Commit 3ef338c0 authored Jul 08, 2024 by Tomi Valkeinen Committed by Hongbo Li Jul 08, 2024

media: mc: Fix graph walk in media_pipeline_start

stable inclusion
from stable-v6.6.34
commit e80d9db99b7b6c697d8d952dfd25c3425cf61499
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0H2
CVE: CVE-2024-39481

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e80d9db99b7b6c697d8d952dfd25c3425cf61499



--------------------------------

commit 8a9d420149c477e7c97fbd6453704e4612bdd3fa upstream.

The graph walk tries to follow all links, even if they are not between
pads. This causes a crash with, e.g. a MEDIA_LNK_FL_ANCILLARY_LINK link.

Fix this by allowing the walk to proceed only for MEDIA_LNK_FL_DATA_LINK
links.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Cc: stable@vger.kernel.org # for 6.1 and later
Fixes: ae219872 ("media: mc: entity: Rewrite media_pipeline_start()")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hongbo Li <lihongbo22@huawei.com>

parent 01c2a11a

drivers/media/mc/mc-entity.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -606,6 +606,12 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe,
		link = list_entry(entry->links, typeof(*link), list);
		last_link = media_pipeline_walk_pop(walk);

		if ((link->flags & MEDIA_LNK_FL_LINK_TYPE) != MEDIA_LNK_FL_DATA_LINK) {
		dev_dbg(walk->mdev->dev,
		"media pipeline: skipping link (not data-link)\n");
		return 0;
		}

		dev_dbg(walk->mdev->dev,
		"media pipeline: exploring link '%s':%u -> '%s':%u\n",
		link->source->entity->name, link->source->index,