[PATCH] media: mtk-jpeg: fix runtime PM leak in mtk_jpeg_dec_device_run()

[Zhao Feng]

mtk_jpeg_dec_device_run() takes a runtime PM reference with
pm_runtime_resume_and_get() and releases it in mtk_jpeg_dec_irq()
after the hardware signals completion.  If mtk_jpeg_set_dec_dst()
fails, however, the function jumps to dec_end without ever starting
the hardware, so the interrupt never fires and the PM reference is
leaked, keeping the device runtime-resumed forever.

mtk_jpeg_set_dec_dst() returns -EINVAL when the component count or
the per-component plane sizes parsed from the JPEG header do not
match the destination buffer, so the leak is reachable from
userspace with a crafted bitstream.

Drop the reference before jumping to dec_end.

Fixes: 5827e4b14ee7 ("media: platform: Improve power on and power off flow")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zhao Feng <zhaofeng2@xxxxxxxxxxxxxxxxxxxx>
---
Verified against current upstream master.  The multi-core decode
worker handles the same failure correctly (setdst_end/clk_end path
does pm_runtime_put()); only the single-core device_run misses it.
Not runtime-tested (no MediaTek JPEG hardware).

 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1011,6 +1011,8 @@ static void mtk_jpeg_dec_device_run(void *priv)
 
 	mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);
-	if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb))
+	if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb)) {
+		pm_runtime_put(jpeg->dev);
 		goto dec_end;
+	}
 
 	schedule_delayed_work(&jpeg->job_timeout_work,
-- 
2.39.2