From 7c7f31405b76acd95a628c834ee8a2d6da439782 Mon Sep 17 00:00:00 2001 From: Kazuki Hanai Date: Wed, 2 Sep 2026 20:22:28 +0900 Subject: [PATCH] media: mediatek: jpeg: Avoid context access after job finish v4l2_m2m_job_finish() publishes job completion and wakes waiters before it returns. A concurrent file release can therefore finish v4l2_m2m_ctx_release() and free the context while the single-core IRQ handler continues with its tail. Both handlers only need the device for the matching runtime PM put. Use the IRQ-owned jpeg pointer instead of dereferencing ctx after completion has been published. This preserves the get/put pairing and removes the post-completion context access. Fixes: 45f13a57d813 ("media: platform: Add jpeg enc feature") Fixes: 5827e4b14ee7 ("media: platform: Improve power on and power off flow") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5 Signed-off-by: Kazuki Hanai Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil --- drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c index 515c21605874..640ae30736f9 100644 --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c @@ -1574,7 +1574,7 @@ static irqreturn_t mtk_jpeg_enc_done(struct mtk_jpeg_dev *jpeg) v4l2_m2m_buf_done(src_buf, buf_state); v4l2_m2m_buf_done(dst_buf, buf_state); v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx); - pm_runtime_put(ctx->jpeg->dev); + pm_runtime_put(jpeg->dev); return IRQ_HANDLED; } @@ -1856,7 +1856,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) v4l2_m2m_buf_done(src_buf, buf_state); v4l2_m2m_buf_done(dst_buf, buf_state); v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx); - pm_runtime_put(ctx->jpeg->dev); + pm_runtime_put(jpeg->dev); return IRQ_HANDLED; }