diff options
| author | Zheng Wang <zyytlz.wz@163.com> | 2024-06-18 14:55:59 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-10-10 12:01:01 +0200 |
| commit | d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c (patch) | |
| tree | ae84a3343d6afee550f7624dbb32d46c0ea4966c | |
| parent | 9fff37bc82b50fa3551dd69536d22227f13a53f4 (diff) | |
| download | linux-stable-d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c.tar.gz linux-stable-d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c.tar.bz2 linux-stable-d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c.zip | |
media: venus: fix use after free bug in venus_remove due to race condition
commit c5a85ed88e043474161bbfe54002c89c1cb50ee2 upstream.
in venus_probe, core->work is bound with venus_sys_error_handler, which is
used to handle error. The code use core->sys_err_done to make sync work.
The core->work is started in venus_event_notify.
If we call venus_remove, there might be an unfished work. The possible
sequence is as follows:
CPU0 CPU1
|venus_sys_error_handler
venus_remove |
hfi_destroy |
venus_hfi_destroy |
kfree(hdev); |
|hfi_reinit
|venus_hfi_queues_reinit
|//use hdev
Fix it by canceling the work in venus_remove.
Cc: stable@vger.kernel.org
Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/media/platform/qcom/venus/core.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c index ce206b709754..fd6cb85e1b1e 100644 --- a/drivers/media/platform/qcom/venus/core.c +++ b/drivers/media/platform/qcom/venus/core.c @@ -426,6 +426,7 @@ static void venus_remove(struct platform_device *pdev) struct device *dev = core->dev; int ret; + cancel_delayed_work_sync(&core->work); ret = pm_runtime_get_sync(dev); WARN_ON(ret < 0); |