[PATCH v2 media] media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release

[PATCH v2 media] media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release

[Tristan Madani]

v4l2_m2m_release() frees the m2m_dev struct without cancelling
m2m_dev->job_work.  When a job finishes, v4l2_m2m_schedule_next_job()
calls schedule_work() to queue the next run.  If the driver tears down
concurrently, v4l2_m2m_ctx_release() invokes v4l2_m2m_cancel_job() which
handles per-context state (TRANS_RUNNING, TRANS_QUEUED) but does not
drain the device-level job_work.  A pending work item can then fire after
kfree and access freed memory.

Add cancel_work_sync() before the kfree in v4l2_m2m_release() to ensure
the work item is drained.

Fixes: 7f98639def42 ("V4L/DVB: add memory-to-memory device helper framework for videobuf")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Changes in v2:
- Expanded commit message to clarify that cancel_work_sync() complements
  the per-context v4l2_m2m_cancel_job(), which handles TRANS_RUNNING and
  TRANS_QUEUED flags but does not drain the device-level work item
  (Nicolas Dufresne)

 drivers/media/v4l2-core/v4l2-mem2mem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index a65cbb124cfe0..311e2e08d066d 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -1207,6 +1207,7 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_init);
 
 void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
 {
+	cancel_work_sync(&m2m_dev->job_work);
 	kfree(m2m_dev);
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_release);
-- 
2.47.3

Re: [PATCH v2 media] media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release

[Hans Verkuil]

On 04/11/2026 02:42, Tristan Madani wrote:
> v4l2_m2m_release() frees the m2m_dev struct without cancelling
> m2m_dev->job_work.  When a job finishes, v4l2_m2m_schedule_next_job()
> calls schedule_work() to queue the next run.  If the driver tears down
> concurrently, v4l2_m2m_ctx_release() invokes v4l2_m2m_cancel_job() which
> handles per-context state (TRANS_RUNNING, TRANS_QUEUED) but does not
> drain the device-level job_work.  A pending work item can then fire after
> kfree and access freed memory.
> 
> Add cancel_work_sync() before the kfree in v4l2_m2m_release() to ensure
> the work item is drained.
> 
> Fixes: 7f98639def42 ("V4L/DVB: add memory-to-memory device helper framework for videobuf")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

This email differs from your gmail address. Which is correct?

Regards,

	Hans

> ---
> Changes in v2:
> - Expanded commit message to clarify that cancel_work_sync() complements
>   the per-context v4l2_m2m_cancel_job(), which handles TRANS_RUNNING and
>   TRANS_QUEUED flags but does not drain the device-level work item
>   (Nicolas Dufresne)
> 
>  drivers/media/v4l2-core/v4l2-mem2mem.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
> index a65cbb124cfe0..311e2e08d066d 100644
> --- a/drivers/media/v4l2-core/v4l2-mem2mem.c
> +++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
> @@ -1207,6 +1207,7 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_init);
>  
>  void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
>  {
> +	cancel_work_sync(&m2m_dev->job_work);
>  	kfree(m2m_dev);
>  }
>  EXPORT_SYMBOL_GPL(v4l2_m2m_release);