Re: [syzbot] [media?] KASAN: use-after-free Read in media_request_release

[Hillf Danton]

> Date: Tue, 18 Aug 2026 01:54:33 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    0f23d56f17fd Merge tag 'linux_kselftest-next-7.3-rc1' of g..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14185a25580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=65bfb7732ae5a736
> dashboard link: https://syzkaller.appspot.com/bug?extid=3910ee87c4ba0a51e3f9
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12185a25580000

#syz test

--- x/drivers/media/mc/mc-device.c
+++ y/drivers/media/mc/mc-device.c
@@ -728,6 +728,8 @@ void media_device_cleanup(struct media_d
 	media_graph_walk_cleanup(&mdev->pm_count_walk);
 	mutex_destroy(&mdev->graph_mutex);
 	mutex_destroy(&mdev->req_queue_mutex);
+	while (atomic_read(&mdev->num_requests))
+		schedule_timeout_idle(HZ/20);
 }
 EXPORT_SYMBOL_GPL(media_device_cleanup);
 
--