| Message ID | 20231027091612.38896-1-zyytlz.wz@163.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 10/27/23 12:16, Zheng Wang wrote: > This patch reverts commit c677d7ae8314 > ("media: mtk-jpeg: Fix use after free bug due to uncanceled work"). > The job_timeout_work is initialized only for > the single-core JPEG device so it will cause the crash for multi-core > JPEG devices. > > Fix it by removing the cancel_delayed_work_sync function. > > Fixes: c677d7ae8314 ("media: mtk-jpeg: Fix use after free bug due to uncanceled work") > Signed-off-by: Zheng Wang <zyytlz.wz@163.com> > Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> > --- > drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c > index 7194f88edc0f..60425c99a2b8 100644 > --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c > +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c > @@ -1403,7 +1403,6 @@ static void mtk_jpeg_remove(struct platform_device *pdev) > { > struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev); > > - cancel_delayed_work_sync(&jpeg->job_timeout_work); > pm_runtime_disable(&pdev->dev); > video_unregister_device(jpeg->vdev); > v4l2_m2m_release(jpeg->m2m_dev); Please send all three patches as a single series and version it with v2. Add cover letter with changelog. # git format-patch --cover-letter -v2 -3
Dmitry Osipenko <dmitry.osipenko@collabora.com> 于2023年10月31日周二 13:49写道： > > On 10/27/23 12:16, Zheng Wang wrote: > > This patch reverts commit c677d7ae8314 > > ("media: mtk-jpeg: Fix use after free bug due to uncanceled work"). > > The job_timeout_work is initialized only for > > the single-core JPEG device so it will cause the crash for multi-core > > JPEG devices. > > > > Fix it by removing the cancel_delayed_work_sync function. > > > > Fixes: c677d7ae8314 ("media: mtk-jpeg: Fix use after free bug due to uncanceled work") > > Signed-off-by: Zheng Wang <zyytlz.wz@163.com> > > Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> > > --- > > drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 - > > 1 file changed, 1 deletion(-) > > > > diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c > > index 7194f88edc0f..60425c99a2b8 100644 > > --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c > > +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c > > @@ -1403,7 +1403,6 @@ static void mtk_jpeg_remove(struct platform_device *pdev) > > { > > struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev); > > > > - cancel_delayed_work_sync(&jpeg->job_timeout_work); > > pm_runtime_disable(&pdev->dev); > > video_unregister_device(jpeg->vdev); > > v4l2_m2m_release(jpeg->m2m_dev); > > Please send all three patches as a single series and version it with v2. > Add cover letter with changelog. > > # git format-patch --cover-letter -v2 -3 > Thanks for your kind reminder. Will do right now. Best regards, Zheng Wang > -- > Best regards, > Dmitry >
diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c index 7194f88edc0f..60425c99a2b8 100644 --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c @@ -1403,7 +1403,6 @@ static void mtk_jpeg_remove(struct platform_device *pdev) { struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev); - cancel_delayed_work_sync(&jpeg->job_timeout_work); pm_runtime_disable(&pdev->dev); video_unregister_device(jpeg->vdev); v4l2_m2m_release(jpeg->m2m_dev);
This patch reverts commit c677d7ae8314 ("media: mtk-jpeg: Fix use after free bug due to uncanceled work"). The job_timeout_work is initialized only for the single-core JPEG device so it will cause the crash for multi-core JPEG devices. Fix it by removing the cancel_delayed_work_sync function. Fixes: c677d7ae8314 ("media: mtk-jpeg: Fix use after free bug due to uncanceled work") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> --- drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 - 1 file changed, 1 deletion(-)