Commit f27cfdcf authored by Dikshita Agarwal's avatar Dikshita Agarwal Committed by Hans Verkuil
Browse files

media: iris: Fix use-after-free in iris_release_internal_buffers() 



The recent change in commit 1dabf00e ("media: iris: gen1: Destroy
internal buffers after FW releases") introduced a regression where
session_release_buf() may free the buffer. The caller,
iris_release_internal_buffers(), continued to access `buffer` after the
call, leading to a potential use-after-free.

Fix this by setting BUF_ATTR_PENDING_RELEASE before calling
session_release_buf(), and reverting the flag if the call fails. This
ensures no dereference occurs after potential freeing.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r


Signed-off-by: default avatarDikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: default avatarVikash Garodia <vikash.garodia@oss.qualcomm.com>
Fixes: 1dabf00e ("media: iris: gen1: Destroy internal buffers after FW releases")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarBryan O'Donoghue <bod@kernel.org>
Signed-off-by: default avatarHans Verkuil <hverkuil+cisco@kernel.org>
parent a297c516

drivers/media/platform/qcom/iris/iris_buffer.c

+4 −2
Original line number Diff line number Diff line
@@ -582,10 +582,12 @@ static int iris_release_internal_buffers(struct iris_inst *inst, 
			continue;

		if (!(buffer->attr & BUF_ATTR_QUEUED))

			continue;

		buffer->attr |= BUF_ATTR_PENDING_RELEASE;

		ret = hfi_ops->session_release_buf(inst, buffer);

		if (ret)

		if (ret) {

			buffer->attr &= ~BUF_ATTR_PENDING_RELEASE;

			return ret;

		buffer->attr |= BUF_ATTR_PENDING_RELEASE;

		}

	}



	return 0;