In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Fix potential NULL dereference in mtkcrtcdestroy()
In mtkcrtccreate(), if the call to mboxrequestchannel() fails then we set the "mtkcrtc->cmdqclient.chan" pointer to NULL. In that situation, we do not call cmdqpktcreate().
During the cleanup, we need to check if the "mtkcrtc->cmdqclient.chan" is NULL first before calling cmdqpktdestroy(). Calling cmdqpktdestroy() is unnecessary if we didn't call cmdqpktcreate() and it will result in a NULL pointer dereference.
[
{
"id": "CVE-2024-53056-8c1b0231",
"signature_version": "v1",
"digest": {
"function_hash": "257072547661074946462797268821148616529",
"length": 475.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c60583a87cb4a85b69d1f448f0be5eb6ec62cbb2",
"target": {
"file": "drivers/gpu/drm/mediatek/mtk_crtc.c",
"function": "mtk_crtc_destroy"
}
},
{
"id": "CVE-2024-53056-f7688868",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72481232073151582452707363088556397665",
"325509875762908446733609363187667130205",
"159316455806939361083650868282808611725",
"189688784195472177154891988630074532174",
"60419235693449890196904181695599956829"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c60583a87cb4a85b69d1f448f0be5eb6ec62cbb2",
"target": {
"file": "drivers/gpu/drm/mediatek/mtk_crtc.c"
}
}
]