82c2c85aea
[ Upstream commit 3b621e9e9e148c0928ab109ac3d4b81487469acb ]
The allocation failure of mycs->yuv_scaler_binary in load_video_binaries()
is followed with a dereference of mycs->yuv_scaler_binary after the
following call chain:
sh_css_pipe_load_binaries()
|-> load_video_binaries(mycs->yuv_scaler_binary == NULL)
|
|-> sh_css_pipe_unload_binaries()
|-> unload_video_binaries()
In unload_video_binaries(), it calls to ia_css_binary_unload with argument
&pipe->pipe_settings.video.yuv_scaler_binary[i], which refers to the
same memory slot as mycs->yuv_scaler_binary. Thus, a null-pointer
dereference is triggered.
Link: https://lore.kernel.org/r/20240118151303.3828292-1-alexious@zju.edu.cn
Fixes:
|
||
|---|---|---|
| .. | ||
| atomisp | ||
| av7110 | ||
| hantro | ||
| imx | ||
| ipu3 | ||
| meson/vdec | ||
| omap4iss | ||
| rkvdec | ||
| sunxi | ||
| tegra-vde | ||
| tegra-video | ||
| zoran | ||
| Kconfig | ||
| Makefile | ||