[PATCH v2 media] media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release

[Tristan Madani <tristmd@gmail.com>]

v4l2_m2m_release() frees the m2m_dev struct without cancelling
m2m_dev->job_work.  When a job finishes, v4l2_m2m_schedule_next_job()
calls schedule_work() to queue the next run.  If the driver tears down
concurrently, v4l2_m2m_ctx_release() invokes v4l2_m2m_cancel_job() which
handles per-context state (TRANS_RUNNING, TRANS_QUEUED) but does not
drain the device-level job_work.  A pending work item can then fire after
kfree and access freed memory.

Add cancel_work_sync() before the kfree in v4l2_m2m_release() to ensure
the work item is drained.

Fixes: 7f98639def42 ("V4L/DVB: add memory-to-memory device helper framework for videobuf")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Changes in v2:
- Expanded commit message to clarify that cancel_work_sync() complements
  the per-context v4l2_m2m_cancel_job(), which handles TRANS_RUNNING and
  TRANS_QUEUED flags but does not drain the device-level work item
  (Nicolas Dufresne)

 drivers/media/v4l2-core/v4l2-mem2mem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index a65cbb124cfe0..311e2e08d066d 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -1207,6 +1207,7 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_init);
 
 void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
 {
+	cancel_work_sync(&m2m_dev->job_work);
 	kfree(m2m_dev);
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_release);
-- 
2.47.3