diff options
| author | Yunfei Dong <yunfei.dong@mediatek.com> | 2022-11-17 09:24:50 +0000 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@kernel.org> | 2022-11-25 11:29:24 +0000 |
| commit | 3568ecd3f3a6d133ab7feffbba34955c8c79bbc4 (patch) | |
| tree | 4fa7da90e2b254510782c9bd9570ac60ce774886 /drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c | |
| parent | d879f770e4d1d5f0d9b692d3a2702f23ee441dbb (diff) | |
| download | linux-stable-3568ecd3f3a6d133ab7feffbba34955c8c79bbc4.tar.gz linux-stable-3568ecd3f3a6d133ab7feffbba34955c8c79bbc4.tar.bz2 linux-stable-3568ecd3f3a6d133ab7feffbba34955c8c79bbc4.zip | |
media: mediatek: vcodec: Can't set dst buffer to done when lat decode error
Core thread will call v4l2_m2m_buf_done to set dst buffer done for
lat architecture. If lat call v4l2_m2m_buf_done_and_job_finish to
free dst buffer when lat decode error, core thread will access kernel
NULL pointer dereference, then crash.
Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Diffstat (limited to 'drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c')
| -rw-r--r-- | drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c index e86809052a9f..ffbcee04dc26 100644 --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c @@ -253,7 +253,7 @@ static void mtk_vdec_worker(struct work_struct *work) state = ret ? VB2_BUF_STATE_ERROR : VB2_BUF_STATE_DONE; if (!IS_VDEC_LAT_ARCH(dev->vdec_pdata->hw_arch) || - ctx->current_codec == V4L2_PIX_FMT_VP8_FRAME || ret) { + ctx->current_codec == V4L2_PIX_FMT_VP8_FRAME) { v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev_dec, ctx->m2m_ctx, state); if (src_buf_req) v4l2_ctrl_request_complete(src_buf_req, &ctx->ctrl_hdl); |