Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

media: amphion: Fix race between m2m job_abort and device_run

Fix kernel panic caused by race condition where v4l2_m2m_ctx_release()
frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run
with the same context.

Race sequence:
v4l2_m2m_try_run(): v4l2_m2m_ctx_release():
lock/unlock v4l2_m2m_cancel_job()
job_abort()
v4l2_m2m_job_finish()
kfree(m2m_ctx) <- frees ctx
device_run() <- use-after-free crash at 0x538

Crash trace:
Unable to handle kernel read from unreadable memory at virtual address
0000000000000538
v4l2_m2m_try_run+0x78/0x138
v4l2_m2m_device_run_work+0x14/0x20

The amphion vpu driver does not rely on the m2m framework's device_run
callback to perform encode/decode operations.

Fix the race by preventing m2m framework job scheduling entirely:
- Add job_ready callback returning 0 (no jobs ready for m2m framework)
- Remove job_abort callback to avoid the race condition

Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
Cc: stable@vger.kernel.org
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

authored by

Ming Qian and committed by
Hans Verkuil
8cd35cea 35c8178e

+3 -6
+3 -6
drivers/media/platform/amphion/vpu_v4l2.c
··· 447 447 { 448 448 } 449 449 450 - static void vpu_m2m_job_abort(void *priv) 450 + static int vpu_m2m_job_ready(void *priv) 451 451 { 452 - struct vpu_inst *inst = priv; 453 - struct v4l2_m2m_ctx *m2m_ctx = inst->fh.m2m_ctx; 454 - 455 - v4l2_m2m_job_finish(m2m_ctx->m2m_dev, m2m_ctx); 452 + return 0; 456 453 } 457 454 458 455 static const struct v4l2_m2m_ops vpu_m2m_ops = { 459 456 .device_run = vpu_m2m_device_run, 460 - .job_abort = vpu_m2m_job_abort 457 + .job_ready = vpu_m2m_job_ready, 461 458 }; 462 459 463 460 static int vpu_vb2_queue_setup(struct vb2_queue *vq,