Patch "media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries" has been added to the 6.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-atomisp-ssh_css-fix-a-null-pointer-dereference.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 4a6efc85d8a6d2105411b6280df9e981f3eda27f
Author: Zhipeng Lu <alexious@xxxxxxxxxx>
Date:   Thu Jan 18 16:13:00 2024 +0100

    media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
    
    [ Upstream commit 3b621e9e9e148c0928ab109ac3d4b81487469acb ]
    
    The allocation failure of mycs->yuv_scaler_binary in load_video_binaries()
    is followed with a dereference of mycs->yuv_scaler_binary after the
    following call chain:
    
    sh_css_pipe_load_binaries()
      |-> load_video_binaries(mycs->yuv_scaler_binary == NULL)
      |
      |-> sh_css_pipe_unload_binaries()
            |-> unload_video_binaries()
    
    In unload_video_binaries(), it calls to ia_css_binary_unload with argument
    &pipe->pipe_settings.video.yuv_scaler_binary[i], which refers to the
    same memory slot as mycs->yuv_scaler_binary. Thus, a null-pointer
    dereference is triggered.
    
    Link: https://lore.kernel.org/r/20240118151303.3828292-1-alexious@xxxxxxxxxx
    
    Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
    Signed-off-by: Zhipeng Lu <alexious@xxxxxxxxxx>
    Reviewed-by: Andy Shevchenko <andy.shevchenko@xxxxxxxxx>
    Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c
index 938a4ea89c590..8c30191b21a77 100644
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -4690,6 +4690,7 @@ static int load_video_binaries(struct ia_css_pipe *pipe)
 						  sizeof(struct ia_css_binary),
 						  GFP_KERNEL);
 		if (!mycs->yuv_scaler_binary) {
+			mycs->num_yuv_scaler = 0;
 			err = -ENOMEM;
 			return err;
 		}