[PATCH 2/3] media: verisilicon: hantro: cancel watchdog work before m2m release
"Shengzhuo Wei" <[email protected]>
| Newsgroups | org.kernel.vger.linux-media,dev.linux.lists.imx,org.infradead.lists.linux-arm-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
Each job arms vpu->watchdog_work, cancelled only by the
job-completion path. If a job stalls, hantro_remove() drops the last
reference to vpu->m2m_dev via v4l2_m2m_put() with the watchdog still
pending, and hantro_watchdog() then dereferences the freed m2m_dev --
a use-after-free.
Drain the watchdog before the m2m device is released.
Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver")
Cc: [email protected]
Signed-off-by: Shengzhuo Wei <[email protected]>
Assisted-by: GLM:5.3
---
drivers/media/platform/verisilicon/hantro_drv.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 2e81877f640fb429b18d2f4fd64bc0c392cf600e..1b04b98371a48184f390a13791243fd00d6b80ef 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -1284,6 +1284,7 @@ static void hantro_remove(struct platform_device *pdev)
hantro_remove_dec_func(vpu);
hantro_remove_enc_func(vpu);
media_device_cleanup(&vpu->mdev);
+ cancel_delayed_work_sync(&vpu->watchdog_work);
v4l2_m2m_put(vpu->m2m_dev);
v4l2_device_unregister(&vpu->v4l2_dev);
clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
--
2.47.3