Four independent fixes found while auditing the vicodec codec paths.
Each is reachable from unprivileged userspace and was reproduced under
KASAN in QEMU.

  1  v4l2-mem2mem: VIDIOC_REMOVE_BUFS is not serialized against job
     execution and can free a buffer an in-flight decode is still
     reading -- use-after-free of a stateless decoder's reference frame.

  2  vicodec: vic_round_dim() rounds only the chroma plane, so a
     dimension one past a multiple of 16 yields a coded size one 8x8
     block short of what the codec walks.

  3  vicodec: S_FMT never clamps the visible dimensions, so shrinking the
     CAPTURE format leaves visible > coded and the decoder runs off the
     end of the capture buffer.

  4  vicodec: the encoder's CAPTURE width and height are settable
     independently of the OUTPUT format, letting the encoder write into a
     buffer far too small for the frame it produces.

Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
Junrui Luo (4):
      media: v4l2-mem2mem: serialize REMOVE_BUFS with job execution
      media: vicodec: fix out-of-bounds write on under-rounded coded dimensions
      media: vicodec: clamp visible dimensions on S_FMT to coded bounds
      media: vicodec: make encoder CAPTURE dimensions read-only

 drivers/media/test-drivers/vicodec/codec-fwht.h   |  2 +-
 drivers/media/test-drivers/vicodec/vicodec-core.c | 15 ++++++
 drivers/media/v4l2-core/v4l2-mem2mem.c            | 60 +++++++++++++++++++++--
 3 files changed, 72 insertions(+), 5 deletions(-)
---
base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a
change-id: 20260815-vicodec-fixes-600a11533341

Best regards,
-- 
Junrui Luo <moonafterrain@outlook.com>