Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

media: verisilicon: Fix crash when probing encoder

ctx->vpu_dst_fmt is no more initialized before calling hantro_try_fmt()
so assigne it to vpu_fmt led to crash the kernel.
Like for decoder case use 'fmt' as format for encoder and clean up
the code.

Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Fixes: db6f68b51e5c ("media: verisilicon: Do not set context src/dst formats in reset functions")
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

authored by

Benjamin Gaignard and committed by
Hans Verkuil
f100ce3b e18a7e9a

+3 -7
+3 -7
drivers/media/platform/verisilicon/hantro_v4l2.c
··· 275 275 struct v4l2_pix_format_mplane *pix_mp, 276 276 enum v4l2_buf_type type) 277 277 { 278 - const struct hantro_fmt *fmt, *vpu_fmt; 278 + const struct hantro_fmt *fmt; 279 279 bool capture = V4L2_TYPE_IS_CAPTURE(type); 280 280 bool coded; 281 281 ··· 295 295 296 296 if (coded) { 297 297 pix_mp->num_planes = 1; 298 - vpu_fmt = fmt; 299 - } else if (ctx->is_encoder) { 300 - vpu_fmt = ctx->vpu_dst_fmt; 301 - } else { 302 - vpu_fmt = fmt; 298 + } else if (!ctx->is_encoder) { 303 299 /* 304 300 * Width/height on the CAPTURE end of a decoder are ignored and 305 301 * replaced by the OUTPUT ones. ··· 307 311 pix_mp->field = V4L2_FIELD_NONE; 308 312 309 313 v4l2_apply_frmsize_constraints(&pix_mp->width, &pix_mp->height, 310 - &vpu_fmt->frmsize); 314 + &fmt->frmsize); 311 315 312 316 if (!coded) { 313 317 /* Fill remaining fields */