kernel/linux.git/drivers/media/platform/qcom/iris/iris_buffer.c, branch linux-7.0.y

media: iris: Fix use-after-free in iris_release_internal_buffers()

2026-05-17T15:16:26+00:00

commit f27cfdcfc916bb59297825805f4c3499f89f9e76 upstream. The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where session_release_buf() may free the buffer. The caller, iris_release_internal_buffers(), continued to access `buffer` after the call, leading to a potential use-after-free. Fix this by setting BUF_ATTR_PENDING_RELEASE before calling session_release_buf(), and reverting the flag if the call fails. This ensures no dereference occurs after potential freeing. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

media: iris: Add buffer to list only after successful allocation

2026-01-20T13:00:12+00:00

Move `list_add_tail()` to after `dma_alloc_attrs()` succeeds when creating internal buffers. Previously, the buffer was enqueued in `buffers->list` before the DMA allocation. If the allocation failed, the function returned `-ENOMEM` while leaving a partially initialized buffer in the list, which could lead to inconsistent state and potential leaks. By adding the buffer to the list only after `dma_alloc_attrs()` succeeds, we ensure the list contains only valid, fully initialized buffers. Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") Reviewed-by: Bryan O'Donoghue Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: iris: Add support for QC08C format for encoder

2025-11-06T10:18:09+00:00

Introduce handling for the QC08C format in the encoder. QC08C format is NV12 with UBWC compression. Update format checks and configuration to enable encoding to QC08C streams. Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: iris: Add support for QC08C format for decoder

2025-11-06T10:18:09+00:00

Introduce handling for the QC08C format in the decoder. QC08C format is NV12 with UBWC compression. Update format checks and configuration to enable decoding of QC08C streams. Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: iris: add VPU33 specific encoding buffer calculation

2025-09-10T07:02:48+00:00

The VPU33 found in the SM8650 Platform requires some slighly different buffer calculation for encoding to allow working with the latest firwware uploaded on linux-firmware at [1]. [1] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=ece445af91bbee49bf0d8b23c2b99b596ae6eac7 Suggested-by: Vikash Garodia Signed-off-by: Neil Armstrong Reviewed-by: Vikash Garodia Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: iris: Allocate and queue internal buffers for encoder video device

2025-09-10T07:02:45+00:00

Add support for allocating and queuing internal buffers required by the encoder. The sizes of these buffers are derived from hardware specifications and are essential to meet the encoder's functional and performance requirements. These buffers are not exposed to userspace; they are allocated and managed internally to ensure correct and efficient hardware operation. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd [bod: added sm8750 enc_op_int_buf_tbl enumeration during merge] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: iris: Set platform capabilities to firmware for encoder video device

2025-09-10T07:02:43+00:00

Initialize and configure platform-specific capabilities for the encoder in the firmware during stream-on, to tailor encoding behavior to the current session's requirements. Some of these capabilities can also be updated dynamically when V4L2 controls are modified by the client after stream-on. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: iris: Initialize and deinitialize encoder instance structure

2025-09-10T07:02:35+00:00

Introduce initialization and deinitialization for internal encoder instance structure with necessary hooks. Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil