]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
authorAlper Ak <alperyasinak1@gmail.com>
Sat, 27 Dec 2025 08:40:37 +0000 (11:40 +0300)
committerHans Verkuil <hverkuil+cisco@kernel.org>
Tue, 13 Jan 2026 08:41:59 +0000 (09:41 +0100)
commit81f8e0e6a2e115df9274d0289779f8fca694479c
tree739a7efd783b8dd65d55c22df3f42641b67319ad
parent5633ec763a2a18cef6c5ac9250e4f4b8786e7999
media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()

rga_get_frame() can return ERR_PTR(-EINVAL) when buffer type is
unsupported or invalid. rga_buf_init() does not check the return value
and unconditionally dereferences the pointer when accessing f->size.

Add proper ERR_PTR checking and return the error to prevent
dereferencing an invalid pointer.

Fixes: 6040702ade23 ("media: rockchip: rga: allocate DMA descriptors per buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
drivers/media/platform/rockchip/rga/rga-buf.c