From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 84997403EA0 for ; Mon, 13 Jul 2026 12:09:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944578; cv=none; b=hJ9kqqNUx4jighnbPZnsVT2nfuYqXERb+B9gT6Dt+HqXYeGyJvLtiTQZpPVWBPnAmPEKRY3oZuxdcCr+rNjZ6AZjSuHHmh+Na4gITRaWF/sjtNSFrBqs14vjisms3TpGVwsSX6kLnnAGhf2dEMPA7796X4HA9z/p6e7yz+LDIE0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944578; c=relaxed/simple; bh=w1FVvyBSHnItHZLCaA4u0+0Ud64qWBuiALT5aaHxYAw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UmlFcwMg21QrZ+yffGC7lmDOKvzOCHfSXd/XNTE0f3nZA6X2LDABSd0ozu3FuG38CKUZ/a4BHvCQSWPviMvZZbIc3okGeK3CoeIdvwHI4Qn2Ex0LXPRxLjeuCEUf8csVRzJWgGD3/8sIHTMCVv6N9azU2QHInz8d6gMAJJHLbcU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=G5rMzgOs; arc=none smtp.client-ip=209.85.216.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="G5rMzgOs" Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-38125cebfdaso3934067a91.1 for ; Mon, 13 Jul 2026 05:09:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944576; x=1784549376; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=K3WTyPeomnpShciKNumkAzLHLjjvlL0zze6H3PBXARM=; b=G5rMzgOsTZIMBe8X91OXIqp31fowVMYh5+W+8NhYy1XVDf8MXAX3kWUPM0moLCDMcI 7rrbKW+GSnQfJJUihaMphg4Xf9iYcI0vUx77cYVEe8MltMX0HNLr4uIHDjDF8DQGV6Vz vm1go7g8AfsZzt3aFhZkerO8DzVgj5On9MD7fGj6G95mwyDaCXZIqDLEJ4lqqaraerfz 7CP3RPyB+GIaTORt+rwiGS2VzFF7bmEq66OCSPyEQO94AVmjmGfTvhgtm9i11XVJLF2+ IPjsZy9Hdfd5WrIzBdjg9+HLSfL3hAQ6ncZeOqWIcDNDXGOLZrtTL6KoALfWt8YHCRA+ H1ZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944576; x=1784549376; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=K3WTyPeomnpShciKNumkAzLHLjjvlL0zze6H3PBXARM=; b=S7lFVGoCru3QzJ6rCJHSHA7m7g86iR0IkOWw8/UVaOWKiikDW85+eoE9S7h4lfP5P4 2VMcfW7ErMnmJof+SdemVZt1l/sFRWdnfhA30mz+hmtBeDUL8crQ8J5OYRRgLwpUJOPu LSLZ7okupPkBO0YOoNV4xqP2chIm7PY8zJLihli4UqFGKRhI1tF3dH/rMSsvd3T76yh9 k3SX/HXt5yl+LdQcHckIvNKuBTp5+2ePjtE4Ehybb7mbk+WwQWDL8ZWFlC2MeyOYcDL9 bwpB8pX7awiyGciK7unNyQVWAdaX2lJ9PPtYEzUfSHbjsvKN202ZF33VrT4mYjz522sP 2KXA== X-Forwarded-Encrypted: i=1; AHgh+Rqp9Q8TFNC7FSsTG4YZnzLFiTqfx0GEGEzqGCCIjMR7ZjGH0k2hsQpGwSVMDKQJw65ad9XEPM3iCd4v3A==@vger.kernel.org X-Gm-Message-State: AOJu0YxKPBVCiiaV6EbbLQdCHq5cw3T6ZXcTS1CtXp+i/9KIYqSkKxAX /B2lrvCSxziRGhzeiRysJLnE7dxK0Iem9TNEJedlBUuG1mrQ/DrmuYd1 X-Gm-Gg: AfdE7clT0V8qgwF5OPssUA8HwSz/XbXKnp8cD3nik6u33dkou5wowMkrM0LQvhNhQiq Ew7Yrn4Iim5MPNY9rrenad3Ak85tKJU+bDwYisC+MH3Ppxwq1OX4VDDzFSc7+YqVk4BLyiXJLE1 dnWFUH53SWPcd9wmm0ekqQRAp9IhPZJoVwlZ9CJEduVhhN1x17Mvlj1NIdXNkBs2Q/+xDydbFka 0OCqIwWsra+vNF3DoI2WSXX3YvIvwQSQi5H7rAg59e0WNTgP7/bO3To1DZCTKNiJWxBUgZYvWA7 IYlq5P1P3WS+ubE7sLXNS7zljVoINmqdHKWgozRgdJ+rGZTGlckl785+9kbwG0Kph0hV7Fu4Lxy 1prJ3c7kA3Jzu7jktstT+EPva3Ijf+xpRYwwRTdH9SyepNPeRNXdeFRFHL0MYc3HceUX2G0jets THgDags676xw== X-Received: by 2002:a17:90b:2248:b0:387:e0db:3fae with SMTP id 98e67ed59e1d1-38dc7779d32mr8371305a91.39.1783944575701; Mon, 13 Jul 2026 05:09:35 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.09.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:09:34 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne , Sashiko Subject: [PATCH v7 04/19] media: meson: vdec: Fix use-after-free race between teardown and ISR routines Date: Mon, 13 Jul 2026 17:36:59 +0530 Message-ID: <20260713120840.17427-5-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Prevent critical race conditions and null pointer dereferences inside the Amlogic video decoder driver by synchronizing the interrupt service routines during session teardown and file descriptor release phases. The hardware interrupt handler (vdec_isr) and threaded handler (vdec_threaded_isr) read 'core->cur_sess' without proper synchronization. During a streaming teardown sequence via vdec_stop_streaming() or session release inside vdec_close(), the underlying session structures can be modified or freed concurrently. This creates a transient window where a late-stage hardware interrupt can wake up, read 'core->cur_sess', and dereference an invalid or NULL session pointer, causing a kernel panic. Update both the hard and threaded interrupt service routines to capture the current session reference using an smp_load_acquire() barrier snapshot. If the snapshot resolves to NULL, terminate immediately with IRQ_HANDLED to guarantee execution contexts do not process stale structures. Cc: Nicolas Dufresne Suggested-by: Druk Tan Ozturk Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel.org/ Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 22 ++++++++++++++++++++-- drivers/staging/media/meson/vdec/vdec.h | 2 ++ 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c index 7fc73d5cdebbf..7ae3d5a9dd6ab 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -484,6 +484,9 @@ static void vdec_stop_streaming(struct vb2_queue *q) } } + /* Synchronize and flush pending hardware interrupt service routines */ + synchronize_irq(core->vdec_irq); + vdec_poweroff(sess); vdec_free_canvas(sess); @@ -989,6 +992,9 @@ static int vdec_close(struct file *file) struct amvdec_session *sess = file_to_amvdec_session(file); struct amvdec_core *core = sess->core; + /* Synchronize and flush pending hardware interrupt service routines */ + synchronize_irq(core->vdec_irq); + if (!IS_ERR_OR_NULL(sess->recycle_thread)) { kthread_stop(sess->recycle_thread); sess->recycle_thread = NULL; @@ -1038,7 +1044,12 @@ static const struct v4l2_file_operations vdec_fops = { static irqreturn_t vdec_isr(int irq, void *data) { struct amvdec_core *core = data; - struct amvdec_session *sess = core->cur_sess; + struct amvdec_session *sess; + + /* Secure an atomic acquire snapshot to protect against concurrent teardown */ + sess = smp_load_acquire(&core->cur_sess); + if (!sess) + return IRQ_HANDLED; sess->last_irq_jiffies = get_jiffies_64(); @@ -1048,7 +1059,12 @@ static irqreturn_t vdec_isr(int irq, void *data) static irqreturn_t vdec_threaded_isr(int irq, void *data) { struct amvdec_core *core = data; - struct amvdec_session *sess = core->cur_sess; + struct amvdec_session *sess; + + /* Prevent late-stage threaded interrupts from dereferencing a NULL session */ + sess = smp_load_acquire(&core->cur_sess); + if (!sess) + return IRQ_HANDLED; return sess->fmt_out->codec_ops->threaded_isr(sess); } @@ -1136,6 +1152,8 @@ static int vdec_probe(struct platform_device *pdev) if (irq < 0) return irq; + core->vdec_irq = irq; + ret = devm_request_threaded_irq(core->dev, irq, vdec_isr, vdec_threaded_isr, IRQF_ONESHOT, "vdec", core); diff --git a/drivers/staging/media/meson/vdec/vdec.h b/drivers/staging/media/meson/vdec/vdec.h index cc0cfafb8a951..d165c343fd022 100644 --- a/drivers/staging/media/meson/vdec/vdec.h +++ b/drivers/staging/media/meson/vdec/vdec.h @@ -67,6 +67,7 @@ struct amvdec_session; * @v4l2_dev: v4l2 device * @cur_sess: current decoding session * @lock: video device lock + * @vdec_irq: irq for video decoding */ struct amvdec_core { void __iomem *dos_base; @@ -93,6 +94,7 @@ struct amvdec_core { struct amvdec_session *cur_sess; struct mutex lock; + int vdec_irq; }; /** -- 2.50.1