diff options
| author |   Stanimir Varbanov <stanimir.varbanov@linaro.org> | 2020-04-03 15:10:13 +0200 |
|---|---|---|
| committer |   Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2020-05-05 13:06:09 +0200 |
| commit | bc3d870e414b42d72cd386aa20a4fc3612e4feb7 (patch) | |
| tree | faf031d87f1c39030031ca61ae4fa2169d19a1c0 /drivers/media/platform | |
| parent | media: venus: vdec: Mark flushed buffers with error state (diff) | |
| download | wireguard-linux-bc3d870e414b42d72cd386aa20a4fc3612e4feb7.tar.xz wireguard-linux-bc3d870e414b42d72cd386aa20a4fc3612e4feb7.zip | |
media: venus: vdec: Init registered list unconditionally
Presently the list initialization is done only in
dynamic-resolution-change state, which leads to list corruptions
and use-after-free. Init list_head unconditionally in
vdec_stop_capture called by vb2 stop_streaming without takeing
into account current codec state.
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'drivers/media/platform')
| -rw-r--r-- | drivers/media/platform/qcom/venus/vdec.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c index 5823537b3131..f23cbd812ef4 100644 --- a/drivers/media/platform/qcom/venus/vdec.c +++ b/drivers/media/platform/qcom/venus/vdec.c @@ -1072,13 +1072,14 @@ static int vdec_stop_capture(struct venus_inst *inst) case VENUS_DEC_STATE_DRC: ret = hfi_session_flush(inst, HFI_FLUSH_OUTPUT); inst->codec_state = VENUS_DEC_STATE_CAPTURE_SETUP; - INIT_LIST_HEAD(&inst->registeredbufs); venus_helper_free_dpb_bufs(inst); break; default: - return 0; + break; } + INIT_LIST_HEAD(&inst->registeredbufs); + return ret; } |