From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3BB5D28B7EA for ; Fri, 31 Jul 2026 00:32:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785457928; cv=none; b=InIDpNXFzLfxH39h7vheTfgsJ9rp4i4vzeaovG3NyzfkE1LNwkZX1eocMjEluslM7ClfNTys4Qi3xYsGVg31VCbvFi5UrRss6uCnUGlJZ2fS1IU2y4pLdV36cIM0OH58XXp0cCq7Lslsg7JyVs6avsSxePU79DD133Acz/9X814= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785457928; c=relaxed/simple; bh=GJ+ySrymWuLsSpYJsvPcJ14/uEgMN/mxqNxIVXzl7aw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=KO0KbRVUmAa6I3fap70SP9adQqW1bT/SHjhp/azpnt7MN8PIkLVmra9lGwAcUFlYhlMaXkMbGWHmTKczq4wDgP8tRvca4FgnEWO+oW2XuWVYnrJ7ZGx8KDS5XOCizUG0yNfYB/0tmSDwSx32IkB070mazepbGmuGeBcaMQ2tQx4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=nwKydO0m; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=hfmOj0tQ; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="nwKydO0m"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="hfmOj0tQ" Received: from pps.filterd (m0279866.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66UMrKKY2011184 for ; Fri, 31 Jul 2026 00:32:05 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 6zRicdP7MxQ+tTXunDsN7IaxIFcAVLbO4TxnDJ5/5TY=; b=nwKydO0mwX5CsyAC AfBQYKdaIIqf8fYMlx1ZTFu4Nf1qqGZfFHS4WBojRTejnax5qt/cJTVLvFX/GEup wIaxXEUQwqxZeMpHm0EH7nFFUPcQnIDjugongZVWzZZEBNJs6nctO7nUZham8E1V 2RR5WVC6PkimQD9fZsIEwlwb3qhGAVf3yHuOQmedrmCThIgBvYz94HRrzOZkktOi yUzUJuFWZhJnlSzH00gNYvKsEbPMySYtY55ltgjITgCH+ebuNTpqbbFQRk++Txc7 IE/z7t1f1yu772ru50W4gnPN7sWsGbi57W4d/w8D9W6t8Ksbjb/tGMCeGEddmiC4 DEyfEQ== Received: from mail-qt1-f200.google.com (mail-qt1-f200.google.com [209.85.160.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4frfmh091g-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 31 Jul 2026 00:32:05 +0000 (GMT) Received: by mail-qt1-f200.google.com with SMTP id d75a77b69052e-51c01ff996dso3582891cf.2 for ; Thu, 30 Jul 2026 17:32:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1785457924; x=1786062724; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6zRicdP7MxQ+tTXunDsN7IaxIFcAVLbO4TxnDJ5/5TY=; b=hfmOj0tQdUrrfAFnaBvg/dojWshgENwCZ16m77trjShPebSfrGzT7MnnZvrCLCU0H0 BovkWeTNXZtHJMv9TGYda1zxMoFX2Himp6nJNOZdNXoqTmEio4/a0I8Ff5PedHq2JCIq ZFVMrwjAWOaAu5mBe2VId0mOUIImuMGlda7ypZbxq/CixnWou+NqjaPkCIQjY0dEA61i w06m3wdFEtYv9DShwtLU6d1PDh1InzFKYnBQGvR6saSjhfx9f3JyGZzgOLaK693IHKvf PC8RgGd9bibsniqEk0lJq+AQ6rolln+huaXA4FDRr0CKyQlO+olfiVc3YmD5ef6NfsPX 4Tzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785457924; x=1786062724; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=6zRicdP7MxQ+tTXunDsN7IaxIFcAVLbO4TxnDJ5/5TY=; b=Dhz1de+125Jg6j1iHZyk4IhOJSZ7opdwVfvZucxRazfXH2AEMRyK27WCGO3SuGoSQG 6cwEGFkPyTTl9m6PIA2W8X3lOSC+xkSdpjd8b2UsMbdXrQtmQzzmfRRgeoo6pYm2yWNq TzpnIhQX6zKFPTone0vDBk0FhZJ7xB9WJLsbsnaZAESX963tffkHNDMh5lKxkPhsnWlj QCG4bINZbQrCpE3fQ+se5MCG8x6jPe+MYFJcshZEEAuTCoOne8XeZYu0pt6/DhPExr46 4KgMG+cxkjb9SjohfvNpZgdLnWGTBQXXJK5+u5Sdmhu9A/PKEIWLyzS1si/D2e8KvTd/ S93A== X-Forwarded-Encrypted: i=1; AHgh+RqTGaWednog7kTM3QU/gCaA81dQ++JuxugyVx6oqC4jirgNXKRz/M0fxSM06VBlrJmMruijWfEkPBvWj3E=@vger.kernel.org X-Gm-Message-State: AOJu0YwT5In2BFPLjdMzh6NswcoGJW2Qr22MT275uFEIQH+jFzzurc1K CZrKMGeqQyFlWxVJ9/KjuQmannZRavGy8hyqlf2GWRiJkh7tzoJlWxajo1BjKH1yuBvwfBsof92 Lu8udwTpgQUVlPL+dNHG9tfflLHW+nB5+U4CicbXWpNBbmppxG/DXAVZjCZUOpPyRHC4= X-Gm-Gg: AR+sD12mGHyYrKdkEsJxC4wdhFiX1VcPvfy26K5m9eYkZ6LCGwt8PfGB+XcdbGyRn+J kPgKKRmL15h18ZPdzgeUwhjzwZFbMqo3swrPDpsx8Ui9aiOMs/Y3GlU8vA6E569XVqHYN8RefuM 7/jcNFTwUAXKrzs7L7YDvi/H1bImiOF2Jy8NPjpvR0+lzFcgm3u1uKXC9ZsH43DbEfzu5shmyOi L4lviSTYGeE+JnRQRa+56bjVlL8i8Psdx0dxWrIpEqwfh1oMFF+KfiFENE3xWqjOADeX0A9PEHF 6VBaYeg3UtvKB68HrBd33YeyhqfuuK+83qJlskjusNwLNAfiwki/BeR6A+DWGqVpGkP/AxNbfxE Ye5e0DkVXhw96HAMwNTxSkRIN6ob4FpRpkEbRujZx98Alr6JRFjBGixvTPnFbel8KXW6h0AwH5S 7evBGMh38aFwoXOg== X-Received: by 2002:a05:6214:419b:b0:8f3:f17a:a3f with SMTP id 6a1803df08f44-9084218f8bemr1689006d6.3.1785457924511; Thu, 30 Jul 2026 17:32:04 -0700 (PDT) X-Received: by 2002:a05:6214:419b:b0:8f3:f17a:a3f with SMTP id 6a1803df08f44-9084218f8bemr1688476d6.3.1785457923900; Thu, 30 Jul 2026 17:32:03 -0700 (PDT) Received: from umbar.lan (2001-14ba-a073-af00-264b-feff-fe8b-be8a.rev.dnainternet.fi. [2001:14ba:a073:af00:264b:feff:fe8b:be8a]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5b2db9d2688sm620538e87.57.2026.07.30.17.32.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Jul 2026 17:32:02 -0700 (PDT) From: Dmitry Baryshkov Date: Fri, 31 Jul 2026 03:31:41 +0300 Subject: [PATCH v2 2/5] media: iris: take core lock when scanning the instance list Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260731-iris-fixes-v2-2-94c002016a09@oss.qualcomm.com> References: <20260731-iris-fixes-v2-0-94c002016a09@oss.qualcomm.com> In-Reply-To: <20260731-iris-fixes-v2-0-94c002016a09@oss.qualcomm.com> To: Vikash Garodia , Dikshita Agarwal , Abhinav Kumar , Bryan O'Donoghue , Mauro Carvalho Chehab , Hans Verkuil , Stefan Schmidt , Vedang Nagar Cc: linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1561; i=dmitry.baryshkov@oss.qualcomm.com; h=from:subject:message-id; bh=GJ+ySrymWuLsSpYJsvPcJ14/uEgMN/mxqNxIVXzl7aw=; b=owEBbQGS/pANAwAKAYs8ij4CKSjVAcsmYgBqa+z8MQFsNBb3TBsAfK8BUIfgXStvOqqp1Z6iw lcmLnE9gI6JATMEAAEKAB0WIQRMcISVXLJjVvC4lX+LPIo+Aiko1QUCamvs/AAKCRCLPIo+Aiko 1elZCAClq7OZugFOwpA/5R6/SUxPPk8GxXUGQdoEOcprMHOHoyk6dsBqIrqspVjlaM2AWyHdUsB KxtKosGjTAv2s0whbOjZDTo0uExwW32+e41pZYX244DprxHGcumdl4b2JE1iMFG8TxZLEGwyclW SGGLdZr5/ynMED94pr2wdO+ngcenOgY1RjAiwcADE6dZfei7X2MwPlDt7GifvXQgXH61/NsrXQt VnekzUYVsK0caDfAYGxTfAhhoEq+Cm9cMnYAZ6+WPYWqg8HwwBpo0WazvU0cz00+QCVUy5PfvBx Tqofi9pAQa/RETvcBr6hkSHo3zie44oDsBO1SmazHHACXep0 X-Developer-Key: i=dmitry.baryshkov@oss.qualcomm.com; a=openpgp; fpr=8F88381DD5C873E4AE487DA5199BF1243632046A X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDAwMiBTYWx0ZWRfX6LIi71IBxyO3 Rkqw5US/mcIBS7J1YBzXLOJ4AEFnv5M7kwPQ8x4Vu4BaNz1Ok598nfOP3dz/iMlzBc6Su3YRn4m lCHX+5OD9iczF9WfkLEo+C8kgNsQBBc= X-Authority-Analysis: v=2.4 cv=evjvCIpX c=1 sm=1 tr=0 ts=6a6bed05 cx=c_pps a=JbAStetqSzwMeJznSMzCyw==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=YMgV9FUhrdKAYTUUvYB2:22 a=EUspDBNiAAAA:8 a=ArhRcrGwThaRUb-MlkEA:9 a=QEXdDO2ut3YA:10 a=uxP6HrT_eTzRwkO_Te1X:22 X-Proofpoint-GUID: DUnpW1ezKqvxuwWXi-FNrVQ06R_XDMCB X-Proofpoint-ORIG-GUID: DUnpW1ezKqvxuwWXi-FNrVQ06R_XDMCB X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDAwMiBTYWx0ZWRfXwONEqXZK3/u3 e69p6z86Fa2imSCxupPOk7RGaubjIyvsBRA5dEC7IGTsFh1BqtAaIRCULy+vLEms3qMWPKpM47S 7lgdUDydo/A9M2Tv6yugVzcuS31hs2X761sQq4HIcYJQEalm7p+G2HTaW++WfCde6pPKUcOwJyJ aZCQIx1TQg4CIwk36Bece1lPSNZDlqH2N9x6ogXyRFET/ySWBDf4y0/MUoMLsnzt6ruNXOQxiam rvZfRte4DLfXCmCvS29sdDQi9zRg283Rb2uhYhfxbctnWaUn0ZeoCOAT1u3eN4Q/Tt8Gcmvd89s nHZziMWQraTnIDOkrkmjK/+Zyj5OaEYuE12jnb1xmlZd2q/oJ58DQEOKkKHMFs/s+ZInv9sX/H6 r7o9HdxhNT7jVYL5NGMGRPeI7TSnlInQsqvn++upEa3USfjiXdATVruOIfExSYepKrXi0v/rZgq GOhwbQGbaZUmAPWjFsg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-30_07,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 spamscore=0 clxscore=1015 adultscore=0 suspectscore=0 bulkscore=0 impostorscore=0 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310002 iris_check_session_supported() walks core->instances to confirm the current instance is registered, but does so without holding core->lock. A concurrent iris_close() takes core->lock and removes a (possibly different) instance from the list via list_del_init() before freeing it, so the lockless traversal can follow a freed pointer and dereference it, resulting in a use-after-free. Hold core->lock across the list traversal, matching the other iterators over core->instances such as iris_check_core_mbpf(). The lock is dropped before iris_check_core_mbpf() is called so the nesting is unchanged. Fixes: bdbe1cac0c10 ("media: iris: add check whether the video session is supported or not") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Dmitry Baryshkov --- drivers/media/platform/qcom/iris/iris_vb2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c b/drivers/media/platform/qcom/iris/iris_vb2.c index a2ea2d67f60d..8faf709c26c1 100644 --- a/drivers/media/platform/qcom/iris/iris_vb2.c +++ b/drivers/media/platform/qcom/iris/iris_vb2.c @@ -56,10 +56,14 @@ static int iris_check_session_supported(struct iris_inst *inst) bool found = false; int ret; + mutex_lock(&core->lock); list_for_each_entry(instance, &core->instances, list) { - if (instance == inst) + if (instance == inst) { found = true; + break; + } } + mutex_unlock(&core->lock); if (!found) { ret = -EINVAL; -- 2.47.3