[PATCH] media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release

[PATCH] media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

v4l2_m2m_release() frees the m2m_dev struct without cancelling
m2m_dev->job_work.  If a device operation schedules work via
v4l2_m2m_try_schedule() and the driver tears down the m2m context
concurrently, the work fires on freed memory.

Add cancel_work_sync() before the kfree in v4l2_m2m_release().

Fixes: 7f98639def42 ("V4L/DVB: add memory-to-memory device helper framework for videobuf")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/media/v4l2-core/v4l2-mem2mem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index a65cbb124cfe0..311e2e08d066d 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -1207,6 +1207,7 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_init);
 
 void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
 {
+	cancel_work_sync(&m2m_dev->job_work);
 	kfree(m2m_dev);
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_release);
-- 
2.47.3

Re: [PATCH] media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release

[Nicolas Dufresne]

[-- Attachment #1: Type: text/plain, Size: 1444 bytes --]

Le samedi 24 octobre 2026 à 20:57 +0000, Tristan Madani a écrit :
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> v4l2_m2m_release() frees the m2m_dev struct without cancelling
> m2m_dev->job_work.  If a device operation schedules work via
> v4l2_m2m_try_schedule() and the driver tears down the m2m context
> concurrently, the work fires on freed memory.

How did you tested this ?

> 
> Add cancel_work_sync() before the kfree in v4l2_m2m_release().
> 
> Fixes: 7f98639def42 ("V4L/DVB: add memory-to-memory device helper framework for videobuf")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/media/v4l2-core/v4l2-mem2mem.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
> index a65cbb124cfe0..311e2e08d066d 100644
> --- a/drivers/media/v4l2-core/v4l2-mem2mem.c
> +++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
> @@ -1207,6 +1207,7 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_init);
>  
>  void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
>  {
> +	cancel_work_sync(&m2m_dev->job_work);

Seems quite insufficient if you compare with the actual implementation in
v4l2_m2m_cancel_job(). Is it really possible to call this without having
released (closed) all the context first ?

Nicolas

>  	kfree(m2m_dev);
>  }
>  EXPORT_SYMBOL_GPL(v4l2_m2m_release);

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]