On Fri Jul 31 03:31:41 2026 +0300, Dmitry Baryshkov wrote:
> iris_check_session_supported() walks core->instances to confirm the
> current instance is registered, but does so without holding core->lock.
> A concurrent iris_close() takes core->lock and removes a (possibly
> different) instance from the list via list_del_init() before freeing it,
> so the lockless traversal can follow a freed pointer and dereference it,
> resulting in a use-after-free.
>
> Hold core->lock across the list traversal, matching the other iterators
> over core->instances such as iris_check_core_mbpf(). The lock is dropped
> before iris_check_core_mbpf() is called so the nesting is unchanged.
>
> Fixes: bdbe1cac0c10 ("media: iris: add check whether the video session is
> supported or not")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dmitry Baryshkov <[email protected]>
> Reviewed-by: Konrad Dybcio <[email protected]>
> Signed-off-by: Bryan O'Donoghue <[email protected]>
Patch committed.
Thanks,
Bryan O'Donoghue
drivers/media/platform/qcom/iris/iris_vb2.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
---
diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c
b/drivers/media/platform/qcom/iris/iris_vb2.c
index a2ea2d67f60d..8faf709c26c1 100644
--- a/drivers/media/platform/qcom/iris/iris_vb2.c
+++ b/drivers/media/platform/qcom/iris/iris_vb2.c
@@ -56,10 +56,14 @@ static int iris_check_session_supported(struct iris_inst
*inst)
bool found = false;
int ret;
+ mutex_lock(&core->lock);
list_for_each_entry(instance, &core->instances, list) {
- if (instance == inst)
+ if (instance == inst) {
found = true;
+ break;
+ }
}
+ mutex_unlock(&core->lock);
if (!found) {
ret = -EINVAL;
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
