media: staging/intel-ipu3: Fix race condition during set_fmt
authorRicardo Ribalda <ribalda@chromium.org>
Fri, 9 Apr 2021 08:41:35 +0000 (10:41 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 11 May 2021 12:47:38 +0000 (14:47 +0200)
commit4121def7df29354d812ae3e0c0528f9af8cbc2a0
tree1454899a53755f885e37a8229745905597e85d6a
parentc6b81b897f6f9445d57f8d47c4e060ec21556137
media: staging/intel-ipu3: Fix race condition during set_fmt

commit dccfe2548746ca9cca3a20401ece4cf255d1f171 upstream.

Do not modify imgu_pipe->nodes[inode].vdev_fmt.fmt.pix_mp, until the
format has been correctly validated.

Otherwise, even if we use a backup variable, there is a period of time
where imgu_pipe->nodes[inode].vdev_fmt.fmt.pix_mp might have an invalid
value that can be used by other functions.

Cc: stable@vger.kernel.org
Fixes: ad91849996f9 ("media: staging/intel-ipu3: Fix set_fmt error handling")
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/media/ipu3/ipu3-v4l2.c