From nobody Sat Jul 25 20:48:39 2026 Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A7DBC34C141 for ; Mon, 13 Jul 2026 17:39:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783964345; cv=none; b=iDhjQPM8yn7A7Rbu+bJVj7nYSsWhMuLImIXpBdYDo7vZ4M6QBls072cz2doAHbGBa7WC64h91KVQn8FZ5/gxKHVuzNXLf5qYGIZM+xuprjrPOLbmY5ZBX1qrO05ZyjqUQl4Wg+K8XSXQVQV6olRq0aCqPYP1Sb7jDNx26/9ea1E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783964345; c=relaxed/simple; bh=+UfnnAywhWfDmMFu2HtpjxsWcBfvg1aF8Wh4AXz/GD4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sgPWLD6U2b1bewLfIvyXuET4MoEC/ZUEoFJyyyDvVSwom8j+zrPbMnX1KvuJxLGTEZcqGWG5mX9QtU3nNzmk51IxegewL3SCsZO/5Cp3g9WRlYrCVNj/0jfU8sVa9y5fvIs1IfJaO5EV2qm2tJ9lsxJi+vtrZnD8pARoAit2F2o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QiNo4quQ; arc=none smtp.client-ip=209.85.214.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QiNo4quQ" Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2ce87c7e3bbso35479005ad.1 for ; Mon, 13 Jul 2026 10:39:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783964342; x=1784569142; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=JJTXKcUVPMM2q094v4fU7tfA4D6n06AAOLUKvX0e/q8=; b=QiNo4quQttG7y6nvcUJ4EBqLbRbRmHKkrdvK6xEAzmAWZiVYvLoy9mmh+mX938+7j7 0iJvjjjExIKKehLDpLrHSsX9Tcc+f1RBLLBueKhpjLH6mwUjLdT1oHsq1GJMe7A3JZ6u mzKqd8s+C6eEJI61zxDqHuBumIjN/+h26VSX28d6UUfVrmtbwCUMcz0PMYD8TAkf3P1V rF9FBQfK6MGplX6tdOKCEERc4B92hsfQ8p64APAcoly16xKCKrX5gf3ZZ/KYc/VAR4N1 3UkVEHXVmgQl2OxY5zL7yqa5lQ3RG/2I8vbqlIVl+taZ6GMIf40PJu44GccOD/7eIyRT a6nw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783964342; x=1784569142; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JJTXKcUVPMM2q094v4fU7tfA4D6n06AAOLUKvX0e/q8=; b=O0QhplE7qgUoqo4ExYWiaXWC27J3h7B9rrsYjbZux9KNd6CGKvSwZD3/UeX8HrOoil crXzSdf6ltqqIJrXYYjzia//5Zs/Du6t6gJ4t9xshbIYAzM3aGJDf9PeBxb8Iyq0iBD3 MsuCg0sD69sklAw+ToVGoFm9VInzFqoAUaIbZQga3wgyLhtE9vh0WNhKiyhLcgimAfeu vWKSAipIMRwOJLY4Mh9YOeudgKAfieylREK+otPVI2E26WFdhsIZA9d3y97WMUjK1POv fzG0Tr3RP3oWf+1F3gIYFPCAgIEOLwFkWNz3Xrrn1nxqZCPCR9Utw7rfJglla2z/qiUt ivRA== X-Forwarded-Encrypted: i=1; AHgh+Roxr2eX85KBiG5Xg1JmBpHwcU16k6WtA8qL9Tq6mIorAbSHrCSycJh/x7xgJav4m3Muyx9jWjPyYqYBBNg=@vger.kernel.org X-Gm-Message-State: AOJu0YwvXTl38jbW0kHhYZHTmYLPX9ugIfwc0Wc5261dCY++tKQJDbKT ziGA1I6HSoJhEwmA+xER6oGcHSH6IDlxljnpnKN6bCXvpkOpy0l5wzEc X-Gm-Gg: AfdE7ck6O1ijGQKRsucyrWTbCqSVxVo2AJK06ikSMH5Fp1VobWoZd6fZ7Bc89xRAtbq 7Ul8sLAGqvmwzk/q6bsKROk+OXdoryTBjHxeq/Kq+13mghFesy4CTd/jYHzTTEv4W8vJvxJYlos o8q1LnZ7guqTJUPiiUVNKrbHSDWWSZU2diq+/2AZbOh2XYItwc/SABPA0Y4XQ2bLG1RqqbsDzHa xyWyfP6dxm81v6vaRD/5ytylZ+o82Q+0t9AfYdWH2isb9eRXTtGkPF2AxPUz//iA5AM7E8knKfG an6ejgKEFCvqCcqjk4MDbXbsCGlA8l0KX/dA9bE06gUv0E3BQyqpxdnEN7OWRCjW7VeuUZAxMqI UZRAk7hm4jiJzla4mHyE8ACwD7DVaaXD3NvOjFnIa7VgMJcK+EMFcn5l8Inyuz/xBW05dJSuedd DB2q4jx+j7BhNrJQJzRWpvvSJ5iEof6q7vG5SMEIjn+XbSJbEIpcc6L4KGLqQS/oUnEJcJVlLdy aOKqlB+LjlQmDdMk4W4/dg91WhThm37uRWaPQjvDTnKQnQ= X-Received: by 2002:a17:90b:134b:b0:37d:ee77:78ac with SMTP id 98e67ed59e1d1-38e17dce582mr175439a91.19.1783964341727; Mon, 13 Jul 2026 10:39:01 -0700 (PDT) Received: from OMEN ([103.184.238.250]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31198cb2b99sm48273547eec.26.2026.07.13.10.38.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 10:39:01 -0700 (PDT) From: Alfie Varghese To: neil.armstrong@linaro.org, gregkh@linuxfoundation.org Cc: linux-media@vger.kernel.org, linux-amlogic@lists.infradead.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Alfie Varghese Subject: [PATCH] staging: media: meson: vdec: fix UAF, memory leak and NULL derefs Date: Mon, 13 Jul 2026 23:08:59 +0530 Message-ID: <20260713173859.643-1-alfievarghese22@gmail.com> X-Mailer: git-send-email 2.54.0.windows.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This combined commit fixes several pre-existing issues identified in the Amlogic video decoder driver: 1. Fix a critical Use-After-Free in vdec_close() by synchronously canceling the sess->esparser_queue_work before freeing the session. 2. Fix a memory leak in vdec_close() by freeing the session control handler via v4l2_ctrl_handler_free(). 3. Prevent a potential NULL pointer dereference in vdec_probe() by adding a NULL check for of_match_node()'s return value. 4. Prevent a potential NULL pointer dereference in vdec_isr() and vdec_threaded_isr() by adding NULL checks for core->cur_sess. Signed-off-by: Alfie Varghese --- drivers/staging/media/meson/vdec/vdec.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index a039d925c0fe..b794ad53711c 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -926,11 +926,15 @@ static int vdec_close(struct file *file) { struct amvdec_session *sess =3D file_to_amvdec_session(file); =20 + cancel_work_sync(&sess->esparser_queue_work); + v4l2_m2m_ctx_release(sess->m2m_ctx); v4l2_m2m_release(sess->m2m_dev); v4l2_fh_del(&sess->fh, file); v4l2_fh_exit(&sess->fh); =20 + v4l2_ctrl_handler_free(&sess->ctrl_handler); + mutex_destroy(&sess->lock); mutex_destroy(&sess->bufs_recycle_lock); =20 @@ -953,6 +957,9 @@ static irqreturn_t vdec_isr(int irq, void *data) struct amvdec_core *core =3D data; struct amvdec_session *sess =3D core->cur_sess; =20 + if (!sess) + return IRQ_NONE; + sess->last_irq_jiffies =3D get_jiffies_64(); =20 return sess->fmt_out->codec_ops->isr(sess); @@ -963,6 +970,9 @@ static irqreturn_t vdec_threaded_isr(int irq, void *dat= a) struct amvdec_core *core =3D data; struct amvdec_session *sess =3D core->cur_sess; =20 + if (!sess) + return IRQ_NONE; + return sess->fmt_out->codec_ops->threaded_isr(sess); } =20 @@ -1020,6 +1030,8 @@ static int vdec_probe(struct platform_device *pdev) return PTR_ERR(core->canvas); =20 of_id =3D of_match_node(vdec_dt_match, dev->of_node); + if (!of_id) + return -ENODEV; core->platform =3D of_id->data; =20 if (core->platform->revision =3D=3D VDEC_REVISION_G12A ||