Re: [PATCH 1/3] media: nxp: imx-jpeg: cancel task_timer before freeing ctx
flat view
From: Ming Qian(OSS) <hidden>
Date: 2026-08-25 01:56:24
Also in:
imx, linux-media, stable
On Tue, Aug 25, 2026 at 03:34:30AM +0800, Shengzhuo Wei wrote:
[You don't often get email from me@cherr.cc. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
Hi Shengzhuo,
Thanks for the patch.
This use-after-free has already been fixed by Fan Wu:
https://lore.kernel.org/lkml/20260623103031.3051-1-fanwu01@zju.edu.cn/ (local)
[PATCH] media: imx-jpeg: cancel timeout worker when streaming stops
Regards,
Ming
quoted hunk ↗ jump to hunk
mxc_jpeg_device_run() arms ctx->task_timer for each job; the only place it is cancelled is the job-completion IRQ handler. If the hardware never completes the job, mxc_jpeg_release() frees ctx with the timer still pending, and mxc_jpeg_device_run_timeout() then dereferences the freed ctx -- a use-after-free. Cancel the timer before the ctx is torn down, before taking mxc_jpeg->lock so the cancel never waits on a worker that needs the mutex. Fixes: cfed9632ca8e ("media: imx-jpeg: Add a timeout mechanism for each frame") Cc: stable@vger.kernel.org Signed-off-by: Shengzhuo Wei <redacted> Assisted-by: GLM:5.3 --- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 ++ 1 file changed, 2 insertions(+)diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c index 725e941528848e8f224fe6a96ba7f746fc45ed63..fbb64a1ecb5189d2d7b953b99dcd7bcb54e6e20e 100644 --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c@@ -2796,6 +2796,8 @@ static int mxc_jpeg_release(struct file *file) struct mxc_jpeg_ctx *ctx = mxc_jpeg_file_to_ctx(file); struct device *dev = mxc_jpeg->dev; + cancel_delayed_work_sync(&ctx->task_timer); + mutex_lock(&mxc_jpeg->lock); if (mxc_jpeg->mode == MXC_JPEG_DECODE) dev_dbg(dev, "Release JPEG decoder instance on slot %d.", --2.47.3