[PATCH] media: iris: Fix use-after-free in iris_release_internal_buffers()

[PATCH] media: iris: Fix use-after-free in iris_release_internal_buffers()

[Dikshita Agarwal]

The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy
internal buffers after FW releases") introduced a regression where
session_release_buf() may free the buffer. The caller,
iris_release_internal_buffers(), continued to access `buffer` after the
call, leading to a potential use-after-free.

Fix this by setting BUF_ATTR_PENDING_RELEASE before calling
session_release_buf(), and reverting the flag if the call fails. This
ensures no dereference occurs after potential freeing.

Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases")
Cc: stable@vger.kernel.org
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
---
 drivers/media/platform/qcom/iris/iris_buffer.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
index f1f003a787bf22db6f048c9e682ba8ed2f39bc21..fd30ec8e33653bd21d3c4d1057f4f1eea938228d 100644
--- a/drivers/media/platform/qcom/iris/iris_buffer.c
+++ b/drivers/media/platform/qcom/iris/iris_buffer.c
@@ -582,10 +582,12 @@ static int iris_release_internal_buffers(struct iris_inst *inst,
 			continue;
 		if (!(buffer->attr & BUF_ATTR_QUEUED))
 			continue;
+		buffer->attr |= BUF_ATTR_PENDING_RELEASE;
 		ret = hfi_ops->session_release_buf(inst, buffer);
-		if (ret)
+		if (ret) {
+			buffer->attr &= ~BUF_ATTR_PENDING_RELEASE;
 			return ret;
-		buffer->attr |= BUF_ATTR_PENDING_RELEASE;
+		}
 	}
 
 	return 0;

---
base-commit: 205697a4aaf20ee56705d7b4771f4081f594e7f7
change-id: 20260213-iris-smatch-fix-68f6a90f9c9e

Best regards,
-- 
Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>

Re: [PATCH] media: iris: Fix use-after-free in iris_release_internal_buffers()

[Vikash Garodia]

On 2/16/2026 12:37 PM, Dikshita Agarwal wrote:
> The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy
> internal buffers after FW releases") introduced a regression where
> session_release_buf() may free the buffer. The caller,
> iris_release_internal_buffers(), continued to access `buffer` after the
> call, leading to a potential use-after-free.
> 
> Fix this by setting BUF_ATTR_PENDING_RELEASE before calling
> session_release_buf(), and reverting the flag if the call fails. This
> ensures no dereference occurs after potential freeing.
> 
> Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases")
> Cc: stable@vger.kernel.org
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r
> Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
> ---

Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>