From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 821033D9DD1 for ; Fri, 31 Jul 2026 11:40:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785498058; cv=none; b=a5cey8oWg62SVR7JlIcX7fcGKbYijLvWrXLTqWZjMrr1/ANVRS9I4733OB5CxJcCOQs8L37gtORkoHrcgpR+rURYdtuCR06UtYM0WtXq6DXn84Ls8jxu5IdPJaQQ+d7d295OZ59cjEw1xyZ8jFVkT8TzllbeFAu/8PDjPGBNHek= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785498058; c=relaxed/simple; bh=5yUznAelfeq0vWs9CLhFYrQ/dKHAJEYsEMNEVqvx1y8=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=BJ0gbMiQd0szqb6qcVm019TlUqCk3XhyoCjUO5DjNK3cTl0Xuf+aM9d/Q9EQOQomU5ULfmX5neocfO9PaJuVKQrN1UbAnbAN3X6LQ+2oo/l9rfj0g5vQ6ONy8dDgouYBkemswRJWFTC4WmwRgdhWJg8IPSU3xuSh5AGzm2yqaUc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=D2/QgbVc; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=DZc8O2FQ; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="D2/QgbVc"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="DZc8O2FQ" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBaw9v4079733 for ; Fri, 31 Jul 2026 11:40:56 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= ry1zHYNDTsQJF9OfZEXfWbGzxNquqJ4GTL12C5DsHAE=; b=D2/QgbVc1RVpLrOv teDMoIixayPd5zdIQ7GSZmc4xWdrDeI1ulvmznu2Ln2D2lGVQgkUiOB7CyW/Xa0W cImuA3ictvd+3+eH0paO8mmP0QiXcA0K/xQ3HFvFFyBB+9KqxYOyYEdVm2cGTrDH wkQg9Chc6O1rNLLZgfdw57Fy8LsrSewWVDdtfTr/eIURoVD8PSn+NLrtU/UlObI1 dm6DNhobYNZC5b2DQp3pnp+pgUr9d4Z9iZbvp0ra5g/3sTS9YwStFHcEKDA4WjmK jblxDVE4LUgioNJUZN40ElDAA4Kg0F6E0Pt5W67Ds+RTBmlgu8i4kOKvoKfGqzcT 44RzCw== Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fru0580kj-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 31 Jul 2026 11:40:56 +0000 (GMT) Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-51c9e97b626so1521871cf.1 for ; Fri, 31 Jul 2026 04:40:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1785498055; x=1786102855; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ry1zHYNDTsQJF9OfZEXfWbGzxNquqJ4GTL12C5DsHAE=; b=DZc8O2FQep+AUtFcTd4IcmnOuHs3KsHAP5qbZM023kHwONqFdgm9DlR8YU0A8Xw42M XrmkFNkHbbpgcNn12tI7sFsZRgRJygK6Vu8krX6n/DNsuqmISCTN34DbDNNAv6OcfWX8 8U7I9KVFqewAC8RcvC+WTyhKhcvCH/6AyRLea2KN06kKKJRJZaxlX418oMOwRmrH7xrt DMEssvhuObS2ZJHV/mWdn1bTtcQ+Xfh89OZEi6iDpz3sG3gtX0uzNlTzVPuIt7TuaOpL LYLbeRL2fBw2dOpBOZDHJw52mrkgcJAV38ETeLD0K+SdP0HSZmFLMdBXv/rYu9cTVmca ypPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785498055; x=1786102855; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ry1zHYNDTsQJF9OfZEXfWbGzxNquqJ4GTL12C5DsHAE=; b=l4qiq/98yL+sYVwFA6Xjg412USCPqz1exuE5D4IYQZkDJmn80fuhzhzF/NlrtLc+J7 9VsHbKAxEdnIYl/M1K1W6P+v03DJbld6JDxDnzv/xYKFm5WmotuZYxZlqi713/rtFgwl XiXS5r/0ANwoGlld1AgQz4+tU5XLZDh2+jZPNs57nkot0pejKZfesx08SvuSrEJA2PR2 uP51t6L62pTvaWWAoMnNC4BiGvTgiQ7VxmZMlgUxNadUmSE6dEkfn9kqT5MFr54LDPY9 a3McUhpvy/VEAcyV1B/CDBwndJsnOACTZaRnkldfZ+awlFxcI+FveiAt5vSTiH85pDnJ PLKQ== X-Forwarded-Encrypted: i=1; AHgh+RqtUoGPE5uN3OHSaPJ2YjPwQENygirMhVSf+JBwwZ273Albl/ehHtkPBgdDRdWRe3lPNylV3h9fmYpvwSE=@vger.kernel.org X-Gm-Message-State: AOJu0YyIIESO8sIihEa97ubo4wa5+HLoDeKxCEj/5Co0xoz0GdVCd+Et eiWQK7IwjYooNOENIm15YzWMJcU+VDEKy+zlBoPyhtvD5NMaIhn2+NsWjNWCxMHfYEYZcz3aN6N 0zbDuz/hfX1ql4EfUo9HA4/S9y+qyLTcJtnoWe0D6gcMwK/EmcKjc5R/DV7k7VlbT5PE= X-Gm-Gg: AR+sD11ZY66yIM34WEetOcyKbDk3V3gIK7Uk8/OQRREHzq7OwNzo+vqCKHNT80HYJf9 VCNzax60SVIvKFMZD5FhhZ3bxmaar7KwnF5Ush4r6KPH2MJ3m1turYaws+yTTab9j3X8/PVMjYE 7WHPb65Eb/AoWTstVv3hmdHS5+9Pqc2VG4FYroHFSNfmW6AAKP4HGd09fBgYPj9A42XPVlrhcCG yqFfUyZDdnaNPWt5r69eFK9M+6CpJVTlTkmvgeXTaV+8Fi+iZdnykg+u0guQDj/rFzO5h2VcNmf PqIlPy+TbCRsCi+fopCb4qIP3AO9vI3tEkYAU+Rn2EEu+WlMoG5A7/C198FNg3tWkJMRpwt+Su+ 5EXxyrc+YWwyQGDcmXkJJg4/1 X-Received: by 2002:a05:622a:578e:b0:51c:2101:f0 with SMTP id d75a77b69052e-52b4aee606cmr23337401cf.2.1785498055691; Fri, 31 Jul 2026 04:40:55 -0700 (PDT) X-Received: by 2002:a05:622a:578e:b0:51c:2101:f0 with SMTP id d75a77b69052e-52b4aee606cmr23336971cf.2.1785498055318; Fri, 31 Jul 2026 04:40:55 -0700 (PDT) Received: from [192.168.120.193] ([178.235.128.140]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1fd44e9ff0sm105675666b.42.2026.07.31.04.40.53 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 31 Jul 2026 04:40:54 -0700 (PDT) Message-ID: <0767fcef-7f54-4035-9e19-421d6c8d5cb7@oss.qualcomm.com> Date: Fri, 31 Jul 2026 13:40:52 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 2/5] media: iris: take core lock when scanning the instance list To: Dmitry Baryshkov , Vikash Garodia , Dikshita Agarwal , Abhinav Kumar , Bryan O'Donoghue , Mauro Carvalho Chehab , Hans Verkuil , Stefan Schmidt , Vedang Nagar Cc: linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260731-iris-fixes-v2-0-94c002016a09@oss.qualcomm.com> <20260731-iris-fixes-v2-2-94c002016a09@oss.qualcomm.com> Content-Language: en-US From: Konrad Dybcio In-Reply-To: <20260731-iris-fixes-v2-2-94c002016a09@oss.qualcomm.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Authority-Analysis: v=2.4 cv=MNVQXsZl c=1 sm=1 tr=0 ts=6a6c89c8 cx=c_pps a=WeENfcodrlLV9YRTxbY/uA==:117 a=PRfkaYvzSr8QmIIGAkY2Sg==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=EUspDBNiAAAA:8 a=cRjjd2jNw_HWXnLK9NUA:9 a=QEXdDO2ut3YA:10 a=kacYvNCVWA4VmyqE58fU:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA4NyBTYWx0ZWRfX2LHLUFw9RJVo zjr7gVvxzCqWa7yXN8RyO8THVkICCCoxJp8uFrm98vJwcj26epXaQKmIeB9waEHJ/ZS+dO9PupD v5bF6i2mbRMtwi5G+DCUeorYLBQpaqU= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA4NyBTYWx0ZWRfX87N6wzpZTAYy 2dft7CwHvwoWG0+KV12OjLF8XGhK6FRHfSWNVYzgzZ8za+jj1APxgeDlOhcx304sLpHfWPWGkXF C8/k/ISCFhAmCq8FWT//7pDZo0Ur4Y6h53gZa7GzhPc9skZ+SW8DpNM+iPG9bMj4Kik4UP3/GBu moP369PYwq8MucHz2wDygaq42zYsjVk1oBf6GT3d3UArgF3REW0OooTc1h+Khg855eNJeMCBqWe pRAXe+pUveAcOLmNZjVjpvioz3gSErf9ujeXt7AOhHpFUO2aoSZ9g21GNYWa7+5MjoE0sIHut/e 2Y647ApyUbnW41N9nel7ib3i8mZM0KQD2YI8X8sal2zjjoKYEO6HNLvERfE/FJNNfjczPS1Kpxr pYHimfARHJAttd9W26EjMh3hMWh83wtcSVtPB0hyM/qyJqfpImnwgCbkGLh4Bwvx3v784/LHci6 qwU+dyGvxUpUq730HbQ== X-Proofpoint-GUID: JrEBG875QNJtMFDW9tYMNdR09wcguSH1 X-Proofpoint-ORIG-GUID: JrEBG875QNJtMFDW9tYMNdR09wcguSH1 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 bulkscore=0 suspectscore=0 malwarescore=0 clxscore=1015 impostorscore=0 adultscore=0 spamscore=0 phishscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310087 On 7/31/26 2:31 AM, Dmitry Baryshkov wrote: > iris_check_session_supported() walks core->instances to confirm the > current instance is registered, but does so without holding core->lock. > A concurrent iris_close() takes core->lock and removes a (possibly > different) instance from the list via list_del_init() before freeing it, > so the lockless traversal can follow a freed pointer and dereference it, > resulting in a use-after-free. > > Hold core->lock across the list traversal, matching the other iterators > over core->instances such as iris_check_core_mbpf(). The lock is dropped > before iris_check_core_mbpf() is called so the nesting is unchanged. > > Fixes: bdbe1cac0c10 ("media: iris: add check whether the video session is supported or not") > Assisted-by: Claude:claude-opus-4-8 > Signed-off-by: Dmitry Baryshkov > --- Reviewed-by: Konrad Dybcio we also have: iris_check_core_load() iris_get_required_freq() iris_vpu36_get_required_freq() iris_vpu36_check_core_load() that traverse the lsit and actually end up being called with the lock, but only implicitly - perhaps a lockdep hint could be useful there? Konrad