Re: [PATCH] media: mtk-jpeg: only init/cancel work for multi-core variants

[Nicolas Dufresne <nicolas.dufresne@collabora.com>]

[-- Attachment #1: Type: text/plain, Size: 2034 bytes --]

Hi,

Le lundi 01 juin 2026 à 15:32 +0800, Icenowy Zheng a écrit :
> Single-core variants of this hardware do not use the work at all, and
> the worker function is set to NULL, which leads to warnings when
> cancelling the work in release callback.
> 
> Skip the work init/cancel code when the JPEG hardware isn't multi-core.

Thanks for sending this patch, thought this specific issue has alrady been fixed
upstream, see commit b1845a227fda37b2fe5327df3ca0015d7e290235

Nicolas

> 
> Cc: stable@vger.kernel.org
> Fixes: 34c519feef3e ("media: mtk-jpeg: fix use-after-free in release path due
> to uncancelled work")
> Fixes: d40e95274925 ("media: mtk-jpeg: reconstructs the initialization mode of
> worker")
> Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
> ---
>  drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> index 8c684756d5fc2..83e54a7ef49c0 100644
> --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> @@ -1160,7 +1160,8 @@ static int mtk_jpeg_open(struct file *file)
>  		goto free;
>  	}
>  
> -	INIT_WORK(&ctx->jpeg_work, jpeg->variant->jpeg_worker);
> +	if (jpeg->variant->multi_core)
> +		INIT_WORK(&ctx->jpeg_work, jpeg->variant->jpeg_worker);
>  	INIT_LIST_HEAD(&ctx->dst_done_queue);
>  	spin_lock_init(&ctx->done_queue_lock);
>  	v4l2_fh_init(&ctx->fh, vfd);
> @@ -1202,7 +1203,8 @@ static int mtk_jpeg_release(struct file *file)
>  	struct mtk_jpeg_dev *jpeg = video_drvdata(file);
>  	struct mtk_jpeg_ctx *ctx = mtk_jpeg_file_to_ctx(file);
>  
> -	cancel_work_sync(&ctx->jpeg_work);
> +	if (jpeg->variant->multi_core)
> +		cancel_work_sync(&ctx->jpeg_work);
>  	mutex_lock(&jpeg->lock);
>  	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
>  	v4l2_ctrl_handler_free(&ctx->ctrl_hdl);

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]