github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-10 17:11:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: mali-c55: Check the parameters buffer address before copying

Browse Source 
mali_c55_params_buf_prepare() copies the parameters buffer supplied by
userspace into the driver's scratch buffer, using the result of
vb2_plane_vaddr() as the source without checking it. The queue accepts
VB2_DMABUF, and vb2_dc_vaddr() returns NULL for an exporter that cannot
be vmapped, so the memcpy() dereferences NULL.

Reject the buffer at prepare time instead.

Fixes: d5f281f3dd ("media: mali-c55: Add Mali-C55 ISP driver")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
David Carlier 2026-09-06 10:24:24 +01:00 committed by Hans Verkuil
parent 5f09aaf3fb
commit 901d72d26b
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/media/platform/arm/mali-c55/mali-c55-params.c
View File

@ -710,6 +710,9 @@ static int mali_c55_params_buf_prepare(struct vb2_buffer *vb)
struct mali_c55 *mali_c55 = params->mali_c55;
int ret;
if (!config)
return -EFAULT;
ret = v4l2_isp_params_validate_buffer_size(mali_c55->dev, vb,
v4l2_isp_buffer_size(MALI_C55_PARAMS_MAX_SIZE));
if (ret)