On Sun Sep 6 10:24:24 2026 +0100, David Carlier wrote:
> mali_c55_params_buf_prepare() copies the parameters buffer supplied by
> userspace into the driver's scratch buffer, using the result of
> vb2_plane_vaddr() as the source without checking it. The queue accepts
> VB2_DMABUF, and vb2_dc_vaddr() returns NULL for an exporter that cannot
> be vmapped, so the memcpy() dereferences NULL.
>
> Reject the buffer at prepare time instead.
>
> Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
> Cc: [email protected]
> Signed-off-by: David Carlier <[email protected]>
> Reviewed-by: Jacopo Mondi <[email protected]>
> Signed-off-by: Jacopo Mondi <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/arm/mali-c55/mali-c55-params.c | 3 +++
1 file changed, 3 insertions(+)
---
diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-params.c
b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
index 70106276b7e4..16e895e3488e 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
@@ -710,6 +710,9 @@ static int mali_c55_params_buf_prepare(struct vb2_buffer
*vb)
struct mali_c55 *mali_c55 = params->mali_c55;
int ret;
+ if (!config)
+ return -EFAULT;
+
ret = v4l2_isp_params_validate_buffer_size(mali_c55->dev, vb,
v4l2_isp_buffer_size(MALI_C55_PARAMS_MAX_SIZE));
if (ret)
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
