Re: [PATCH v2] media: iris: fix use-after-free of fmt_src during MBPF check

[Vikash Garodia]

On 3/4/2026 2:28 PM, Vishnu Reddy wrote:
> During concurrency testing, multiple instances can run in parallel, and
> each instance uses its own inst->lock while the global core->lock

drop global

> protects the list of active instances. The race happens because these
> locks cover different scopes, inst->lock protects only the internals of
> a single instance, while the MBPF checker walks the core list under

MBPF ?

> core->lock and reads fields like fmt_src->width and fmt_src->height.
> At the same time, iris_close() may free fmt_src and fmt_dst under
> inst->lock while the instance is still present in the core list. This
> allows a situation where the MBPF checker, still iterating through the
> core list, reaches an instance whose fmt_src was already freed by another
> thread and ends up dereferencing a dangling pointer, resulting in a
> use-after-free. This happens because the MBPF checker assumes that any
> instance in the core list is fully valid, but the freeing of fmt_src and
> fmt_dst without removing the instance from the core list is not correct.
>
> The correct ordering is to defer freeing fmt_src and fmt_dst until after
> the instance has been removed from the core list and all teardown under
> the core lock has completed, ensuring that no dangling pointers are ever
> exposed during MBPF checks.
>
> Fixes: 5ad964ad5656 ("media: iris: Initialize and deinitialize encoder instance structure")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Vishnu Reddy <busanna.reddy@xxxxxxxxxxxxxxxx>
> ---

Once updated,

Reviewed-by: Vikash Garodia <vikash.garodia@xxxxxxxxxxxxxxxx>