• Dan Carpenter's avatar
    media: mediatek: vcodec: fix potential double free · be40f524
    Dan Carpenter authored
    The "lat_buf->private_data" needs to be set to NULL to prevent a
    double free.  How this would happen is if vdec_msg_queue_init() failed
    twice in a row and on the second time it failed earlier than on the
    first time.
    
    The vdec_msg_queue_init() function has a loop which does:
    	for (i = 0; i < NUM_BUFFER_COUNT; i++) {
    
    Each iteration initializes one element in the msg_queue->lat_buf[] array
    and then the clean up function vdec_msg_queue_deinit() frees each
    element of the msg_queue->lat_buf[] array.  This clean up code relies
    on the assumption that every element is either initialized or zeroed.
    Leaving a freed pointer which is non-zero breaks the assumption.
    
    Fixes: b199fe46 ("media: mtk-vcodec: Add msg queue feature for lat and core architecture")
    Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
    Reviewed-by: default avatarNicolas Dufresne <nicolas.dufresne@collabora.com>
    Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
    be40f524
vdec_msg_queue.c 10.3 KB