Yuchan Nam d8549a453d media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex ...

commit bef4f4a88b upstream.

MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)
queue teardown paths. This can race request object cleanup against vb2
queue cancellation and lead to use-after-free reports.

We already serialize request queueing against STREAMON/OFF with
req_queue_mutex. Extend that serialization to REQBUFS, and also take
the same mutex in media_request_ioctl_reinit() so REINIT is in the
same exclusion domain.

This keeps request cleanup and queue cancellation from running in
parallel for request-capable devices.

Fixes: 6093d3002e ("media: vb2: keep a reference to the request until dqbuf")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchan Nam <entropy1110@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-04-02 13:09:43 +02:00

..

Kconfig

…

Makefile

…

mc-dev-allocator.c

…

mc-device.c

…

mc-devnode.c

…

mc-entity.c

…

mc-request.c

media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex

2026-04-02 13:09:43 +02:00