RE: [PATCH 1/2] media: chips-media: wave5: Release m2m_ctx after Instance Removed from List

[jackson . lee]

Hi Brandon


> -----Original Message-----
> From: Brandon Brnich <b-brnich@xxxxxx>
> Sent: Friday, April 3, 2026 3:46 AM
> To: linux-media@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx
> Cc: detheridge@xxxxxx; mchehab@xxxxxxxxxx; Nas Chung
> <nas.chung@xxxxxxxxxxxxxxx>; jackson.lee <jackson.lee@xxxxxxxxxxxxxxx>;
> nicolas.dufresne@xxxxxxxxxxxxx; Brandon Brnich <b-brnich@xxxxxx>
> Subject: [PATCH 1/2] media: chips-media: wave5: Release m2m_ctx after
> Instance Removed from List
> 
> Possible use after free if IRQ thread manages to obtain spinlock between
> m2m_ctx release and wave5_release function removing stream instance from
> list of active instances. The IRQ thread looks for the m2m_ctx which is
> freed so null pointer dereference occurs.
> 
> Signed-off-by: Brandon Brnich <b-brnich@xxxxxx>

Tested-by: Jackson Lee <jackson.lee@xxxxxxxxxxxxxxx>

Thanks
Jackson


> ---
>  drivers/media/platform/chips-media/wave5/wave5-helper.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/chips-media/wave5/wave5-helper.c
> b/drivers/media/platform/chips-media/wave5/wave5-helper.c
> index 53a0ac068c2e..c3d34be833ff 100644
> --- a/drivers/media/platform/chips-media/wave5/wave5-helper.c
> +++ b/drivers/media/platform/chips-media/wave5/wave5-helper.c
> @@ -68,7 +68,6 @@ int wave5_vpu_release_device(struct file *filp,
>  	int ret = 0;
>  	unsigned long flags;
> 
> -	v4l2_m2m_ctx_release(inst->v4l2_fh.m2m_ctx);
>  	/*
>  	 * To prevent Null reference exception, the existing irq handler
> were
>  	 * separated to two modules.
> @@ -89,6 +88,9 @@ int wave5_vpu_release_device(struct file *filp,
>  	list_del_init(&inst->list);
>  	spin_unlock_irqrestore(&inst->dev->irq_spinlock, flags);
>  	mutex_unlock(&inst->dev->irq_lock);
> +
> +	v4l2_m2m_ctx_release(inst->v4l2_fh.m2m_ctx);
> +
>  	if (inst->state != VPU_INST_STATE_NONE) {
>  		u32 fail_res;
> 
> --
> 2.43.0