lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 18 Dec 2022 11:07:21 -0500 From: Sasha Levin <sashal@...nel.org> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: Yunfei Dong <yunfei.dong@...iatek.com>, Hans Verkuil <hverkuil-cisco@...all.nl>, Mauro Carvalho Chehab <mchehab@...nel.org>, Sasha Levin <sashal@...nel.org>, tiffany.lin@...iatek.com, andrew-ct.chen@...iatek.com, matthias.bgg@...il.com, linux-media@...r.kernel.org, linux-arm-kernel@...ts.infradead.org, linux-mediatek@...ts.infradead.org Subject: [PATCH AUTOSEL 6.0 53/73] media: mediatek: vcodec: Can't set dst buffer to done when lat decode error From: Yunfei Dong <yunfei.dong@...iatek.com> [ Upstream commit 3568ecd3f3a6d133ab7feffbba34955c8c79bbc4 ] Core thread will call v4l2_m2m_buf_done to set dst buffer done for lat architecture. If lat call v4l2_m2m_buf_done_and_job_finish to free dst buffer when lat decode error, core thread will access kernel NULL pointer dereference, then crash. Signed-off-by: Yunfei Dong <yunfei.dong@...iatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@...all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@...nel.org> Signed-off-by: Sasha Levin <sashal@...nel.org> --- .../media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c index c45bd2599bb2..f41a3ff17b04 100644 --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c @@ -250,7 +250,7 @@ static void mtk_vdec_worker(struct work_struct *work) state = ret ? VB2_BUF_STATE_ERROR : VB2_BUF_STATE_DONE; if (!IS_VDEC_LAT_ARCH(dev->vdec_pdata->hw_arch) || - ctx->current_codec == V4L2_PIX_FMT_VP8_FRAME || ret) { + ctx->current_codec == V4L2_PIX_FMT_VP8_FRAME) { v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev_dec, ctx->m2m_ctx, state); if (src_buf_req) v4l2_ctrl_request_complete(src_buf_req, &ctx->ctrl_hdl); -- 2.35.1
Powered by blists - more mailing lists