Re: [PATCH v2 5/5] media: iris: reference count video instances

[Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>]

On 7/31/26 2:31 AM, Dmitry Baryshkov wrote:
> iris_get_instance() looks up an instance on core->instances and returns
> it after dropping core->lock, without taking any reference. The threaded
> interrupt handler uses this to find the instance a firmware response
> belongs to and then takes inst->lock. Meanwhile userspace may close the
> same file descriptor: iris_close() removes the instance from the list,
> destroys inst->lock and frees the instance. The interrupt handler then
> operates on freed memory and a destroyed mutex, a use-after-free.

[...]

> @@ -92,6 +92,12 @@ struct iris_inst *iris_get_instance(struct iris_core *core, u32 session_id)
>  	mutex_lock(&core->lock);
>  	list_for_each_entry(inst, &core->instances, list) {
>  		if (inst->session_id == session_id) {
> +			/*
> +			 * Take a reference under core->lock, paired with
> +			 * iris_inst_put() once the caller is done, so the
> +			 * instance cannot be freed by a concurrent close().
> +			 */
> +			kref_get(&inst->kref);
>  			mutex_unlock(&core->lock);

But none of the _puts() are under the core lock?

Konrad