Re: [PATCH 1/2] media: mali-c55: Check the parameters buffer address before copying

[Jacopo Mondi]

Hi David

On Sun, Sep 06, 2026 at 10:24:24AM +0100, David Carlier wrote:
> mali_c55_params_buf_prepare() copies the parameters buffer supplied by
> userspace into the driver's scratch buffer, using the result of
> vb2_plane_vaddr() as the source without checking it. The queue accepts
> VB2_DMABUF, and vb2_dc_vaddr() returns NULL for an exporter that cannot
> be vmapped, so the memcpy() dereferences NULL.
>
> Reject the buffer at prepare time instead.
>
> Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: David Carlier <devnexen@xxxxxxxxx>

Quite a corner case I would say, but it's anyway good to check.

Reviewed-by: Jacopo Mondi <jacopo.mondi@xxxxxxxxxxxxxxxx>

> ---
>  drivers/media/platform/arm/mali-c55/mali-c55-params.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-params.c b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
> index 70106276b7e4..16e895e3488e 100644
> --- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c
> +++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
> @@ -710,6 +710,9 @@ static int mali_c55_params_buf_prepare(struct vb2_buffer *vb)
>  	struct mali_c55 *mali_c55 = params->mali_c55;
>  	int ret;
>
> +	if (!config)
> +		return -EFAULT;
> +
>  	ret = v4l2_isp_params_validate_buffer_size(mali_c55->dev, vb,
>  			v4l2_isp_buffer_size(MALI_C55_PARAMS_MAX_SIZE));
>  	if (ret)
> --
> 2.55.0
>
>