Re: [PATCH] media: imx-jpeg: Cancel timeout work on release

[Frank Li <Frank.li@oss.nxp.com>]

On Fri, Aug 28, 2026 at 02:14:52PM +0900, Kazuki Hanai wrote:
> [You don't often get email from hnkz.64@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> mxc_jpeg_device_run_timeout() signals job completion through
> v4l2_m2m_job_finish(). This clears TRANS_RUNNING and allows a concurrent
> v4l2_m2m_ctx_release() to continue. The timeout handler then accesses
> ctx->mxc_jpeg once more while releasing hw_lock, but the release path may
> already have freed ctx, resulting in a use-after-free.
>
> Synchronously cancel the timeout work after v4l2_m2m_ctx_release() and
> before freeing ctx. The cancellation must remain after the mem2mem release
> because the timeout is the only completion path for a hung hardware job.
>
> Fixes: cfed9632ca8e ("media: imx-jpeg: Add a timeout mechanism for each frame")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kazuki Hanai <hnkz.64@gmail.com>
> ---

Suppose it already fixed

https://lore.kernel.org/lkml/20260623103031.3051-1-fanwu01@zju.edu.cn/

Frank

>  drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> index 725e94152884..dfe3b1ea6bb4 100644
> --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> @@ -2805,6 +2805,7 @@ static int mxc_jpeg_release(struct file *file)
>                         ctx->slot);
>         v4l2_ctrl_handler_free(&ctx->ctrl_handler);
>         v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
> +       cancel_delayed_work_sync(&ctx->task_timer);
>         v4l2_fh_del(&ctx->fh, file);
>         v4l2_fh_exit(&ctx->fh);
>         kfree(ctx);
> --
> 2.53.0
>
>