From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82B5B4071C5 for ; Mon, 13 Jul 2026 12:09:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944600; cv=none; b=QVL/IeLblgtWp1fxzbqdAunY1T5CxsFW5YKO26dBU9fMnIUhZw5q+qZajahZR3HT9RFwho7MguX9y2TxFSnFQLQlDW+5a1nfrrKafpuqCmwGKMC/6szRTlq7AM5K9s9fEwlHgmnP8O3E+vpMGP6EPyzXFzZT4Eiw9wKXIrfqy74= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944600; c=relaxed/simple; bh=kWjWrkYR+dFbDvQ8L5AHa4OLzTj4rBUUdqyRkjtvM1s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UlAFf/IeLAcr+f7/bmhJVAwjaZRFVdd82aZ+F187FIc5KUL8DwGMWZPQIwdtG84YvWO3PpDr/dcgMlSlvy1Az+BQcudsS7FqNY7py/0ZyUy9mYpIOsV4pCZ6+aPiiL1wsysnFXDkr+D1BxapavCD9N8DykMv3E4QvHFq2lEY/HI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BWKbG7TL; arc=none smtp.client-ip=209.85.216.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BWKbG7TL" Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-381216921aaso3397249a91.1 for ; Mon, 13 Jul 2026 05:09:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944597; x=1784549397; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=R5VN0Op/PYgxXXGiNzBVb7Bc2A/YDsd2gosba72MniQ=; b=BWKbG7TLfQhde5neCAajbjpbN9iHaGDot8+s5eak4xHWDOQTmc9xPMCOSDd4YWiPe0 TXn7+f6OOX1R/jqy5RVEwHq9+Q+kJhFbnFa/T3+XIPjjzpHD5Er60EY8iisKgS+R+v8f VZwU+p89UfvL/CPm19hS/BF7aJ90uiebr8EtxpcSMnEHWKk15rWTE4E8Sb0Ge79fHCxC /rGxbaNTormuaOgNE93sS3KoBUNe7ZMtNPQtyZzWLyHysq29RXblQGl44mDDe0VOJCjS sZNrkYG5oLRlTwmgmqU/InQPpoRYbA9+ACKuTqr8sjz4KknOGR+9ZteSA+ZLhRjjVI6X 63ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944597; x=1784549397; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=R5VN0Op/PYgxXXGiNzBVb7Bc2A/YDsd2gosba72MniQ=; b=EtGXN0+312sq6za73FCvMn3v89tDYqGBdsczXLyBEcEhdx1/JjWruSpMar4kSAaY1i fmZb6RIqdggjPWDb9pWSlu1wt41chAU1zQ9jbBhXgOOjgPN7dbCdqerKJ1XHAt/6Iu7g zFp18TsHauP9j09xYOT4bjmJBHoT8ycnf1bNZq2Yl0i0wbRcf1CTVi1Paz8CYpU8Q9lU 9uXhrCS2bT9EDtwyEtZorLy1h5bhJu9oYelhACLRZQOB7cMvFQ11CgBzHRF9o78CsvN5 RnINTyiie4/dn8d0ub1yeg740uqvW1ndy0BrsVD6uoZsH+OgD/MdSJky3wUiVCdzw92v l/ZA== X-Forwarded-Encrypted: i=1; AHgh+RqPrPEwwg6ZZ2kj5JADITLUhLoTZUU7+dXbS2vXuYSb/XTZLQACGWZHbx+aHYg/C5HrgrLzn2DiFqewdAQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yxa/1bhBpyHCvKeBZN870jMtAWVq9rAbG6w6LP3fLkOvh+NJlmV vyqpqAHfY7bIVM/giN7Rf4fsJB5dyA3zB4xuxAX6ljHymuuOIGwMP6wB X-Gm-Gg: AfdE7cleikj+6sXxjhP/rW2KF74RtyP6+i4kFqSbk/PPbrMBN7QzwT3HIJZEgH6LwuE 8Dv1JoNwAF+64OUvN6Mm2kOXjHIPKT5ccHZn2251dot8NdQDHX4JdC9Gq4OB6WEWl6D4IuXMWy/ iRVhLI9Uz1Ng3HAFs4sbjYb0qs+I/Bym7XjZLNAMJxhNkWarwxIenozxGWri1dsOgqxJcTfpLuq EmqASzW0bLb/rRePzLGrNB4lJ+kBAczSpY7sP7kfedo9zV56JRFybL6MiaZ+uXEZA5btpbKRCEf DPSOYtyJucRPEXI1gXSxpTM/hjFWHSt82RJb/5l69hNxkQbWs5yPsBCugW87HAKfpgnqHG0GzIR MLMaDr756NVcaSq94rjVomWAFb6J8oeX3NMdjyfEkalM7OIBjRrijDNLdYArNsWR/VQY0xZ1alt JB7cYNEWweKQ== X-Received: by 2002:a17:90b:3c43:b0:37f:9ce3:ca97 with SMTP id 98e67ed59e1d1-38dc777b8a2mr8263084a91.32.1783944596948; Mon, 13 Jul 2026 05:09:56 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.09.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:09:56 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne , Sashiko Subject: [PATCH v7 06/19] media: meson: vdec: Fix race condition by canceling work sync Date: Mon, 13 Jul 2026 17:37:01 +0530 Message-ID: <20260713120840.17427-7-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Synchronize work-queue states cleanly during streaming teardown and close operations to eliminate asynchronous pipeline race conditions. The esparser ISR can schedule work onto 'esparser_queue_work'. While synchronize_irq() ensures the ISR itself finishes executing, it does not prevent any already scheduled work items from running concurrently during driver teardown. This causes a race condition during stream stopping or file closing. Remove the scheduling of esparser queue work during destination buffer completion, as freeing the vififo is handled elsewhere. Add synchronous cancellation of any pending work in vdec_stop_streaming and vdec_close before synchronizing interrupts to prevent use-after-free and race conditions. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel.org/ Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c index 7689ffdb2e500..6fe9722577179 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -484,11 +484,15 @@ static void vdec_stop_streaming(struct vb2_queue *q) } } + mutex_unlock(&core->lock); /* Synchronize and flush pending hardware interrupt service routines */ synchronize_irq(core->vdec_irq); /* Ensure esparser ISR finishes executing */ synchronize_irq(core->esparser_irq); + cancel_work_sync(&sess->esparser_queue_work); + mutex_lock(&core->lock); + vdec_poweroff(sess); vdec_free_canvas(sess); @@ -999,6 +1003,8 @@ static int vdec_close(struct file *file) /* Ensure esparser ISR finishes executing */ synchronize_irq(core->esparser_irq); + cancel_work_sync(&sess->esparser_queue_work); + if (!IS_ERR_OR_NULL(sess->recycle_thread)) { kthread_stop(sess->recycle_thread); sess->recycle_thread = NULL; -- 2.50.1