From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C091E3BCD01 for ; Fri, 31 Jul 2026 14:10:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785507003; cv=none; b=EjAdGS28rHuDSa0RNq91Gk43TcAOkDiXhOrlvlFBTOhQy8yEHuwJTd10KMYAoEDMRB8JQTljhKYQp8dA1nsibsuUqbTrRKrk3Tqe8bYx9ZDTY+al3jmMrD5dqR/Srsy88Jp7nIxR7I4wwMXkoX/LyPHuj7oq5FDoj19PkVf+ijE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785507003; c=relaxed/simple; bh=5qY/6592ZN6hUTDDrFmtMOeCukxo2QrAHDQySYUCnho=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Aem25bgd7vLhpHJBdmf04aMIgpMAZFSa90xznmT/q0r8+YLnaqN3F0eE9Kgu6MyrjLyjHZltrWgBViJH6nhxJhuI7zWEx+ndnAf8gTZFsJz8s5W6AfdIggXZQw1SMVmzClG0QD5mjzOjf0FYilWrxjitYysGrPHGOegotMxW98U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=FezMA13M; arc=none smtp.client-ip=209.85.210.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FezMA13M" Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-84eb992a881so933268b3a.2 for ; Fri, 31 Jul 2026 07:10:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785507001; x=1786111801; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=DMmR98zYdJ3/hNNg4PWjtIFCt0ZaQpb0CEXhOAdim3c=; b=FezMA13MgDg58lUSdzbbMSuGVsz5I9e1zDUYPKcwTc5kn1YcC+c2znGK/NS0U5n0/M vsCMiMLZdMbeSU9WljbTtrgL5Eu3zSfXJ5w5As4JaCJa3SzxWCAseYxyc9/VAfgKnYlb ItTdf0sufhv4jzl8MbSryPGwAv9ASBgb9eoWzYnMnTzSYVLPC/0ld8eOo4Z5EtrWt+jO ImYuq9dNax90/kUS/ePwh0avXsFuGjIJTBw7TdhyeNNewC8LLLeg+kSme8Puw0aLiwBl 0p1g2y2Ph11CTc5cctgoD4SUgVwp6hUikVKRGg8eWeuCtIPt7OxjlP10vzYTSsW1AqQr 56yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785507001; x=1786111801; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DMmR98zYdJ3/hNNg4PWjtIFCt0ZaQpb0CEXhOAdim3c=; b=sQDsMNEAJHZ1pZz8DFgQUof4iLuwJmZ55z+Jrw5pJB6AVS9tBN4oxVGMoVt4v+lV+r O4pl1HRRl7tMveIrVB5JGFPVUqqQBdST81N5BJg2mM6XHErp8EPHypdoU9lB1Hnywgjn 2LX6/xTiMq6GpoYHNtfgM19L1tGUWau/Jiq9KKVs/jFovs7ojcwqY+XtMhfPF80SwD5s SjMDilk5O3IZONetHapT4Ilhv3R2Q4QpzBdQz0LxKma527qchMn4nGEo24U+UIrK0BHM 4i8OEAKzXCuKsbMbwPp+nNqdsLf7s6xFjSfX60PkizkwrQ11FsZYc6I4ZA24b5dXqs3a Ao9A== X-Forwarded-Encrypted: i=1; AHgh+RqalNJXTXgf+//hseJvP73Zn5te0LZE6puycE5qg9j0iMTSM8w1YhQyyuNS3dinZZhiST3/BW0SXMHvuJc=@vger.kernel.org X-Gm-Message-State: AOJu0Yz4oLdzlyreuciX7iwlJxGuszF4glCGNykoiLIcuFRt9SXgf5nF 3N03e5v30HVACZWO6qYJhidn6Rz03IwtRolXs6F+lJWt/mssT4cvuKPP X-Gm-Gg: AR+sD11pg2rfGjXQRTqj1ze6OlVHJKYLWugOdCYfP4gFt8MAc/faK3+qdWH0hEKIkX0 yhRgNj3M3USmJoxhgiVbr8PpDHC+VH9dmXxRUnFh69x8cPYUoeAgtoKEy6bhcOeY5NQLLGd4xDH xGKX/Few2wCQCBAAoT0ZuVEGyd3oIJeWdSAB9aCvI5Y35iwoAVqNI7rPZPFbU5mUizaTj6+ewfi Jf0H0BvFXYOOlqqxzW/1nlVspwtZTMXWnvU49XzTTDrGK6DSeDHRl/YfmUXpuuIeKBIuphd406t 7de+sbSvi6XWXsegFmH2EBDDHs5YYOO52jW0A8E5LPJVFn6+1v1liL1/PyqweDN1QdxNr5r+jIa cVo6WMseoMVpzBrQX1Fhx+vY1+IVO25bEIWKq4TF+ZTFYxok2sm/wtlyH0M2j6aPcM32zUHzF+9 Axld0W0SFibPJSzG0e51WSI5rMVXGgptk8/qA61jGMhL1dBBLNuMxYnEE0cpoDnp/8DpM3zn4C+ 4jZo0wGhjKexwiyAup0l5Sxn0o4CW1fEb+HFSz7iDwxZESCyvF+XXQDYNLVp44= X-Received: by 2002:a05:6a00:8997:b0:847:8b11:596d with SMTP id d2e1a72fcca58-84ed726695amr1276807b3a.41.1785507000538; Fri, 31 Jul 2026 07:10:00 -0700 (PDT) Received: from debian-rockchip-rock5b-rk3588.. ([2405:9800:b670:b64b:1c6e:95da:41c0:e7b6]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84edc29ebbcsm506071b3a.34.2026.07.31.07.09.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jul 2026 07:10:00 -0700 (PDT) From: Tharit Tangkijwanichakul To: Nicolas Dufresne , Benjamin Gaignard , Philipp Zabel , linux-media@vger.kernel.org Cc: Mauro Carvalho Chehab , Hans Verkuil , Ezequiel Garcia , Jernej Skrabec , linux-rockchip@lists.infradead.org, linux-kernel@vger.kernel.org, linux-kernel-mentees@lists.linux.dev, skhan@linuxfoundation.org, me@brighamcampbell.com, jkoolstra@xs4all.nl, Tharit Tangkijwanichakul Subject: [PATCH] media: hantro: Harden MPEG-2 control access against NULL Date: Fri, 31 Jul 2026 14:07:51 +0000 Message-ID: <20260731140751.1183-1-tharitt97@gmail.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The MPEG-2 sequence and picture controls are validated before a job is queued, so hantro_get_ctrl() is not expected to return NULL in hantro_g1_mpeg2_dec_run(). The controls are nonetheless dereferenced unconditionally. Harden the invariant by checking the sequence and picture controls with WARN_ON(). Found by code inspection. Fixes: f329e21e9dad ("media: uapi: mpeg2: Split sequence and picture parameters") Signed-off-by: Tharit Tangkijwanichakul --- Tested on a Rockchip RK3588 (Rock 5B) board with Fluster: MPEG-2 (MPEG2_VIDEO-MAIN): 23/43, unchanged drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c b/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c index e0d6bd0a6e44..6a942f4b8a2d 100644 --- a/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c +++ b/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c @@ -161,8 +161,13 @@ int hantro_g1_mpeg2_dec_run(struct hantro_ctx *ctx) seq = hantro_get_ctrl(ctx, V4L2_CID_STATELESS_MPEG2_SEQUENCE); + if (WARN_ON(!seq)) + return -EINVAL; + pic = hantro_get_ctrl(ctx, V4L2_CID_STATELESS_MPEG2_PICTURE); + if (WARN_ON(!pic)) + return -EINVAL; reg = G1_REG_DEC_AXI_RD_ID(0) | G1_REG_DEC_TIMEOUT_E(1) | -- 2.47.3