Yuchan Nam bef4f4a88b media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex ... MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports. We already serialize request queueing against STREAMON/OFF with req_queue_mutex. Extend that serialization to REQBUFS, and also take the same mutex in media_request_ioctl_reinit() so REINIT is in the same exclusion domain. This keeps request cleanup and queue cancellation from running in parallel for request-capable devices. Fixes: 6093d3002e ("media: vb2: keep a reference to the request until dqbuf") Cc: stable@vger.kernel.org Signed-off-by: Yuchan Nam <entropy1110@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>		2026-03-18 11:21:31 +01:00
..
Kconfig	media: drop CONFIG_MEDIA_CONTROLLER_REQUEST_API	2023-11-23 13:03:45 +01:00
Makefile	media: Fix Media Controller API config checks	2021-06-24 14:26:00 +02:00
mc-dev-allocator.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
mc-device.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
mc-devnode.c	media: mc: add debugfs node to keep track of requests	2026-01-05 15:56:31 +01:00
mc-entity.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
mc-request.c	media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex	2026-03-18 11:21:31 +01:00