This is a note to let you know that I've just added the patch titled media: mediatek: vcodec: Fix getting NULL pointer for dst buffer to the 6.0-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: media-mediatek-vcodec-fix-getting-null-pointer-for-d.patch and it can be found in the queue-6.0 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit 31f7b686681c2a9ba471648651d61596232fd101 Author: Yunfei Dong <yunfei.dong@xxxxxxxxxxxx> Date: Thu Nov 17 09:24:49 2022 +0000 media: mediatek: vcodec: Fix getting NULL pointer for dst buffer [ Upstream commit d879f770e4d1d5f0d9b692d3a2702f23ee441dbb ] The driver may can't get v4l2 buffer when lat or core decode timeout, will lead to crash when call v4l2_m2m_buf_done to set dst buffer (NULL pointer) done. Fixes: 7b182b8d9c85 ("media: mediatek: vcodec: Refactor get and put capture buffer flow") Signed-off-by: Yunfei Dong <yunfei.dong@xxxxxxxxxxxx> Signed-off-by: Hans Verkuil <hverkuil-cisco@xxxxxxxxx> Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c index c45bd2599bb2..e86809052a9f 100644 --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c @@ -138,10 +138,13 @@ static void mtk_vdec_stateless_cap_to_disp(struct mtk_vcodec_ctx *ctx, int error state = VB2_BUF_STATE_DONE; vb2_dst = v4l2_m2m_dst_buf_remove(ctx->m2m_ctx); - v4l2_m2m_buf_done(vb2_dst, state); - - mtk_v4l2_debug(2, "free frame buffer id:%d to done list", - vb2_dst->vb2_buf.index); + if (vb2_dst) { + v4l2_m2m_buf_done(vb2_dst, state); + mtk_v4l2_debug(2, "free frame buffer id:%d to done list", + vb2_dst->vb2_buf.index); + } else { + mtk_v4l2_err("dst buffer is NULL"); + } if (src_buf_req) v4l2_ctrl_request_complete(src_buf_req, &ctx->ctrl_hdl);