On Mon Dec 29 12:01:24 2025 +0530, Dikshita Agarwal wrote:
> In iris_kill_session, inst->state is set to IRIS_INST_ERROR and
> session_close is executed, which will kfree(inst_hfi_gen2->packet).
> If stop_streaming is called afterward, it will cause a crash.
>
> Add a NULL check for inst_hfi_gen2->packet before sendling STOP packet
> to firmware to fix that.
>
> Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops")
> Signed-off-by: Dikshita Agarwal <[email protected]>
> Reviewed-by: Vikash Garodia <[email protected]>
> Cc: [email protected]
> Signed-off-by: Bryan O'Donoghue <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c | 3 +++
1 file changed, 3 insertions(+)
---
diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
b/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
index b492d9dfddd3..c75c8b9398a2 100644
--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
+++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
@@ -1036,6 +1036,9 @@ static int iris_hfi_gen2_session_stop(struct iris_inst
*inst, u32 plane)
struct iris_inst_hfi_gen2 *inst_hfi_gen2 = to_iris_inst_hfi_gen2(inst);
int ret = 0;
+ if (!inst_hfi_gen2->packet)
+ return -EINVAL;
+
reinit_completion(&inst->completion);
iris_hfi_gen2_packet_session_command(inst,
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
