[PATCH] media: v4l2-mem2mem: cancel job work before freeing m2m_dev

[Yaohan Li]

v4l2_m2m_release() frees the mem2mem device without draining its
embedded job_work. A job completion can queue the work while device
removal runs, leaving the worker to access a freed m2m_dev.

Cancel and wait for job_work before freeing the device. This ensures
that a previously queued or running job worker has completed before
the memory backing it is released.

The use-after-free was reproduced with an in-tree V4L2 test driver
under KASAN during stream teardown and device unbind; the same
injected scheduling sequence completed without the report after the
change.

Fixes: cbd9463da1b12 ("media: v4l2-mem2mem: Avoid calling .device_run in v4l2_m2m_job_finish")
Assisted-by: ZCode:GLM-4
Signed-off-by: Yaohan Li <shunsheng1218@xxxxxxxxx>
---
 drivers/media/v4l2-core/v4l2-mem2mem.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index a65cbb124cfe0..c4756e7bb1fb2 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -1207,6 +1207,12 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_init);
 
 void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
 {
+	/*
+	 * job_work is embedded in m2m_dev and is re-queued unconditionally
+	 * whenever a job finishes; wait for it before freeing the device.
+	 */
+	cancel_work_sync(&m2m_dev->job_work);
+
 	kfree(m2m_dev);
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_release);
-- 
2.34.1