[PATCH] media: mtk-jpeg: drain hardware completion before freeing context

[PATCH] media: mtk-jpeg: drain hardware completion before freeing context

[Guangshuo Li]

The change referenced by the Fixes tag cancels ctx->jpeg_work before
freeing the JPEG context from mtk_jpeg_release().

That prevents a queued or running JPEG worker from dereferencing the
context after it has been freed. However, on multi-core hardware the
worker can program a hardware instance, arm the per-hardware timeout
work, store the context in hw_param.curr_ctx and then return while the
hardware completion is still pending.

In that state cancel_work_sync(&ctx->jpeg_work) can complete even though
the IRQ handler or timeout work can still recover the same context from
hw_param.curr_ctx. If userspace closes the file before the hardware
completion path has run, release can free the context and a later IRQ or
timeout work can dereference the freed ctx while updating the done queues.

Drain the in-flight hardware completion state associated with the context
before freeing it.

Fixes: 34c519feef3e ("media: mtk-jpeg: fix use-after-free in release path due to uncancelled work")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index d147ec483081..bc9eea0483ce 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1202,8 +1202,11 @@ static int mtk_jpeg_release(struct file *file)
 	struct mtk_jpeg_dev *jpeg = video_drvdata(file);
 	struct mtk_jpeg_ctx *ctx = mtk_jpeg_file_to_ctx(file);
 
-	if (jpeg->variant->jpeg_worker)
+	if (jpeg->variant->jpeg_worker) {
 		cancel_work_sync(&ctx->jpeg_work);
+		mtk_jpeg_release_hw(jpeg, ctx);
+	}
+
 	mutex_lock(&jpeg->lock);
 	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
 	v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
-- 
2.43.0

Re: [PATCH] media: mtk-jpeg: drain hardware completion before freeing context

[Nicolas Dufresne]

[-- Attachment #1: Type: text/plain, Size: 2195 bytes --]

Le mercredi 08 juillet 2026 à 20:08 +0800, Guangshuo Li a écrit :
> The change referenced by the Fixes tag cancels ctx->jpeg_work before
> freeing the JPEG context from mtk_jpeg_release().
> 
> That prevents a queued or running JPEG worker from dereferencing the
> context after it has been freed. However, on multi-core hardware the
> worker can program a hardware instance, arm the per-hardware timeout
> work, store the context in hw_param.curr_ctx and then return while the
> hardware completion is still pending.
> 
> In that state cancel_work_sync(&ctx->jpeg_work) can complete even though
> the IRQ handler or timeout work can still recover the same context from
> hw_param.curr_ctx. If userspace closes the file before the hardware
> completion path has run, release can free the context and a later IRQ or
> timeout work can dereference the freed ctx while updating the done queues.
> 
> Drain the in-flight hardware completion state associated with the context
> before freeing it.
> 
> Fixes: 34c519feef3e ("media: mtk-jpeg: fix use-after-free in release path due to uncancelled work")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Build failed.

https://gitlab.freedesktop.org/linux-media/users/patchwork/-/jobs/104405577

Nicolas

> ---
>  drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> index d147ec483081..bc9eea0483ce 100644
> --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> @@ -1202,8 +1202,11 @@ static int mtk_jpeg_release(struct file *file)
>  	struct mtk_jpeg_dev *jpeg = video_drvdata(file);
>  	struct mtk_jpeg_ctx *ctx = mtk_jpeg_file_to_ctx(file);
>  
> -	if (jpeg->variant->jpeg_worker)
> +	if (jpeg->variant->jpeg_worker) {
>  		cancel_work_sync(&ctx->jpeg_work);
> +		mtk_jpeg_release_hw(jpeg, ctx);
> +	}
> +
>  	mutex_lock(&jpeg->lock);
>  	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
>  	v4l2_ctrl_handler_free(&ctx->ctrl_hdl);

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH] media: mtk-jpeg: drain hardware completion before freeing context

[kernel test robot]

Hi Guangshuo,

kernel test robot noticed the following build errors:

[auto build test ERROR on linuxtv-media-pending/master]
[also build test ERROR on media-tree/master linus/master v7.2-rc5 next-20260731]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Guangshuo-Li/media-mtk-jpeg-drain-hardware-completion-before-freeing-context/20260803-143440
base:   https://git.linuxtv.org/media-ci/media-pending.git master
patch link:    https://lore.kernel.org/r/20260708120833.755998-1-lgs201920130244%40gmail.com
patch subject: [PATCH] media: mtk-jpeg: drain hardware completion before freeing context
config: alpha-allmodconfig (https://download.01.org/0day-ci/archive/20260803/202608031631.Ha5cORQG-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260803/202608031631.Ha5cORQG-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608031631.Ha5cORQG-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c: In function 'mtk_jpeg_release':
>> drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1207:17: error: implicit declaration of function 'mtk_jpeg_release_hw'; did you mean 'mtk_jpeg_release'? [-Wimplicit-function-declaration]
    1207 |                 mtk_jpeg_release_hw(jpeg, ctx);
         |                 ^~~~~~~~~~~~~~~~~~~
         |                 mtk_jpeg_release


vim +1207 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c

  1199	
  1200	static int mtk_jpeg_release(struct file *file)
  1201	{
  1202		struct mtk_jpeg_dev *jpeg = video_drvdata(file);
  1203		struct mtk_jpeg_ctx *ctx = mtk_jpeg_file_to_ctx(file);
  1204	
  1205		if (jpeg->variant->jpeg_worker) {
  1206			cancel_work_sync(&ctx->jpeg_work);
> 1207			mtk_jpeg_release_hw(jpeg, ctx);
  1208		}
  1209	
  1210		mutex_lock(&jpeg->lock);
  1211		v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
  1212		v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
  1213		v4l2_fh_del(&ctx->fh, file);
  1214		v4l2_fh_exit(&ctx->fh);
  1215		kfree(ctx);
  1216		mutex_unlock(&jpeg->lock);
  1217		return 0;
  1218	}
  1219	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] media: mtk-jpeg: drain hardware completion before freeing context

[kernel test robot]

Hi Guangshuo,

kernel test robot noticed the following build errors:

[auto build test ERROR on linuxtv-media-pending/master]
[also build test ERROR on media-tree/master linus/master v7.2-rc6 next-20260731]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Guangshuo-Li/media-mtk-jpeg-drain-hardware-completion-before-freeing-context/20260803-143440
base:   https://git.linuxtv.org/media-ci/media-pending.git master
patch link:    https://lore.kernel.org/r/20260708120833.755998-1-lgs201920130244%40gmail.com
patch subject: [PATCH] media: mtk-jpeg: drain hardware completion before freeing context
config: arm-randconfig-004-20260803 (https://download.01.org/0day-ci/archive/20260803/202608032056.zBdPisX5-lkp@intel.com/config)
compiler: clang version 21.1.8 (https://github.com/llvm/llvm-project 2078da43e25a4623cab2d0d60decddf709aaea28)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260803/202608032056.zBdPisX5-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608032056.zBdPisX5-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1207:3: error: call to undeclared function 'mtk_jpeg_release_hw'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
    1207 |                 mtk_jpeg_release_hw(jpeg, ctx);
         |                 ^
   drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1207:3: note: did you mean 'mtk_jpeg_release'?
   drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1200:12: note: 'mtk_jpeg_release' declared here
    1200 | static int mtk_jpeg_release(struct file *file)
         |            ^
    1201 | {
    1202 |         struct mtk_jpeg_dev *jpeg = video_drvdata(file);
    1203 |         struct mtk_jpeg_ctx *ctx = mtk_jpeg_file_to_ctx(file);
    1204 | 
    1205 |         if (jpeg->variant->jpeg_worker) {
    1206 |                 cancel_work_sync(&ctx->jpeg_work);
    1207 |                 mtk_jpeg_release_hw(jpeg, ctx);
         |                 ~~~~~~~~~~~~~~~~~~~
         |                 mtk_jpeg_release
   1 error generated.


vim +/mtk_jpeg_release_hw +1207 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c

  1199	
  1200	static int mtk_jpeg_release(struct file *file)
  1201	{
  1202		struct mtk_jpeg_dev *jpeg = video_drvdata(file);
  1203		struct mtk_jpeg_ctx *ctx = mtk_jpeg_file_to_ctx(file);
  1204	
  1205		if (jpeg->variant->jpeg_worker) {
  1206			cancel_work_sync(&ctx->jpeg_work);
> 1207			mtk_jpeg_release_hw(jpeg, ctx);
  1208		}
  1209	
  1210		mutex_lock(&jpeg->lock);
  1211		v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
  1212		v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
  1213		v4l2_fh_del(&ctx->fh, file);
  1214		v4l2_fh_exit(&ctx->fh);
  1215		kfree(ctx);
  1216		mutex_unlock(&jpeg->lock);
  1217		return 0;
  1218	}
  1219	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki