[PATCH] media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release

[PATCH] media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

v4l2_m2m_release() frees the m2m_dev struct without cancelling
m2m_dev->job_work.  If a device operation schedules work via
v4l2_m2m_try_schedule() and the driver tears down the m2m context
concurrently, the work fires on freed memory.

Add cancel_work_sync() before the kfree in v4l2_m2m_release().

Fixes: 7f98639def42 ("V4L/DVB: add memory-to-memory device helper framework for videobuf")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/media/v4l2-core/v4l2-mem2mem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index a65cbb124cfe0..311e2e08d066d 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -1207,6 +1207,7 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_init);
 
 void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
 {
+	cancel_work_sync(&m2m_dev->job_work);
 	kfree(m2m_dev);
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_release);
-- 
2.47.3