Re: [PATCH v7 09/18] media: iris: Add platform flag for instantaneous bandwidth voting

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] This problem wasn't introduced by this patch, but the `iris_core` structure is allocated with `devm_kzalloc`, leading to a Use-After-Free during device unbind because the video device and delayed work outlive the device-managed allocation.
--

--- Patch [9]: [PATCH v7 09/18] media: iris: Add platform flag for instantaneous bandwidth voting ---
commit 5567f5c1da418821cf2cb0c55e4585a7cba76a62
Author: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>

media: iris: Add platform flag for instantaneous bandwidth voting

This commit introduces a platform-configurable instantaneous bandwidth (IB)
multiplier and enables IB voting for all SoCs. It prepares for AR50LT core
support, which requires explicit IB voting in addition to average bandwidth
(AB) for interconnect QoS. Existing platforms will default to an equal IB
and AB, whereas AR50LT will require 2x peak bandwidth.

> diff --git a/drivers/media/platform/qcom/iris/iris_resources.c b/drivers/media/platform/qcom/iris/iris_resources.c
> index 773f6548370a2..caeaf199cef74 100644
> --- a/drivers/media/platform/qcom/iris/iris_resources.c
> +++ b/drivers/media/platform/qcom/iris/iris_resources.c
> @@ -18,6 +18,7 @@
>  
>  int iris_set_icc_bw(struct iris_core *core, unsigned long icc_bw)
>  {
> +	u32 icc_ib_multiplier = core->iris_platform_data->icc_ib_multiplier;
>  	unsigned long bw_kbps = 0, bw_prev = 0;
>  	const struct icc_info *icc_tbl;
>  	int ret = 0, i;

[Severity: Critical]
This is a pre-existing issue, but the iris_core structure is allocated with
devm_kzalloc, which can lead to a use-after-free regression during device
unbind. The video device and delayed work appear to outlive the
device-managed allocation.

In drivers/media/platform/qcom/iris/iris_probe.c:iris_probe():

    core = devm_kzalloc(&pdev->dev, sizeof(*core), GFP_KERNEL);

The unbind path fails to explicitly cancel the delayed work and exits,
triggering devm to free the core structure while V4L2 file descriptors may
still be open:

drivers/media/platform/qcom/iris/iris_probe.c:iris_remove() {
        struct iris_core *core;
        
        core = platform_get_drvdata(pdev);
        if (!core)
            return;
            
        iris_core_deinit(core);
        
        video_unregister_device(core->vdev_dec);
        video_unregister_device(core->vdev_enc);
        
        v4l2_device_unregister(&core->v4l2_dev);
        
        mutex_destroy(&core->lock);
}

When a lingering file descriptor is eventually closed, iris_close() invokes
iris_remove_session(), which dereferences the freed core structure and its
destroyed lock:

drivers/media/platform/qcom/iris/iris_vidc.c:iris_remove_session() {
    struct iris_core *core = inst->core;
    
    mutex_lock(&core->lock);
    ...
}

Can this corrupt memory if the driver is unbound while the video node is in
use, or while the error handling delayed work is active?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-iris-ar50lt-v7-0-76af9dd4d1f6@oss.qualcomm.com?part=9