linux-kernel - [bug report] media: iris: gen1: Destroy internal buffers after FW releases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYXvKAX3Pg3sL37P@stanley.mountain>
Date: Fri, 6 Feb 2026 16:39:52 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Dikshita Agarwal <dikshita.agarwal@....qualcomm.com>
Cc: Abhinav Kumar <abhinav.kumar@...ux.dev>, linux-media@...r.kernel.org,
	linux-arm-msm@...r.kernel.org,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: [bug report] media: iris: gen1: Destroy internal buffers after FW
 releases

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Dikshita Agarwal,

Commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers
after FW releases") from Dec 29, 2025 (linux-next), leads to the
following Smatch static checker warning:

	drivers/media/platform/qcom/iris/iris_buffer.c:588 iris_release_internal_buffers()
	error: dereferencing freed memory 'buffer' (line 585)

drivers/media/platform/qcom/iris/iris_buffer.c
    572 static int iris_release_internal_buffers(struct iris_inst *inst,
    573                                          enum iris_buffer_type buffer_type)
    574 {
    575         const struct iris_hfi_command_ops *hfi_ops = inst->core->hfi_ops;
    576         struct iris_buffers *buffers = &inst->buffers[buffer_type];
    577         struct iris_buffer *buffer, *next;
    578         int ret;
    579 
    580         list_for_each_entry_safe(buffer, next, &buffers->list, list) {
    581                 if (buffer->attr & BUF_ATTR_PENDING_RELEASE)
    582                         continue;
    583                 if (!(buffer->attr & BUF_ATTR_QUEUED))
    584                         continue;
    585                 ret = hfi_ops->session_release_buf(inst, buffer);

The commit adds a free of buffer to ->session_release_buf().

    586                 if (ret)
    587                         return ret;
--> 588                 buffer->attr |= BUF_ATTR_PENDING_RELEASE;
                        ^^^^^^^^^^^^
Use after free.

    589         }
    590 
    591         return 0;
    592 }

regards,
dan carpenter