Re: [PATCH v6 17/18] media: venus: skip QCM2290 if Iris driver is enabled

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] A scheduled delayed work can execute after the `venus_core` structure is freed on the probe error path.
- [High] The `venus_probe` error path fails to clean up HFI resources if the IRQ request fails.
--

--- Patch [17]: [PATCH v6 17/18] media: venus: skip QCM2290 if Iris driver is enabled ---
commit aca4e84f0aabcb82f9ee70af8657eb2e88c258cf
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

media: venus: skip QCM2290 if Iris driver is enabled

This commit avoids a race condition between the Venus and Iris drivers
on platforms where Iris now supports QCM2290. It achieves this by
skipping QCM2290 hardware in the Venus driver when the Iris driver is
enabled.

> diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
> index 243e342b0ae75..3c88594eb1d00 100644
> --- a/drivers/media/platform/qcom/venus/core.c
> +++ b/drivers/media/platform/qcom/venus/core.c

[ ... ]

[Severity: High]
This isn't a bug introduced by this patch, but does the IRQ error path
in venus_probe() leak resources?

drivers/media/platform/qcom/venus/core.c:venus_probe() {
...
	ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
					"venus", core);
	if (ret)
		goto err_core_put;
...
}

Earlier in venus_probe(), hfi_create() allocates memory and DMA buffers.
If devm_request_threaded_irq() fails and returns -EPROBE_DEFER, the code
jumps to err_core_put, bypassing err_hfi_destroy and the call to
hfi_destroy().

Should this error path jump to err_hfi_destroy instead to prevent
exhausting contiguous DMA memory on repeated probe deferrals?

[Severity: High]
This is a pre-existing issue, but could this error path in venus_probe()
lead to a use-after-free?

drivers/media/platform/qcom/venus/core.c:venus_probe() {
...
err_hfi_destroy:
	hfi_destroy(core);
err_core_put:
	if (core->pm_ops->core_put)
		core->pm_ops->core_put(core);
	return ret;
}

If a hardware interrupt fires during probe, venus_event_notify() can
schedule core->work. If probe subsequently fails, the error path does
not call cancel_delayed_work_sync().

Devres will then free the core object, and the pending delayed work will
dereference it when it executes. Should cancel_delayed_work_sync() be
called before returning here?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-iris-ar50lt-v6-0-374f0a46c23b@oss.qualcomm.com?part=17