Re: [PATCH v2 2/5] media: iris: take core lock when scanning the instance list

[Konrad Dybcio]

On 7/31/26 2:31 AM, Dmitry Baryshkov wrote:
> iris_check_session_supported() walks core->instances to confirm the
> current instance is registered, but does so without holding core->lock.
> A concurrent iris_close() takes core->lock and removes a (possibly
> different) instance from the list via list_del_init() before freeing it,
> so the lockless traversal can follow a freed pointer and dereference it,
> resulting in a use-after-free.
> 
> Hold core->lock across the list traversal, matching the other iterators
> over core->instances such as iris_check_core_mbpf(). The lock is dropped
> before iris_check_core_mbpf() is called so the nesting is unchanged.
> 
> Fixes: bdbe1cac0c10 ("media: iris: add check whether the video session is supported or not")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxxxxxxxx>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@xxxxxxxxxxxxxxxx>

we also have:

iris_check_core_load()
iris_get_required_freq()
iris_vpu36_get_required_freq()
iris_vpu36_check_core_load()

that traverse the lsit and actually end up being called with
the lock, but only implicitly - perhaps a lockdep hint could
be useful there?

Konrad