linux-kernel - [PATCH] media: amphion: fix potential NULL deref in vpu_core_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250411184356.2910366-1-chenyuan0y@gmail.com>
Date: Fri, 11 Apr 2025 13:43:56 -0500
From: Chenyuan Yang <chenyuan0y@...il.com>
To: ming.qian@....com,
	eagle.zhou@....com,
	mchehab@...nel.org,
	shijie.qin@....com,
	hverkuil@...all.nl
Cc: linux-media@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Chenyuan Yang <chenyuan0y@...il.com>
Subject: [PATCH] media: amphion: fix potential NULL deref in vpu_core_parse_dt()

The result of memremap() may be NULL on failure, leading to a null
dereference in the subsequent memset(). Add explicit checks after
each memremap() call: if the firmware region fails to map, return
immediately; if the RPC region fails, unmap the firmware window before
returning.

This is similar to the commit 966d47e1f27c
("efi: fix potential NULL deref in efi_mem_reserve_persistent").

This is found by our static analysis tool KNighter.

Signed-off-by: Chenyuan Yang <chenyuan0y@...il.com>
Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
---
 drivers/media/platform/amphion/vpu_core.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index 8df85c14ab3f..26568987586d 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -586,7 +586,18 @@ static int vpu_core_parse_dt(struct vpu_core *core, struct device_node *np)
 	}
 
 	core->fw.virt = memremap(core->fw.phys, core->fw.length, MEMREMAP_WC);
+	if (!core->fw.virt) {
+		dev_err(core->dev, "failed to remap fw region\n");
+		of_node_put(node);
+		return -ENOMEM;
+	}
 	core->rpc.virt = memremap(core->rpc.phys, core->rpc.length, MEMREMAP_WC);
+	if (!core->rpc.virt) {
+		dev_err(core->dev, "failed to remap rpc region\n");
+		memunmap(core->fw.virt);
+		of_node_put(node);
+		return -ENOMEM;
+	}
 	memset(core->rpc.virt, 0, core->rpc.length);
 
 	ret = vpu_iface_check_memory_region(core, core->rpc.phys, core->rpc.length);
-- 
2.34.1