mirror of
https://github.com/torvalds/linux.git
synced 2026-05-22 14:12:07 +02:00
8cd35ceadc
Fix kernel panic caused by race condition where v4l2_m2m_ctx_release()
frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run
with the same context.
Race sequence:
v4l2_m2m_try_run(): v4l2_m2m_ctx_release():
lock/unlock v4l2_m2m_cancel_job()
job_abort()
v4l2_m2m_job_finish()
kfree(m2m_ctx) <- frees ctx
device_run() <- use-after-free crash at 0x538
Crash trace:
Unable to handle kernel read from unreadable memory at virtual address
0000000000000538
v4l2_m2m_try_run+0x78/0x138
v4l2_m2m_device_run_work+0x14/0x20
The amphion vpu driver does not rely on the m2m framework's device_run
callback to perform encode/decode operations.
Fix the race by preventing m2m framework job scheduling entirely:
- Add job_ready callback returning 0 (no jobs ready for m2m framework)
- Remove job_abort callback to avoid the race condition
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| vdec.c | ||
| venc.c | ||
| vpu_cmds.c | ||
| vpu_cmds.h | ||
| vpu_codec.h | ||
| vpu_color.c | ||
| vpu_core.c | ||
| vpu_core.h | ||
| vpu_dbg.c | ||
| vpu_defs.h | ||
| vpu_drv.c | ||
| vpu_helpers.c | ||
| vpu_helpers.h | ||
| vpu_imx8q.c | ||
| vpu_imx8q.h | ||
| vpu_malone.c | ||
| vpu_malone.h | ||
| vpu_mbox.c | ||
| vpu_mbox.h | ||
| vpu_msgs.c | ||
| vpu_msgs.h | ||
| vpu_rpc.c | ||
| vpu_rpc.h | ||
| vpu_v4l2.c | ||
| vpu_v4l2.h | ||
| vpu_windsor.c | ||
| vpu_windsor.h | ||
| vpu.h | ||