Re: [PATCH v9 11/14] media: iris: Add hooks for pixel and non-pixel context banks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] V4L2 file release callback `iris_close()` accesses the `core` structure after it has been freed by `devres` during driver unbind.
--

--- Patch [11]: [PATCH v9 11/14] media: iris: Add hooks for pixel and non-pixel context banks ---
commit 8d8f4d5f3484b996ec8fcb46a6a17cb0805e77fa
Author: Vikash Garodia <vikash.garodia@oss.qualcomm.com>

media: iris: Add hooks for pixel and non-pixel context banks

Iris platforms use separate context-bank devices for the pixel, non-pixel
firmware domains. Add platform hooks to create and destroy those
subdevices, and wire them up for the affected platforms.

> diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c
> index 97563bf899392..7d9d67baf22a8 100644
> --- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
> +++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c

[ ... ]

[Severity: High]
This is a pre-existing issue, but while reviewing the driver's lifecycle
management I noticed a potential use-after-free in the V4L2 file release
flow.

If a userspace process opens the V4L2 device and the driver is subsequently
unbound (e.g., via sysfs), the driver core automatically frees all devres
allocations, including the iris_core structure.

When the userspace process later closes the file descriptor, iris_close()
is called. Can this trigger a use-after-free when it accesses the freed
core structure?

drivers/media/platform/qcom/iris/iris_vidc.c:iris_close() {
        ...
        iris_check_num_queued_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
        iris_remove_session(inst);
        ...
}

Which then takes a mutex on the already freed core structure:

drivers/media/platform/qcom/iris/iris_vidc.c:iris_remove_session() {
        struct iris_core *core = inst->core;

        mutex_lock(&core->lock);
        ...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=11