Re: [PATCH] staging: most: video: fix potential race in list iteration

[Dan Carpenter]

On Tue, Feb 03, 2026 at 08:28:00PM +0900, Minu Jin wrote:
> There is a pattern in the loops where the lock is dropped
> to call a specific function and then re-acquired.
> 
> The list can be exposed during this short gap, creating a potential
> race condition. This patch fixes the problem by moving nodes to a
> local list while holding the lock, instead of using the
> unlock/lock pattern in the loop.
> 
> Signed-off-by: Minu Jin <s9430939@xxxxxxxxx>
> ---
>  drivers/staging/most/video/video.c | 22 ++++++++++++++--------
>  1 file changed, 14 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/video/video.c
> index 32f71d9a9cf7..e7db58e5746a 100644
> --- a/drivers/staging/most/video/video.c
> +++ b/drivers/staging/most/video/video.c
> @@ -121,6 +121,7 @@ static int comp_vdev_close(struct file *filp)
>  	struct comp_fh *fh = to_comp_fh(filp);
>  	struct most_video_dev *mdev = fh->mdev;
>  	struct mbo *mbo, *tmp;
> +	LIST_HEAD(free_list);
>  
>  	/*
>  	 * We need to put MBOs back before we call most_stop_channel()
> @@ -134,12 +135,15 @@ static int comp_vdev_close(struct file *filp)
>  	spin_lock_irq(&mdev->list_lock);
>  	mdev->mute = true;
>  	list_for_each_entry_safe(mbo, tmp, &mdev->pending_mbos, list) {
> -		list_del(&mbo->list);
> -		spin_unlock_irq(&mdev->list_lock);
> -		most_put_mbo(mbo);
> -		spin_lock_irq(&mdev->list_lock);
> +		list_move(&mbo->list, &free_list);
>  	}

This loop moves ever single item in the list one by one.  You could
do it in one step instead by copying the list_head and setting
pending_mbos to point to itself.

Same in other loop.

regards,
dan carpenter