Re: [PATCH v17 06/12] media: mediatek: jpeg: fix buffer state update timing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] media: mtk-jpeg: Use-After-Free in mtk_jpegdec_worker on timeout race
--

commit 44ce2c64fc6b5a268c3679b0da3fbbbb9bc8ce15
Author: Kyrie Wu <kyrie.wu@mediatek.com>

media: mediatek: jpeg: fix buffer state update timing

This commit delays the update of the destination buffer state until after the
decoder has selected a hardware core and resumed its runtime PM state. It also
protects the buffer state update with the hardware spinlock and stops walking
the done queue after completing the next expected frame.

> diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> index a5a1f6126af73..e152ebae0f219 100644
> --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
[ ... ]
> @@ -1773,6 +1767,9 @@ static void mtk_jpegdec_worker(struct work_struct *work)
>  			      msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
>  
>  	spin_lock_irqsave(&comp_jpeg[hw_id]->hw_lock, flags);
> +	jpeg_dst_buf = mtk_jpeg_vb2_to_srcbuf(&dst_buf->vb2_buf);
> +	jpeg_dst_buf->curr_ctx = ctx;
> +	jpeg_dst_buf->frame_num = ctx->total_frame_num;

[Severity: High]
If mtk_jpegdec_worker() is preempted immediately after schedule_delayed_work(),
but before acquiring the spinlock, could the timeout handler run?

If the timeout handler executes during this window, it could reset the hardware
state to idle and complete the buffers back to userspace (where they might
subsequently be freed).

When the worker thread resumes, would writing to jpeg_dst_buf->curr_ctx and
frame_num result in a use-after-free?

Could the hardware then be programmed to DMA into those potentially unowned
addresses?

>  	ctx->total_frame_num++;
>  	mtk_jpeg_dec_reset(comp_jpeg[hw_id]->reg_base);
>  	mtk_jpeg_dec_set_config(comp_jpeg[hw_id]->reg_base,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922091530.241762-1-kyrie.wu@mediatek.com?part=6