* [PATCH 6.1.y] media: mtk-vcodec: potential null pointer deference in SCP
@ 2025-01-24 4:06 Imkanmod Khan
0 siblings, 0 replies; 4+ messages in thread
From: Imkanmod Khan @ 2025-01-24 4:06 UTC (permalink / raw)
To: stable
Cc: patches, mchehab, fullwaywang, gregkh, linux-kernel, tiffany.lin,
andrew-ct.chen, yunfei.dong, matthias.bgg, linux-media,
linux-arm-kernel, linux-mediatek, Imkanmod Khan
From: Fullway Wang <fullwaywang@outlook.com>
[ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ]
The return value of devm_kzalloc() needs to be checked to avoid
NULL pointer deference. This is similar to CVE-2022-3113.
Link: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com
Signed-off-by: Fullway Wang <fullwaywang@outlook.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
[ To fix CVE: CVE-2024-40973, modified the file path from drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c
to drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c and minor conflict resolution ]
Signed-off-by: Imkanmod Khan <imkanmodkhan@gmail.com>
---
drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
index d8e66b645bd8..27f08b1d34d1 100644
--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
+++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
@@ -65,6 +65,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(struct mtk_vcodec_dev *dev)
}
fw = devm_kzalloc(&dev->plat_dev->dev, sizeof(*fw), GFP_KERNEL);
+ if (!fw)
+ return ERR_PTR(-ENOMEM);
fw->type = SCP;
fw->ops = &mtk_vcodec_rproc_msg;
fw->scp = scp;
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 6.1.y] media: mtk-vcodec: potential null pointer deference in SCP
@ 2025-02-25 3:08 jianqi.ren.cn
0 siblings, 0 replies; 4+ messages in thread
From: jianqi.ren.cn @ 2025-02-25 3:08 UTC (permalink / raw)
To: stable
Cc: patches, mchehab, fullwaywang, gregkh, linux-kernel, tiffany.lin,
andrew-ct.chen, yunfei.dong, matthias.bgg, linux-media,
linux-arm-kernel, linux-mediatek
From: Fullway Wang <fullwaywang@outlook.com>
[ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ]
The return value of devm_kzalloc() needs to be checked to avoid
NULL pointer deference. This is similar to CVE-2022-3113.
Link: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com
Signed-off-by: Fullway Wang <fullwaywang@outlook.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
[ To fix CVE-2024-40973, change the file path from drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c
to drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c and minor conflict resolution ]
Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
Signed-off-by: He Zhe <zhe.he@windriver.com>
---
Verified the build test.
---
drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
index d8e66b645bd8..27f08b1d34d1 100644
--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
+++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
@@ -65,6 +65,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(struct mtk_vcodec_dev *dev)
}
fw = devm_kzalloc(&dev->plat_dev->dev, sizeof(*fw), GFP_KERNEL);
+ if (!fw)
+ return ERR_PTR(-ENOMEM);
fw->type = SCP;
fw->ops = &mtk_vcodec_rproc_msg;
fw->scp = scp;
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 6.1.y] media: mtk-vcodec: potential null pointer deference in SCP
@ 2024-12-11 10:02 jianqi.ren.cn
0 siblings, 0 replies; 4+ messages in thread
From: jianqi.ren.cn @ 2024-12-11 10:02 UTC (permalink / raw)
To: fullwaywang, gregkh
Cc: patches, mchehab, stable, linux-kernel, tiffany.lin,
andrew-ct.chen, yunfei.dong, matthias.bgg, linux-media,
linux-arm-kernel, linux-mediatek
From: Fullway Wang <fullwaywang@outlook.com>
[ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ]
The return value of devm_kzalloc() needs to be checked to avoid
NULL pointer deference. This is similar to CVE-2022-3113.
Link: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com
Signed-off-by: Fullway Wang <fullwaywang@outlook.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
---
drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
index d8e66b645bd8..27f08b1d34d1 100644
--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
+++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
@@ -65,6 +65,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(struct mtk_vcodec_dev *dev)
}
fw = devm_kzalloc(&dev->plat_dev->dev, sizeof(*fw), GFP_KERNEL);
+ if (!fw)
+ return ERR_PTR(-ENOMEM);
fw->type = SCP;
fw->ops = &mtk_vcodec_rproc_msg;
fw->scp = scp;
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 6.1.y] media: mtk-vcodec: potential null pointer deference in SCP
@ 2024-12-09 6:54 jianqi.ren.cn
0 siblings, 0 replies; 4+ messages in thread
From: jianqi.ren.cn @ 2024-12-09 6:54 UTC (permalink / raw)
To: fullwaywang, gregkh
Cc: stable, linux-kernel, tiffany.lin, andrew-ct.chen, yunfei.dong,
mchehab, matthias.bgg, linux-media, linux-arm-kernel,
linux-mediatek
From: Fullway Wang <fullwaywang@outlook.com>
[ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ]
The return value of devm_kzalloc() needs to be checked to avoid
NULL pointer deference. This is similar to CVE-2022-3113.
Link: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com
Signed-off-by: Fullway Wang <fullwaywang@outlook.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
---
drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
index d8e66b645bd8..27f08b1d34d1 100644
--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
+++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c
@@ -65,6 +65,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(struct mtk_vcodec_dev *dev)
}
fw = devm_kzalloc(&dev->plat_dev->dev, sizeof(*fw), GFP_KERNEL);
+ if (!fw)
+ return ERR_PTR(-ENOMEM);
fw->type = SCP;
fw->ops = &mtk_vcodec_rproc_msg;
fw->scp = scp;
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-02-25 3:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-01-24 4:06 [PATCH 6.1.y] media: mtk-vcodec: potential null pointer deference in SCP Imkanmod Khan
-- strict thread matches above, loose matches on Subject: below --
2025-02-25 3:08 jianqi.ren.cn
2024-12-11 10:02 jianqi.ren.cn
2024-12-09 6:54 jianqi.ren.cn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox