18a39796e6
commit a0157b5aa34eb43ec4c5510f9c260bbb03be937e upstream. There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst. Fix it by cancelling the work in vdec_close. Cc: stable@vger.kernel.org Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com> Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| am437x | ||
| atmel | ||
| cadence | ||
| coda | ||
| davinci | ||
| exynos | ||
| exynos-gsc | ||
| exynos4-is | ||
| marvell-ccic | ||
| mtk-jpeg | ||
| mtk-mdp | ||
| mtk-vcodec | ||
| mtk-vpu | ||
| omap | ||
| omap3isp | ||
| qcom | ||
| rcar-vin | ||
| rockchip/rga | ||
| s3c-camif | ||
| s5p-g2d | ||
| s5p-jpeg | ||
| s5p-mfc | ||
| sti | ||
| stm32 | ||
| sunxi | ||
| ti-vpe | ||
| vsp1 | ||
| xilinx | ||
| aspeed-video.c | ||
| fsl-viu.c | ||
| imx-pxp.c | ||
| imx-pxp.h | ||
| Kconfig | ||
| m2m-deinterlace.c | ||
| Makefile | ||
| mx2_emmaprp.c | ||
| pxa_camera.c | ||
| rcar-fcp.c | ||
| rcar_drif.c | ||
| rcar_fdp1.c | ||
| rcar_jpu.c | ||
| renesas-ceu.c | ||
| sh_vou.c | ||
| via-camera.c | ||
| via-camera.h | ||
| video-mux.c | ||