mxc_jpeg_device_run_timeout() signals job completion through
v4l2_m2m_job_finish(). This clears TRANS_RUNNING and allows a concurrent
v4l2_m2m_ctx_release() to continue. The timeout handler then accesses
ctx->mxc_jpeg once more while releasing hw_lock, but the release path may
already have freed ctx, resulting in a use-after-free.

Synchronously cancel the timeout work after v4l2_m2m_ctx_release() and
before freeing ctx. The cancellation must remain after the mem2mem release
because the timeout is the only completion path for a hung hardware job.

Fixes: cfed9632ca8e ("media: imx-jpeg: Add a timeout mechanism for each frame")
Cc: stable@vger.kernel.org
Signed-off-by: Kazuki Hanai <hnkz.64@gmail.com>
---
 drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
index 725e94152884..dfe3b1ea6bb4 100644
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -2805,6 +2805,7 @@ static int mxc_jpeg_release(struct file *file)
 			ctx->slot);
 	v4l2_ctrl_handler_free(&ctx->ctrl_handler);
 	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+	cancel_delayed_work_sync(&ctx->task_timer);
 	v4l2_fh_del(&ctx->fh, file);
 	v4l2_fh_exit(&ctx->fh);
 	kfree(ctx);
-- 
2.53.0

On Fri, Aug 28, 2026 at 02:14:52PM +0900, Kazuki Hanai wrote:
> [You don't often get email from hnkz.64@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> mxc_jpeg_device_run_timeout() signals job completion through
> v4l2_m2m_job_finish(). This clears TRANS_RUNNING and allows a concurrent
> v4l2_m2m_ctx_release() to continue. The timeout handler then accesses
> ctx->mxc_jpeg once more while releasing hw_lock, but the release path may
> already have freed ctx, resulting in a use-after-free.
>
> Synchronously cancel the timeout work after v4l2_m2m_ctx_release() and
> before freeing ctx. The cancellation must remain after the mem2mem release
> because the timeout is the only completion path for a hung hardware job.
>
> Fixes: cfed9632ca8e ("media: imx-jpeg: Add a timeout mechanism for each frame")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kazuki Hanai <hnkz.64@gmail.com>
> ---

Suppose it already fixed

https://lore.kernel.org/lkml/20260623103031.3051-1-fanwu01@zju.edu.cn/

Frank

>  drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> index 725e94152884..dfe3b1ea6bb4 100644
> --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> @@ -2805,6 +2805,7 @@ static int mxc_jpeg_release(struct file *file)
>                         ctx->slot);
>         v4l2_ctrl_handler_free(&ctx->ctrl_handler);
>         v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
> +       cancel_delayed_work_sync(&ctx->task_timer);
>         v4l2_fh_del(&ctx->fh, file);
>         v4l2_fh_exit(&ctx->fh);
>         kfree(ctx);
> --
> 2.53.0
>
>