rockchip, linux-arm-kernel,
linux-kernel
rga_get_frame() can return ERR_PTR(-EINVAL) when buffer type is
unsupported or invalid. rga_buf_init() does not check the return value
and unconditionally dereferences the pointer when accessing f->size.
Add proper ERR_PTR checking and return the error to prevent
dereferencing an invalid pointer.
Fixes: 6040702ade23 ("media: rockchip: rga: allocate DMA descriptors per buffer")
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
---
drivers/media/platform/rockchip/rga/rga-buf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/rockchip/rga/rga-buf.c b/drivers/media/platform/rockchip/rga/rga-buf.c
index 730bdf98565a..bb575873f2b2 100644
--- a/drivers/media/platform/rockchip/rga/rga-buf.c
+++ b/drivers/media/platform/rockchip/rga/rga-buf.c
@@ -80,6 +80,9 @@ static int rga_buf_init(struct vb2_buffer *vb)
struct rga_frame *f = rga_get_frame(ctx, vb->vb2_queue->type);
size_t n_desc = 0;
+ if (IS_ERR(f))
+ return PTR_ERR(f);
+
n_desc = DIV_ROUND_UP(f->size, PAGE_SIZE);
rbuf->n_desc = n_desc;
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
2025-12-27 8:40 [PATCH] media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() Alper Ak
@ 2026-01-06 14:33 ` Michael Tretter
0 siblings, 0 replies; 2+ messages in thread
From: Michael Tretter @ 2026-01-06 14:33 UTC (permalink / raw)
To: Alper Ak
Cc: hverkuil, mchehab, Jacob Chen, Ezequiel Garcia, Heiko Stuebner,
linux-media, linux-rockchip, linux-arm-kernel, linux-kernel
On Sat, 27 Dec 2025 11:40:37 +0300, Alper Ak wrote:
> rga_get_frame() can return ERR_PTR(-EINVAL) when buffer type is
> unsupported or invalid. rga_buf_init() does not check the return value
> and unconditionally dereferences the pointer when accessing f->size.
>
> Add proper ERR_PTR checking and return the error to prevent
> dereferencing an invalid pointer.
>
> Fixes: 6040702ade23 ("media: rockchip: rga: allocate DMA descriptors per buffer")
> Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
> ---
> drivers/media/platform/rockchip/rga/rga-buf.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/media/platform/rockchip/rga/rga-buf.c b/drivers/media/platform/rockchip/rga/rga-buf.c
> index 730bdf98565a..bb575873f2b2 100644
> --- a/drivers/media/platform/rockchip/rga/rga-buf.c
> +++ b/drivers/media/platform/rockchip/rga/rga-buf.c
> @@ -80,6 +80,9 @@ static int rga_buf_init(struct vb2_buffer *vb)
> struct rga_frame *f = rga_get_frame(ctx, vb->vb2_queue->type);
> size_t n_desc = 0;
>
> + if (IS_ERR(f))
> + return PTR_ERR(f);
> +
> n_desc = DIV_ROUND_UP(f->size, PAGE_SIZE);
>
> rbuf->n_desc = n_desc;
> --
> 2.43.0
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-01-06 14:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-27 8:40 [PATCH] media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() Alper Ak
2026-01-06 14:33 ` Michael Tretter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox