Commit 3568ecd3 authored by Yunfei Dong's avatar Yunfei Dong Committed by Mauro Carvalho Chehab
Browse files

media: mediatek: vcodec: Can't set dst buffer to done when lat decode error 



Core thread will call v4l2_m2m_buf_done to set dst buffer done for
lat architecture. If lat call v4l2_m2m_buf_done_and_job_finish to
free dst buffer when lat decode error, core thread will access kernel
NULL pointer dereference, then crash.

Signed-off-by: default avatarYunfei Dong <yunfei.dong@mediatek.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent d879f770

drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c

+1 −1
Original line number Diff line number Diff line
@@ -253,7 +253,7 @@ static void mtk_vdec_worker(struct work_struct *work) 


	state = ret ? VB2_BUF_STATE_ERROR : VB2_BUF_STATE_DONE;

	if (!IS_VDEC_LAT_ARCH(dev->vdec_pdata->hw_arch) ||

	    ctx->current_codec == V4L2_PIX_FMT_VP8_FRAME || ret) {

	    ctx->current_codec == V4L2_PIX_FMT_VP8_FRAME) {

		v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev_dec, ctx->m2m_ctx, state);

		if (src_buf_req)

			v4l2_ctrl_request_complete(src_buf_req, &ctx->ctrl_hdl);