From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0C3B30568A; Fri, 15 May 2026 15:57:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778860660; cv=none; b=ZyeMqkuKHq6ha0PwlPZxfjH/x3ouzrMDbELIzphELR+AL/H6M72VO42Qaa2zwc46DuAUr2Lsn2h7N2zUYy2S1y0ClH2X+qh+9G699MRzhtwa+fX1gZ28WO8IIqvMDpDCLe+tzPEnRMVrKZluqAMIbFYrnOqkkNN2QkXyrsEE5iM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778860660; c=relaxed/simple; bh=cLIR4T3wgZFTjW+meyucKG6okf1q6KQBUZ9gs91u9ys=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Xz4FSYj1jM2gGd3biJ4lp2BD5Csx32sLnMJdlRYWjt6n13I1LYUNhzhQjzstZXglzn11jzWik/HSobd71hEqkEc9E3qKtXHy7XNVw02wWCUgzUkcrGtLkbvMKXjSdeN82ZvprG0fRtshOMYCNFcDeLDjbqQiJYLct5MtP5khIs0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KgWuGX48; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="KgWuGX48" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F7DDC2BCB0; Fri, 15 May 2026 15:57:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778860660; bh=cLIR4T3wgZFTjW+meyucKG6okf1q6KQBUZ9gs91u9ys=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KgWuGX48H2Dn6/ln6QbzGJ5/uLMrLpJrHNym70tFOIzwfbCW0MCKpqGVoPx9190h7 o13DE6N8qVWaf0pfUqEwyu/EZEzM4SWOm2WX6FFN8psQM5c0qNEsAjyRnobkkiUPOu Mr16wb5BYmgQnWPr+uwFuu51NRdPAlgGJmw82m7Q= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ming Qian , Nicolas Dufresne , Hans Verkuil Subject: [PATCH 6.6 031/474] media: amphion: Fix race between m2m job_abort and device_run Date: Fri, 15 May 2026 17:42:20 +0200 Message-ID: <20260515154715.723392202@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260515154715.053014143@linuxfoundation.org> References: <20260515154715.053014143@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ming Qian commit 8cd35ceadcfc8c5da2eb7f7ce24525ce9d4ee62e upstream. Fix kernel panic caused by race condition where v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run with the same context. Race sequence: v4l2_m2m_try_run(): v4l2_m2m_ctx_release(): lock/unlock v4l2_m2m_cancel_job() job_abort() v4l2_m2m_job_finish() kfree(m2m_ctx) <- frees ctx device_run() <- use-after-free crash at 0x538 Crash trace: Unable to handle kernel read from unreadable memory at virtual address 0000000000000538 v4l2_m2m_try_run+0x78/0x138 v4l2_m2m_device_run_work+0x14/0x20 The amphion vpu driver does not rely on the m2m framework's device_run callback to perform encode/decode operations. Fix the race by preventing m2m framework job scheduling entirely: - Add job_ready callback returning 0 (no jobs ready for m2m framework) - Remove job_abort callback to avoid the race condition Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") Cc: stable@vger.kernel.org Signed-off-by: Ming Qian Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman --- drivers/media/platform/amphion/vpu_v4l2.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) --- a/drivers/media/platform/amphion/vpu_v4l2.c +++ b/drivers/media/platform/amphion/vpu_v4l2.c @@ -441,17 +441,14 @@ static void vpu_m2m_device_run(void *pri { } -static void vpu_m2m_job_abort(void *priv) +static int vpu_m2m_job_ready(void *priv) { - struct vpu_inst *inst = priv; - struct v4l2_m2m_ctx *m2m_ctx = inst->fh.m2m_ctx; - - v4l2_m2m_job_finish(m2m_ctx->m2m_dev, m2m_ctx); + return 0; } static const struct v4l2_m2m_ops vpu_m2m_ops = { .device_run = vpu_m2m_device_run, - .job_abort = vpu_m2m_job_abort + .job_ready = vpu_m2m_job_ready, }; static int vpu_vb2_queue_setup(struct vb2_queue *vq,