[PATCH 0/3] media: cancel timeout delayed work before freeing its owner

[PATCH 0/3] media: cancel timeout delayed work before freeing its owner

[Shengzhuo Wei]

Three m2m codec drivers arm a per-job timeout delayed work on the
system workqueue and only cancel it on the job-completion path. If the
hardware never completes the job, the release/remove path frees the
object the timeout callback dereferences (via container_of or through
the m2m device) with the work still pending -- a use-after-free when
the timer expires.

All three are the same missed-twins class as the recent mtk-jpeg
jpeg_work release fix and the host1x timeout-worker fix. In each case
the fix is a single cancel_delayed_work_sync() placed before the object
is freed:

  - mxc-jpeg: cancel ctx->task_timer in mxc_jpeg_release() before
    kfree(ctx); the timer is otherwise only cancelled in the job IRQ.
  - hantro: cancel vpu->watchdog_work in hantro_remove() before
    v4l2_m2m_put() frees the m2m device the watchdog dereferences.
  - mtk-jpeg: cancel jpeg->job_timeout_work in mtk_jpeg_remove()
    before v4l2_m2m_release(); ctx->jpeg_work in the same driver got
    the equivalent fix earlier, the device-level work was missed.

Patches are independent of each other.

---
Shengzhuo Wei (3):
      media: nxp: imx-jpeg: cancel task_timer before freeing ctx
      media: verisilicon: hantro: cancel watchdog work before m2m release
      media: mediatek: jpeg: cancel job timeout work before m2m release

 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 +
 drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c       | 2 ++
 drivers/media/platform/verisilicon/hantro_drv.c      | 1 +
 3 files changed, 4 insertions(+)
---
base-commit: 075b74841bd0065a3bda3440873c747938e69b68
change-id: 20260825-media-timeout-work-1cef7720c63b

Best regards,
-- 
Shengzhuo Wei <me@cherr.cc>

[PATCH 1/3] media: nxp: imx-jpeg: cancel task_timer before freeing ctx

[Shengzhuo Wei]

mxc_jpeg_device_run() arms ctx->task_timer for each job; the only place
it is cancelled is the job-completion IRQ handler. If the hardware
never completes the job, mxc_jpeg_release() frees ctx with the timer
still pending, and mxc_jpeg_device_run_timeout() then dereferences the
freed ctx -- a use-after-free.

Cancel the timer before the ctx is torn down, before taking
mxc_jpeg->lock so the cancel never waits on a worker that needs the
mutex.

Fixes: cfed9632ca8e ("media: imx-jpeg: Add a timeout mechanism for each frame")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Assisted-by: GLM:5.3
---
 drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
index 725e941528848e8f224fe6a96ba7f746fc45ed63..fbb64a1ecb5189d2d7b953b99dcd7bcb54e6e20e 100644
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -2796,6 +2796,8 @@ static int mxc_jpeg_release(struct file *file)
 	struct mxc_jpeg_ctx *ctx = mxc_jpeg_file_to_ctx(file);
 	struct device *dev = mxc_jpeg->dev;
 
+	cancel_delayed_work_sync(&ctx->task_timer);
+
 	mutex_lock(&mxc_jpeg->lock);
 	if (mxc_jpeg->mode == MXC_JPEG_DECODE)
 		dev_dbg(dev, "Release JPEG decoder instance on slot %d.",

-- 
2.47.3

Re: [PATCH 1/3] media: nxp: imx-jpeg: cancel task_timer before freeing ctx

[Ming Qian(OSS)]

On Tue, Aug 25, 2026 at 03:34:30AM +0800, Shengzhuo Wei wrote:
> [You don't often get email from me@cherr.cc. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 

Hi Shengzhuo,

Thanks for the patch.

This use-after-free has already been fixed by Fan Wu:
    https://lore.kernel.org/lkml/20260623103031.3051-1-fanwu01@zju.edu.cn/
    [PATCH] media: imx-jpeg: cancel timeout worker when streaming stops

Regards,
Ming

> mxc_jpeg_device_run() arms ctx->task_timer for each job; the only place
> it is cancelled is the job-completion IRQ handler. If the hardware
> never completes the job, mxc_jpeg_release() frees ctx with the timer
> still pending, and mxc_jpeg_device_run_timeout() then dereferences the
> freed ctx -- a use-after-free.
> 
> Cancel the timer before the ctx is torn down, before taking
> mxc_jpeg->lock so the cancel never waits on a worker that needs the
> mutex.
> 
> Fixes: cfed9632ca8e ("media: imx-jpeg: Add a timeout mechanism for each frame")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shengzhuo Wei <me@cherr.cc>
> Assisted-by: GLM:5.3
> ---
>  drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> index 725e941528848e8f224fe6a96ba7f746fc45ed63..fbb64a1ecb5189d2d7b953b99dcd7bcb54e6e20e 100644
> --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> @@ -2796,6 +2796,8 @@ static int mxc_jpeg_release(struct file *file)
>         struct mxc_jpeg_ctx *ctx = mxc_jpeg_file_to_ctx(file);
>         struct device *dev = mxc_jpeg->dev;
> 
> +       cancel_delayed_work_sync(&ctx->task_timer);
> +
>         mutex_lock(&mxc_jpeg->lock);
>         if (mxc_jpeg->mode == MXC_JPEG_DECODE)
>                 dev_dbg(dev, "Release JPEG decoder instance on slot %d.",
> 
> --
> 2.47.3
> 

Re: [PATCH 1/3] media: nxp: imx-jpeg: cancel task_timer before freeing ctx

[Shengzhuo Wei]

On 2026-08-25 10:56, Ming Qian(OSS) wrote:
> Hi Shengzhuo,
> 
> Thanks for the patch.
> 
> This use-after-free has already been fixed by Fan Wu:
>     https://lore.kernel.org/lkml/20260623103031.3051-1-fanwu01@zju.edu.cn/
>     [PATCH] media: imx-jpeg: cancel timeout worker when streaming stops
> 
> Regards,
> Ming
> 

Hi Ming,

Thanks for pointing me at Fan Wu's patch -- I had missed it (it is not
in the 7.2-rc6 base I worked from, and I failed to check for in-flight
patches on the list before sending). His version is also the better
one: placing the cancel in mxc_jpeg_stop_streaming() closes the
re-arm window that a cancel in mxc_jpeg_release() leaves open, which
Sashiko also flagged on my 1/3. I'll drop that patch.

The other two patches in the series (hantro watchdog, mtk-jpeg
job_timeout_work) fix the same class of bug in different drivers and,
as far as I can tell, have no equivalent fix in flight. Sashiko raised
one real point on the mtk patch: jpeg->job_timeout_work is only
initialized on the single-core path, so the unconditional
cancel_delayed_work_sync() in mtk_jpeg_remove() would hit a zeroed
work struct (WARN_ON(!work->func)) on multi-core variants. I plan to
send a v2 that drops the imx-jpeg patch and guards the mtk cancel
accordingly.

Do you see anything else in the remaining two patches you'd like
changed before I send the v2?

Regards,
Shengzhuo

[PATCH 2/3] media: verisilicon: hantro: cancel watchdog work before m2m release

[Shengzhuo Wei]

Each job arms vpu->watchdog_work, cancelled only by the
job-completion path. If a job stalls, hantro_remove() drops the last
reference to vpu->m2m_dev via v4l2_m2m_put() with the watchdog still
pending, and hantro_watchdog() then dereferences the freed m2m_dev --
a use-after-free.

Drain the watchdog before the m2m device is released.

Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Assisted-by: GLM:5.3
---
 drivers/media/platform/verisilicon/hantro_drv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 2e81877f640fb429b18d2f4fd64bc0c392cf600e..1b04b98371a48184f390a13791243fd00d6b80ef 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -1284,6 +1284,7 @@ static void hantro_remove(struct platform_device *pdev)
 	hantro_remove_dec_func(vpu);
 	hantro_remove_enc_func(vpu);
 	media_device_cleanup(&vpu->mdev);
+	cancel_delayed_work_sync(&vpu->watchdog_work);
 	v4l2_m2m_put(vpu->m2m_dev);
 	v4l2_device_unregister(&vpu->v4l2_dev);
 	clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);

-- 
2.47.3

[PATCH 3/3] media: mediatek: jpeg: cancel job timeout work before m2m release

[Shengzhuo Wei]

Each job arms jpeg->job_timeout_work, cancelled only by the IRQ
completion path. If a job stalls, mtk_jpeg_remove() frees
jpeg->m2m_dev via v4l2_m2m_release() with the timeout still pending,
and mtk_jpeg_job_timeout_work() then dereferences the freed m2m_dev
and the stale ctx it returns -- a use-after-free.

Drain the work before the m2m device is released. The device-level
job_timeout_work was missed by the earlier fix for ctx->jpeg_work.

Fixes: 5fb1c2361e56 ("mtk-jpegenc: add jpeg encode worker interface")
Fixes: dedc21500334 ("media: mtk-jpegdec: add jpeg decode worker interface")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Assisted-by: GLM:5.3
---
 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index d147ec48308110ae8520662e182dc0445447d8d0..f0fe14e83d515f5011cbfe051abbf565568013d0 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1405,6 +1405,7 @@ static void mtk_jpeg_remove(struct platform_device *pdev)
 
 	pm_runtime_disable(&pdev->dev);
 	video_unregister_device(jpeg->vdev);
+	cancel_delayed_work_sync(&jpeg->job_timeout_work);
 	v4l2_m2m_release(jpeg->m2m_dev);
 	v4l2_device_unregister(&jpeg->v4l2_dev);
 }

-- 
2.47.3