Re: [PATCH v2 media] media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release

[Hans Verkuil <hverkuil+cisco@kernel.org>]

On 04/11/2026 02:42, Tristan Madani wrote:
> v4l2_m2m_release() frees the m2m_dev struct without cancelling
> m2m_dev->job_work.  When a job finishes, v4l2_m2m_schedule_next_job()
> calls schedule_work() to queue the next run.  If the driver tears down
> concurrently, v4l2_m2m_ctx_release() invokes v4l2_m2m_cancel_job() which
> handles per-context state (TRANS_RUNNING, TRANS_QUEUED) but does not
> drain the device-level job_work.  A pending work item can then fire after
> kfree and access freed memory.
> 
> Add cancel_work_sync() before the kfree in v4l2_m2m_release() to ensure
> the work item is drained.
> 
> Fixes: 7f98639def42 ("V4L/DVB: add memory-to-memory device helper framework for videobuf")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

This email differs from your gmail address. Which is correct?

Regards,

	Hans

> ---
> Changes in v2:
> - Expanded commit message to clarify that cancel_work_sync() complements
>   the per-context v4l2_m2m_cancel_job(), which handles TRANS_RUNNING and
>   TRANS_QUEUED flags but does not drain the device-level work item
>   (Nicolas Dufresne)
> 
>  drivers/media/v4l2-core/v4l2-mem2mem.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
> index a65cbb124cfe0..311e2e08d066d 100644
> --- a/drivers/media/v4l2-core/v4l2-mem2mem.c
> +++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
> @@ -1207,6 +1207,7 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_init);
>  
>  void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
>  {
> +	cancel_work_sync(&m2m_dev->job_work);
>  	kfree(m2m_dev);
>  }
>  EXPORT_SYMBOL_GPL(v4l2_m2m_release);