From nobody Mon Jun 8 06:36:12 2026 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C670251795 for ; Sat, 6 Jun 2026 08:16:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780733804; cv=none; b=mobEwQ+Lo0CWoGyP2lQNZb10Udxs67Hpy6PmMQtxO9eCa6kkBAZOJoqTFmJp/pawnZJmIri10/aG2XY1ZjfpAwmCqn/uvEImVzLXuM3H3ApxdnU+pZenm6UcwrZc9+ktCawEIYJMPmtOKFG194kvepJeQhadbW9Onbi4PZqtm9A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780733804; c=relaxed/simple; bh=XRLsF9m/UswY0c3AinlYQkni5aTuuuboCKSYyhRwQRk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sqtacoeO4qGa1MgbsYRHn0wRSW2/Yc3ofaCNtZXt6yL08ry+vd32kmeQNjkzfX0CcskqozDl8SzWkSXyutj9SUbsjPo9ZxueztgqBao3yjIr1a5WiObAreJlMIajhFM6m5KR4fJz6Lm2Sx1AlWEWb9TeCPXHdBPIKv8DlEwNYxw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Zw1q/T7f; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Zw1q/T7f" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2bf2247e38eso28122095ad.3 for ; Sat, 06 Jun 2026 01:16:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780733802; x=1781338602; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=g8qChUGYgELG/aZ1nAOZ/r8X2US5HdwujYtACOKdC8M=; b=Zw1q/T7fLrAz6a61EssLqYSAiLDUi+Tz2NDCNw849dVZ83soemKzBkgH7wskbMbFF/ SMgqqZHn2mvSBo2/R+4Jv+iSBeRXEhaW/XPv2sXRpmzUOHL6GOMYqTQTlCDxnjGUDsyM riI3RZWbcSirCNNxmHaOu42swk2i21TBwugsfTxA1vlbqkf3hS5Oy4M6nGoAJySEYawb uQuy8WPnUtwFaU3YV1F/HED3mfBxmdoHCoeZyOqmVuVHbxo78u/gENbJjJhxLObJGPZq PqBZigvhALNY8rq8mg6FO8oF4FY2EzLuHbiVT5KvJ7fJ9GH+o54S4k1CkDm92Zy/XmCj xc2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780733802; x=1781338602; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=g8qChUGYgELG/aZ1nAOZ/r8X2US5HdwujYtACOKdC8M=; b=hITFI2qIy9bv0gbliz4pHdsDwe7lYMwFcn0iLrbcnSGfd4q7thWqWnDHbyPUx99L/i gKGIyODE/QQZlQ5as5sXv9FGdKDg4R9yFOzvZFKJNk+IQJT7w5IijbXJAnS2wQ2esEMw sohJiW6UNUY5Uh6xhUgoU4wOSFmz3a/8JXEWtDoymloeLTwYYhWBQvCB8UWaHf18IoL1 tMPTHdy5jhaQfR+NR1670MSpfkTqfCWa7VDx6OQj4Sd6RUhb0EyQmdB9X7o8AfKNb8vT 91/mJ8eBGOvHLo/4rJ3BIyvGdDKk5wjjD8qL25uWnH4i6Thx8Vs2vAFuDiqZlpdHd6Z9 IJNg== X-Forwarded-Encrypted: i=1; AFNElJ9WbDfrZ+mid5py4dbs6lMuYiCDxrszscR+DMBtBcZ9NpS/T+z/76O1LRn7pGlzWCuc25igX/Rr+aVgys4=@vger.kernel.org X-Gm-Message-State: AOJu0Yz/XElhCEE3xkNxlOXYBT27hB3dapU8/lC4i5dVLAud+an+sm2O AfBdSe5Nt27tSgAm0mRx8iuFJMiJgCsd2wsce1f9Gs+dhg6JDfyWjin0 X-Gm-Gg: Acq92OEUfkqx8qkcIlUPLnOPjiBVvp0WkpFTzQ/m1cYUiIp81EZ5zgoIknNTtxPyauP TAKM4qC0bwtWwWKHNz9b5exqh3CqyMvxH/f4EIe8SmwSPcNjVueM3rPxPCgoQuE2zeQxrSj8C5Y nOS7ISEGTEUNY0MtVZljRbHwhCzADErF95QRg4d9QTRNfyxxIAUjQzAI7UAeiijApVFAY69goC8 uR0xV2xpsAJZ9dz7SfJfqef86qkc7buxNm+e2XBUbmd+8SO/jeMkOjMBqPResHr791KX0fZI0RR 2Fbjv2qEi2cVFdQrzI121mnnW4cPwhViYTAbpLn+z1TXBHrga+PhrxaQ9rsK2cXBOK+xYO20eut FCAt0g3oZy75YVZifteWrPTWBol9yCbvIzdbKI9ZYjf96jriyT44rCHG0A32MygNjNJwRUGiq8p nRpGUzXaofW/u5uHiy2uupMj74+Z3zbBza9xHrJC+/BMgIscRZbS+RdA== X-Received: by 2002:a17:902:c94c:b0:2c2:33a4:aa8f with SMTP id d9443c01a7336-2c233a4ade9mr7285325ad.13.1780733802479; Sat, 06 Jun 2026 01:16:42 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:967f:7ce4:ec98:f08b]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c16629d55esm116375565ad.63.2026.06.06.01.16.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 01:16:42 -0700 (PDT) From: Ruoyu Wang To: Vikash Garodia , Dikshita Agarwal Cc: Abhinav Kumar , Bryan O'Donoghue , Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH v2] media: iris: check decoder format allocations Date: Sat, 6 Jun 2026 16:16:36 +0800 Message-ID: <20260606081636.3-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260606040736.13-1-ruoyuw560@gmail.com> References: <20260606040736.13-1-ruoyuw560@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" iris_vdec_inst_init() allocates source and destination v4l2_format structures before initializing their fields. Allocation failures would leave the function dereferencing NULL pointers during instance initialization. Allocate the formats into local variables and check each allocation before assigning them to the instance. If the second allocation fails, free the first allocation and return -ENOMEM. Store the pointers in the instance only after both allocations have succeeded so the open path can unwind cleanly. Signed-off-by: Ruoyu Wang --- Changes in v2: - Allocate the formats into local variables and assign them to the instance only after both allocations succeed, as requested in review. drivers/media/platform/qcom/iris/iris_vdec.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/qcom/iris/iris_vdec.c b/drivers/media/p= latform/qcom/iris/iris_vdec.c index 99d544e2af4f9..837f29f403bb7 100644 --- a/drivers/media/platform/qcom/iris/iris_vdec.c +++ b/drivers/media/platform/qcom/iris/iris_vdec.c @@ -19,10 +19,21 @@ int iris_vdec_inst_init(struct iris_inst *inst) { struct iris_core *core =3D inst->core; + struct v4l2_format *fmt_src, *fmt_dst; struct v4l2_format *f; =20 - inst->fmt_src =3D kzalloc_obj(*inst->fmt_src); - inst->fmt_dst =3D kzalloc_obj(*inst->fmt_dst); + fmt_src =3D kzalloc_obj(*fmt_src); + if (!fmt_src) + return -ENOMEM; + + fmt_dst =3D kzalloc_obj(*fmt_dst); + if (!fmt_dst) { + kfree(fmt_src); + return -ENOMEM; + } + + inst->fmt_src =3D fmt_src; + inst->fmt_dst =3D fmt_dst; =20 inst->fw_min_count =3D MIN_BUFFERS; =20 --=20 2.51.0