| From 4a6efc85d8a6d2105411b6280df9e981f3eda27f Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 18 Jan 2024 16:13:00 +0100 |
| Subject: media: atomisp: ssh_css: Fix a null-pointer dereference in |
| load_video_binaries |
| |
| From: Zhipeng Lu <alexious@zju.edu.cn> |
| |
| [ Upstream commit 3b621e9e9e148c0928ab109ac3d4b81487469acb ] |
| |
| The allocation failure of mycs->yuv_scaler_binary in load_video_binaries() |
| is followed with a dereference of mycs->yuv_scaler_binary after the |
| following call chain: |
| |
| sh_css_pipe_load_binaries() |
| |-> load_video_binaries(mycs->yuv_scaler_binary == NULL) |
| | |
| |-> sh_css_pipe_unload_binaries() |
| |-> unload_video_binaries() |
| |
| In unload_video_binaries(), it calls to ia_css_binary_unload with argument |
| &pipe->pipe_settings.video.yuv_scaler_binary[i], which refers to the |
| same memory slot as mycs->yuv_scaler_binary. Thus, a null-pointer |
| dereference is triggered. |
| |
| Link: https://lore.kernel.org/r/20240118151303.3828292-1-alexious@zju.edu.cn |
| |
| Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") |
| Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> |
| Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> |
| Signed-off-by: Hans de Goede <hdegoede@redhat.com> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/staging/media/atomisp/pci/sh_css.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c |
| index 938a4ea89c590..8c30191b21a77 100644 |
| --- a/drivers/staging/media/atomisp/pci/sh_css.c |
| +++ b/drivers/staging/media/atomisp/pci/sh_css.c |
| @@ -4690,6 +4690,7 @@ static int load_video_binaries(struct ia_css_pipe *pipe) |
| sizeof(struct ia_css_binary), |
| GFP_KERNEL); |
| if (!mycs->yuv_scaler_binary) { |
| + mycs->num_yuv_scaler = 0; |
| err = -ENOMEM; |
| return err; |
| } |
| -- |
| 2.43.0 |
| |
