Re: [PATCH] media: iris: Fix use-after-free in iris_release_internal_buffers()

[Vikash Garodia]

On 2/16/2026 12:37 PM, Dikshita Agarwal wrote:
> The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy
> internal buffers after FW releases") introduced a regression where
> session_release_buf() may free the buffer. The caller,
> iris_release_internal_buffers(), continued to access `buffer` after the
> call, leading to a potential use-after-free.
>
> Fix this by setting BUF_ATTR_PENDING_RELEASE before calling
> session_release_buf(), and reverting the flag if the call fails. This
> ensures no dereference occurs after potential freeing.
>
> Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r
> Signed-off-by: Dikshita Agarwal <dikshita.agarwal@xxxxxxxxxxxxxxxx>
> ---

Reviewed-by: Vikash Garodia <vikash.garodia@xxxxxxxxxxxxxxxx>