From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7DD1C386C15 for ; Wed, 8 Jul 2026 12:08:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783512525; cv=none; b=TefEi+AiWOwkWlKym59PtH5ONFVYMFeq8Kf//kGeo586tsBAdJh8TswyYlYkU60fvuG6guH7hEa08Fj3E2jQ5PqkgbPgqnqhEZ/QZEErc0XaaeznNhsDy8LjJpu2wRpBRvgsCBnOOZgBG2hUWP9py6/JLBRG6fbjy/qdpsVE+UM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783512525; c=relaxed/simple; bh=PZdxUgVPTH97DqcK6+oUruofjz7CC0UhzdFau+lZCJo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pSbB1yv55PU7CYD+vtcrqlXYJLZCJEqTKtm+dF1u0mqzY5qKR22zh0K93x3yKs3r8qGNBGdFxAvFhSNMkRvW2oNKenpp/mr8fr70ZDKcx986GA62AWXWs+geuY2FUVRf9znmQtf196kde0hBtZLfq9KDqsb9NP4EFY69ywjhPXg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=alP9CjWa; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="alP9CjWa" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2cc7ef7ec27so8068835ad.1 for ; Wed, 08 Jul 2026 05:08:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783512523; x=1784117323; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=X/P0XI2f+jIz2x5Bw9cZxHv5AndciwcR9koDyZ8FmdY=; b=alP9CjWaVrxIDJobh7MbpJTFard37z6Yd3PgdpAsp2tussZqW4umAkUTZxJoI4r1pv kexbgWSs2QOIuu/u/6sYFkwiXBfzMw1RR0rOLxIGqSX9XtWakR4qir5nLCEJKAreKGns bIzl7ee/4MpygArizlurMeb1a/mSytKAjHB0PWTLu3z9IjV2ldPGgkzXVDCmkJ4rJamv D8Fbf2F+T/yFgazvCTYglyrI91xGA51t4j6vhk0Ze6Vl85e5HKArJYTr8dQlNNOW8J/H YN6ABbQtwz8jmbu23NEPFOLX5t3ZgHm5jBM+dtPLB3UlfUypOuHf+U18F0CvuhPfurPr 4fdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783512523; x=1784117323; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=X/P0XI2f+jIz2x5Bw9cZxHv5AndciwcR9koDyZ8FmdY=; b=EswzHGM9cFh1xsz/NDgkNcVQG6Ow2/syheEejA6BRwc0PIWiKMrKrlE353oiLTAXPt 1FgiyhGZx/8al8NisB2woX7qqHs5PBVIa/Blt5PTbtD/0QMlYOViDYRVr/sDSnTb75dS BOOqB88Fee6v9nmnPr3e4qPaxtnQamRDw6FIF3skXXF9CQmVezYidqNP4gqCS3egxI9o tOTS9EIHSd4YKeephvfx4uNLGpcc/eyncfkXL2EYS6jzVIJGSpo6/cJqCJrYz3pNj6q6 ZjfwnEq9mRYEqdfPwav7221JEZSfGH+WChDsRWnmBu1EL9FI+ku7KPudhkynkeoWbIOf cuzg== X-Forwarded-Encrypted: i=1; AHgh+Rr6kBU9suaP1eaCfUA7gKGrYM4p3mvX5a+WRni+lg/n2w7nznHnNlk8XqcN8tbrA5GHLgpgeZKTKJUh3N4=@vger.kernel.org X-Gm-Message-State: AOJu0YxcD9jGxqueclouR1c9no7SrcxyUZOmL3KdKpmrcyvDxboIPIvp idvMCBJZ85S7cZjvsqVs47addp6CDgdaBDk0Lrc/T1BnEPgq91D2yp1F X-Gm-Gg: AfdE7cmLvM6a2w+DOuAv2XmKokcYTl4iEWq4YtHeor/nPFcAlHfA7/BeTLP81Mfhy6E 1LTgpWELbT9wQmJ64J0ssfLeTYMiAoc9EZQIvT7aBAaMqkkHbIwMWgsjPGS3bEl92SK+rwze61v +YZRzirzYjzcY6611lwP/qpdtHFAGkB7PdFiZunRnjemtgwkt3+J58q6fuarOGT04wf/y+2iA8q hKp1dWV8Ge3q3ActAa1ZtS7f0TspZwcgH9P+0rKQtinp1AJ2Qmnh9+DyW8O/+zktOj98JGSkm0l CC2KbZ2ODvd8EbMz29+PAJn4UYfM5BKh2DM10H4eMDegHa44+TumXRGJa3MZbytGmwyFKt+tbp2 VEiva5m99ciCLW6tkx0csfczs7ptC2546ewueBxOqkrwMVxTGgQR6PICxQOCUDubz2RQZQE94PA d+x1KrQhWvSBOEWg== X-Received: by 2002:a17:903:fa5:b0:2cc:a977:4260 with SMTP id d9443c01a7336-2ccea3b0e5bmr25272395ad.21.1783512522781; Wed, 08 Jul 2026 05:08:42 -0700 (PDT) Received: from lgs.. ([101.36.109.218]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9d1f030sm27088705ad.51.2026.07.08.05.08.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Jul 2026 05:08:42 -0700 (PDT) From: Guangshuo Li To: Bin Liu , Mauro Carvalho Chehab , Matthias Brugger , AngeloGioacchino Del Regno , Nicolas Dufresne , Fan Wu , Hans Verkuil , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Cc: Guangshuo Li Subject: [PATCH] media: mtk-jpeg: drain hardware completion before freeing context Date: Wed, 8 Jul 2026 20:08:33 +0800 Message-ID: <20260708120833.755998-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The change referenced by the Fixes tag cancels ctx->jpeg_work before freeing the JPEG context from mtk_jpeg_release(). That prevents a queued or running JPEG worker from dereferencing the context after it has been freed. However, on multi-core hardware the worker can program a hardware instance, arm the per-hardware timeout work, store the context in hw_param.curr_ctx and then return while the hardware completion is still pending. In that state cancel_work_sync(&ctx->jpeg_work) can complete even though the IRQ handler or timeout work can still recover the same context from hw_param.curr_ctx. If userspace closes the file before the hardware completion path has run, release can free the context and a later IRQ or timeout work can dereference the freed ctx while updating the done queues. Drain the in-flight hardware completion state associated with the context before freeing it. Fixes: 34c519feef3e ("media: mtk-jpeg: fix use-after-free in release path due to uncancelled work") Signed-off-by: Guangshuo Li --- drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c index d147ec483081..bc9eea0483ce 100644 --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c @@ -1202,8 +1202,11 @@ static int mtk_jpeg_release(struct file *file) struct mtk_jpeg_dev *jpeg = video_drvdata(file); struct mtk_jpeg_ctx *ctx = mtk_jpeg_file_to_ctx(file); - if (jpeg->variant->jpeg_worker) + if (jpeg->variant->jpeg_worker) { cancel_work_sync(&ctx->jpeg_work); + mtk_jpeg_release_hw(jpeg, ctx); + } + mutex_lock(&jpeg->lock); v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); v4l2_ctrl_handler_free(&ctx->ctrl_hdl); -- 2.43.0