media: imx-jpeg: Reset slot data pointers when freed

commit faa8051b128f4b34277ea8a026d02d83826f8122 upstream.

Ensure that the slot data pointers are reset to NULL and handles are
set to 0 after freeing the coherent memory. This makes he function
mxc_jpeg_alloc_slot_data() and mxc_jpeg_free_slot_data() safe to be
called multiple times.

Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
index 38033ed169e531acf065dfc7c5e2fafc6d81d663..09087a26014daa449a514c154a6c035a35818a7b 100644 (file)
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -758,16 +758,22 @@ static void mxc_jpeg_free_slot_data(struct mxc_jpeg_dev *jpeg)
        dma_free_coherent(jpeg->dev, sizeof(struct mxc_jpeg_desc),
                          jpeg->slot_data.desc,
                          jpeg->slot_data.desc_handle);
+       jpeg->slot_data.desc = NULL;
+       jpeg->slot_data.desc_handle = 0;
 
        /* free descriptor for encoder configuration phase / decoder DHT */
        dma_free_coherent(jpeg->dev, sizeof(struct mxc_jpeg_desc),
                          jpeg->slot_data.cfg_desc,
                          jpeg->slot_data.cfg_desc_handle);
+       jpeg->slot_data.cfg_desc_handle = 0;
+       jpeg->slot_data.cfg_desc = NULL;
 
        /* free configuration stream */
        dma_free_coherent(jpeg->dev, MXC_JPEG_MAX_CFG_STREAM,
                          jpeg->slot_data.cfg_stream_vaddr,
                          jpeg->slot_data.cfg_stream_handle);
+       jpeg->slot_data.cfg_stream_vaddr = NULL;
+       jpeg->slot_data.cfg_stream_handle = 0;
 
        jpeg->slot_data.used = false;
 }