media: rkvdec: Initialize the m2m context before the controls

[ Upstream commit d43d7db3c8a1868dcbc6cb8de90a3cdf309d6cbb ]

Setting up the control handler calls into .s_ctrl ops. While validating
the controls the ops may need to access some of the context state, which
could lead to a crash if not properly initialized.

Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
index a5eca08ff259722714af87ca008fc711bb7f4ab1..3266f1d78e8827af66417e674a1466b526a16d19 100644 (file)
--- a/drivers/staging/media/rkvdec/rkvdec.c
+++ b/drivers/staging/media/rkvdec/rkvdec.c
@@ -827,24 +827,24 @@ static int rkvdec_open(struct file *filp)
        rkvdec_reset_decoded_fmt(ctx);
        v4l2_fh_init(&ctx->fh, video_devdata(filp));
 
-       ret = rkvdec_init_ctrls(ctx);
-       if (ret)
-               goto err_free_ctx;
-
        ctx->fh.m2m_ctx = v4l2_m2m_ctx_init(rkvdec->m2m_dev, ctx,
                                            rkvdec_queue_init);
        if (IS_ERR(ctx->fh.m2m_ctx)) {
                ret = PTR_ERR(ctx->fh.m2m_ctx);
-               goto err_cleanup_ctrls;
+               goto err_free_ctx;
        }
 
+       ret = rkvdec_init_ctrls(ctx);
+       if (ret)
+               goto err_cleanup_m2m_ctx;
+
        filp->private_data = &ctx->fh;
        v4l2_fh_add(&ctx->fh);
 
        return 0;
 
-err_cleanup_ctrls:
-       v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
+err_cleanup_m2m_ctx:
+       v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
 
 err_free_ctx:
        kfree(ctx);