Unverified Commit 8c2a4928 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5468 media: mtk-jpeg: Fix use after free bug due to error path handling in... 

!5468  media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run

Merge Pull Request from: @ci-robot 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/JHQDTC675OYBRBWDHWXBQKGK7HR5FMP4/ 
 
https://gitee.com/src-openeuler/kernel/issues/I97NHC 
 
Link:https://gitee.com/openeuler/kernel/pulls/5468

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents f78e3bf7 c0b3cf15

drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -977,13 +977,13 @@ static void mtk_jpeg_dec_device_run(void *priv) 
	if (ret < 0)

	if (ret < 0)

		goto dec_end;

		goto dec_end;





	schedule_delayed_work(&jpeg->job_timeout_work,

			      msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));



	mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);

	mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);

	if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb))

	if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb))

		goto dec_end;

		goto dec_end;





	schedule_delayed_work(&jpeg->job_timeout_work,

			      msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));



	spin_lock_irqsave(&jpeg->hw_lock, flags);

	spin_lock_irqsave(&jpeg->hw_lock, flags);

	mtk_jpeg_dec_reset(jpeg->reg_base);

	mtk_jpeg_dec_reset(jpeg->reg_base);

	mtk_jpeg_dec_set_config(jpeg->reg_base,

	mtk_jpeg_dec_set_config(jpeg->reg_base,