[PATCH] media: v4l2-mem2mem: cancel job work before freeing m2m_dev

[PATCH] media: v4l2-mem2mem: cancel job work before freeing m2m_dev

[Yaohan Li]

v4l2_m2m_release() frees the mem2mem device without draining its
embedded job_work. A job completion can queue the work while device
removal runs, leaving the worker to access a freed m2m_dev.

Cancel and wait for job_work before freeing the device. This ensures
that a previously queued or running job worker has completed before
the memory backing it is released.

The use-after-free was reproduced with an in-tree V4L2 test driver
under KASAN during stream teardown and device unbind; the same
injected scheduling sequence completed without the report after the
change.

Fixes: cbd9463da1b12 ("media: v4l2-mem2mem: Avoid calling .device_run in v4l2_m2m_job_finish")
Assisted-by: ZCode:GLM-4
Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>
---
 drivers/media/v4l2-core/v4l2-mem2mem.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index a65cbb124cfe0..c4756e7bb1fb2 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -1207,6 +1207,12 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_init);
 
 void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
 {
+	/*
+	 * job_work is embedded in m2m_dev and is re-queued unconditionally
+	 * whenever a job finishes; wait for it before freeing the device.
+	 */
+	cancel_work_sync(&m2m_dev->job_work);
+
 	kfree(m2m_dev);
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_release);
-- 
2.34.1

Re: [PATCH] media: v4l2-mem2mem: cancel job work before freeing m2m_dev

[Nicolas Dufresne]

[-- Attachment #1: Type: text/plain, Size: 1780 bytes --]

Hi,

Le mercredi 04 novembre 2026 à 17:50 +0800, Yaohan Li a écrit :
> v4l2_m2m_release() frees the mem2mem device without draining its
> embedded job_work. A job completion can queue the work while device
> removal runs, leaving the worker to access a freed m2m_dev.
> 
> Cancel and wait for job_work before freeing the device. This ensures
> that a previously queued or running job worker has completed before
> the memory backing it is released.
> 
> The use-after-free was reproduced with an in-tree V4L2 test driver
> under KASAN during stream teardown and device unbind; the same
> injected scheduling sequence completed without the report after the
> change.
> 
> Fixes: cbd9463da1b12 ("media: v4l2-mem2mem: Avoid calling .device_run in v4l2_m2m_job_finish")
> Assisted-by: ZCode:GLM-4
> Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>


Please, check the mailing list before sending patches, there is a v2 of this
change already. Its as simple as adding this step to your prompt really.

Nicolas

> ---
>  drivers/media/v4l2-core/v4l2-mem2mem.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
> index a65cbb124cfe0..c4756e7bb1fb2 100644
> --- a/drivers/media/v4l2-core/v4l2-mem2mem.c
> +++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
> @@ -1207,6 +1207,12 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_init);
>  
>  void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
>  {
> +	/*
> +	 * job_work is embedded in m2m_dev and is re-queued unconditionally
> +	 * whenever a job finishes; wait for it before freeing the device.
> +	 */
> +	cancel_work_sync(&m2m_dev->job_work);
> +
>  	kfree(m2m_dev);
>  }
>  EXPORT_SYMBOL_GPL(v4l2_m2m_release);

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]