From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B0F1446826 for ; Thu, 30 Jul 2026 16:35:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785429320; cv=none; b=q0QiuJI/OEEW10FA0aGL66jjs4FszOp77n35NE89W4of4RXX8ofJG2IzPERHAaLy07Cr4XsWckjbpgkgMRJFqRpeYEXDLutEAAllMgUOtOif5uGLKujUAcnk7EP9bPvJ2MTZ6BSJ9LCzhX75qoqj+LVpu/SETeRRgRvFkrV3cFo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785429320; c=relaxed/simple; bh=kNFoGkto4YUV+q+kdaTKRfPJFFbgRIEaJOcb4pYZBDE=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Q1aldiL8JZN8uw/UMRx0c+Xo1DuUdyuVGvEQ3R1Lj9Z/klp3PdseFJOOxQsC8WUGhruZ3h/8KJUAFvbjdOwmAuv+7xZMWZP8HVQUa3TUS4M0+1sSTXxnxrXSB6icGyFYBJOE7v7oFpwT0UtggRpU1aPlky4KZAArgb0xKLKbLuQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=U25TYe6p; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=gGREizHB; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="U25TYe6p"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="gGREizHB" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66UGXWiI1571708 for ; Thu, 30 Jul 2026 16:35:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= aOj1vVWOBMo3uZFHaAul+1fIzuwnLdxwYpZuOgVkZW0=; b=U25TYe6pBHo5C5O4 sTDYe80skS4vVPNROe2VqadG1sf6X9st+q/yhFDDUbef/vBJKOOj6TZN0VzURlGh jQIK2L2qIJ6K24D4MKubaX2EJoIApnhL/kMEg7eaO4AGHq3617yJfRtHHkTjTLFg 11ca/3ujt+jAy0F3ZRtU6wwKlhpJtmX+k1wHaZt3aAHqIOh3t8n5RzPzFROeufV4 A82X+DlHyjbbXzv0M3TQsaTxIBItuYB6mfldQkPexiJfAwpWkFAhd0WdE8YcUTYY HREB0UpJXe+MNtrts9UyDawFTI/sWSguY620gIWzSfV5CVChA+D9r1nJTlwYfu35 8fJIvQ== Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fr891gruw-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 30 Jul 2026 16:35:18 +0000 (GMT) Received: by mail-qv1-f70.google.com with SMTP id 6a1803df08f44-8ee7cd05e18so157156d6.0 for ; Thu, 30 Jul 2026 09:35:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1785429317; x=1786034117; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to :content-type; bh=aOj1vVWOBMo3uZFHaAul+1fIzuwnLdxwYpZuOgVkZW0=; b=gGREizHBSUfUZqqdk+GykYPj/B+2RsAVG96H1lV1Wz9Z7IbfCNVhnhZlDmGcwzgCYI qW36VQndjDnmVlHWJqKJbVysafSbpALNuMWsJ9DvybLqB8JL56hNVSlw7UnOiZEMlf70 ygrSMs0/VQAprn8OOLHih4YLweKwQbDDOxEzFMLlqM40Wa56jL8jyB93BJ/vi6cSSqPE Dyv27Jet78gxNI4u3Gg3hsUfa13/1EfiBqfCwhZ2zaNiMYXSmiimCBHeSApm2lwlfDFE UCMZiBi/2GWuRMQBiOwmSjTZbxSVqFncgbTmSDGkmwz2embZYhoJbcMKpRH3p/UnQmiE O78g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785429317; x=1786034117; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aOj1vVWOBMo3uZFHaAul+1fIzuwnLdxwYpZuOgVkZW0=; b=dDLZkvNeGN6UUdGiKhGI8j/fv3fw1wgZv1fRw+u9pSCCdaMxZ36+caGMtDT+4UBS86 T3nIpyTV7lh22/oy37aVOKo0J8l3t5IdKIz72wVdCHbPsilinh7EptLQe6VSeSk3mGnD L+K1Hp3dmS2HPfmWpj62jMbHWK07CjgxZWoW4YspvchZvYP6XhfldLG/0aDbEIy68/Mo /Lw+f1Ecl02ITA28mF6hcmav0VF1oltzQLupz/oVeQ77y+wkViBZel+0gIVDBWcDENP/ UfqolSJI8D85odvg4nOcWVcCmAkdkcxBiy6KrfGUCDfCIdqUNna+i568fAEsId/SmDBE EQLQ== X-Forwarded-Encrypted: i=1; AHgh+Rru2BUtaXssxnPzg1RkGE63ZJQ61VP7aqhTqFWLYCgxEkdTqE1bD/oiaUA5/XXzZcH9f6sxV+SYU2BjfPI=@vger.kernel.org X-Gm-Message-State: AOJu0Yxumd7AcHafvJBjwv/lfjqEd57AC0SjcLnKAeQFrRBsoPxBSVxH fiKESKCk4JycENEKqgDfMds+X69k0foH4uViTQGtwASykqNf66Wuo7RpWs9uQj5Tjfaoq6TIlKR 4O3PPsM6uP6Rm4Ceboke9/sm9DV2mqaEAU1RvFtm2l9ovzY6YTjJwIneAFBhQY4nXgzg= X-Gm-Gg: AR+sD10qwMFU7RNV5Erg61cdsVXKaBX2sW4905wBNOVasQjXbB5BOFp8iuhuGMUEhJi s1tR3rGZm30uzd0cxcWXqTdTA5FdKRQBw1OllSS7JWHSqBN9vR4Lvw2XEFlpUkaBX1b9pwvZcWM 8Px/QrAwWx3xWuVyj4Litsz5Gb23dmpJKQ9I8SlVmKgLDtWSlGhiuyLVEYiEaBx8J/ScmHLrgPz 1DaSvS9yxPfWFdhX1JXDEQW7F4EcJSvugpzqFQn2AjQzQ8wWQxSREGlBKmUqnr83AvhpqIsjfOx Vt2SLy/ppfp4atTTmwiX1rg8rFDRrUW+tMkDtUFncIieYUDeyrupVlQotUHwLzheGOvZiOEwecd iO24mIThvxWUoM5I6L/Zk9ha3 X-Received: by 2002:ad4:596a:0:b0:907:bde4:981e with SMTP id 6a1803df08f44-9083bb803e1mr12195206d6.4.1785429317256; Thu, 30 Jul 2026 09:35:17 -0700 (PDT) X-Received: by 2002:ad4:596a:0:b0:907:bde4:981e with SMTP id 6a1803df08f44-9083bb803e1mr12194516d6.4.1785429316599; Thu, 30 Jul 2026 09:35:16 -0700 (PDT) Received: from [192.168.120.193] ([178.235.128.140]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1fa8bf2c99sm91770266b.62.2026.07.30.09.35.14 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 30 Jul 2026 09:35:15 -0700 (PDT) Message-ID: Date: Thu, 30 Jul 2026 18:35:13 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 5/5] media: iris: reference count video instances To: Dmitry Baryshkov , Vikash Garodia , Dikshita Agarwal , Abhinav Kumar , Bryan O'Donoghue , Mauro Carvalho Chehab , Hans Verkuil , Stefan Schmidt , Vedang Nagar Cc: linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260730-iris-fixes-v1-0-413d6cfaa8ca@oss.qualcomm.com> <20260730-iris-fixes-v1-5-413d6cfaa8ca@oss.qualcomm.com> Content-Language: en-US From: Konrad Dybcio In-Reply-To: <20260730-iris-fixes-v1-5-413d6cfaa8ca@oss.qualcomm.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMwMDEyNCBTYWx0ZWRfX1uZfWS7TAuWb mDB5PFWKQ2ToEl0LYCdLfuagHkaoRChzkNXL0tKf1h6JGBpaBIz1nNMkYOF6YH+N/DUPJci2ybs G7wTIfAL+29OP15wgLeVrfgxWH53ZaruaTmUtAHhe6tJtX+/tsKtcgs0PvCbiCO+r5mn61+Fb8P PYQz35/5VQCamBR8K3GZBYCUF4+Qfy3f9WTppzU5T9wp10DCLNF0t8ofQ0OU5u8J8TWwVW2QeJh r0KxX7DW8wYLUBOkv6IWg6/Pr+yEhb0YuOC5d9b1cJPYpz12ZJGMa+XtLHGv5phT/DCXYfB3V1Q WRZDF86M0Ik5ksC2hG/t5c/7FVOaioQRiN2ZlajAgb8j+ZFW2tKONxfbNHobCDzOaa+NazhmeoN PuXRjX5PguyPUxWTBBrBShjRLR5Xl7v7q5MKX6ZmAJbhS109HDKSA5X1JpJ7dCfPOYl87OcYQEF Oz1uw1Jf9jJbmHV6LDg== X-Proofpoint-ORIG-GUID: CUEjnucOycqR-41KXHIInd9efweZbOc3 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMwMDEyNCBTYWx0ZWRfXzVibkgckb8pw 4I8CcmtXc48bvD/S6mS7H3um/ZrRIg5wmh/gv/PdetaI8kGrISaFY2ZUapDXhnKR0pNfXqG9OBk DerO460W+iNBc97ZkMOSBY0DyoGZBLc= X-Authority-Analysis: v=2.4 cv=PdzPQChd c=1 sm=1 tr=0 ts=6a6b7d46 cx=c_pps a=oc9J++0uMp73DTRD5QyR2A==:117 a=PRfkaYvzSr8QmIIGAkY2Sg==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=EUspDBNiAAAA:8 a=4zhTdlWgoSH5eR7NdxQA:9 a=QEXdDO2ut3YA:10 a=iYH6xdkBrDN1Jqds4HTS:22 X-Proofpoint-GUID: CUEjnucOycqR-41KXHIInd9efweZbOc3 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-30_05,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 malwarescore=0 clxscore=1015 bulkscore=0 lowpriorityscore=0 adultscore=0 phishscore=0 impostorscore=0 spamscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607300124 On 7/30/26 5:26 PM, Dmitry Baryshkov wrote: > iris_get_instance() looks up an instance on core->instances and returns > it after dropping core->lock, without taking any reference. The threaded > interrupt handler uses this to find the instance a firmware response > belongs to and then takes inst->lock. Meanwhile userspace may close the > same file descriptor: iris_close() removes the instance from the list, > destroys inst->lock and frees the instance. The interrupt handler then > operates on freed memory and a destroyed mutex, a use-after-free. > > Add a kref to struct iris_inst. iris_get_instance() takes a reference > under core->lock, so an instance it returns cannot be freed until the > caller drops that reference with iris_inst_put(). The instance is > released (mutexes destroyed, memory freed) only when the last reference > goes away, whether that is held by the closing thread or the interrupt > handler. > > Fixes: 38fc8beaba55 ("media: iris: implement reqbuf ioctl with vb2_queue_setup") > Signed-off-by: Dmitry Baryshkov > Assisted-by: Claude:claude-opus-4-8 > Signed-off-by: Dmitry Baryshkov I think your agent didn't get the part where it can never sign-off for you.. or some other funky combination Konrad