Re: [PATCH 5/5] media: iris: reference count video instances

[Konrad Dybcio]

On 7/30/26 5:26 PM, Dmitry Baryshkov wrote:
> iris_get_instance() looks up an instance on core->instances and returns
> it after dropping core->lock, without taking any reference. The threaded
> interrupt handler uses this to find the instance a firmware response
> belongs to and then takes inst->lock. Meanwhile userspace may close the
> same file descriptor: iris_close() removes the instance from the list,
> destroys inst->lock and frees the instance. The interrupt handler then
> operates on freed memory and a destroyed mutex, a use-after-free.
> 
> Add a kref to struct iris_inst. iris_get_instance() takes a reference
> under core->lock, so an instance it returns cannot be freed until the
> caller drops that reference with iris_inst_put(). The instance is
> released (mutexes destroyed, memory freed) only when the last reference
> goes away, whether that is held by the closing thread or the interrupt
> handler.
> 
> Fixes: 38fc8beaba55 ("media: iris: implement reqbuf ioctl with vb2_queue_setup")
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxxxxxxxx>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxxxxxxxx>

I think your agent didn't get the part where it can never sign-off
for you.. or some other funky combination

Konrad