Unverified Commit b8dd59f2 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6529 [sync] PR-5468: media: mtk-jpeg: Fix use after free bug due to error... 

!6529 [sync] PR-5468:  media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/5468 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/JHQDTC675OYBRBWDHWXBQKGK7HR5FMP4/ 
 
https://gitee.com/src-openeuler/kernel/issues/I97NHC 
 
Link:https://gitee.com/openeuler/kernel/pulls/6529

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents c1c32b56 11318b55

drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c

+3 −3
Original line number Diff line number Diff line
@@ -977,13 +977,13 @@ static void mtk_jpeg_dec_device_run(void *priv) 
	if (ret < 0)

		goto dec_end;



	schedule_delayed_work(&jpeg->job_timeout_work,

			      msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));



	mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);

	if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb))

		goto dec_end;



	schedule_delayed_work(&jpeg->job_timeout_work,

			      msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));



	spin_lock_irqsave(&jpeg->hw_lock, flags);

	mtk_jpeg_dec_reset(jpeg->reg_base);

	mtk_jpeg_dec_set_config(jpeg->reg_base,