Linux ARM-MSM sub-architecture
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 4.14 10/29] media: venus: hfi: avoid null dereference in deinit
       [not found] <20220530135057.1937286-1-sashal@kernel.org>
@ 2022-05-30 13:50 ` Sasha Levin
  0 siblings, 0 replies; only message in thread
From: Sasha Levin @ 2022-05-30 13:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Luca Weiss, Stanimir Varbanov, Mauro Carvalho Chehab, Sasha Levin,
	agross, bjorn.andersson, linux-media, linux-arm-msm

From: Luca Weiss <luca.weiss@fairphone.com>

[ Upstream commit 86594f6af867b5165d2ba7b5a71fae3a5961e56c ]

If venus_probe fails at pm_runtime_put_sync the error handling first
calls hfi_destroy and afterwards hfi_core_deinit. As hfi_destroy sets
core->ops to NULL, hfi_core_deinit cannot call the core_deinit function
anymore.

Avoid this null pointer derefence by skipping the call when necessary.

Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/venus/hfi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/qcom/venus/hfi.c b/drivers/media/platform/qcom/venus/hfi.c
index ba29fd4d4984..7d1d3e64007c 100644
--- a/drivers/media/platform/qcom/venus/hfi.c
+++ b/drivers/media/platform/qcom/venus/hfi.c
@@ -117,6 +117,9 @@ int hfi_core_deinit(struct venus_core *core, bool blocking)
 		mutex_lock(&core->lock);
 	}
 
+	if (!core->ops)
+		goto unlock;
+
 	ret = core->ops->core_deinit(core);
 
 	if (!ret)
-- 
2.35.1


^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2022-05-30 14:29 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <20220530135057.1937286-1-sashal@kernel.org>
2022-05-30 13:50 ` [PATCH AUTOSEL 4.14 10/29] media: venus: hfi: avoid null dereference in deinit Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox