Changes in iris_vdec.h

2519003dd5fb6f89f10f031e3a97ecb7c9d1b816 - Merge tag 'asoc-fix-v7.1-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Fri, 22 May 2026 08:25:18 +0200

Merge tag 'asoc-fix-v7.1-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v7.1A bigger batch of fixes than usual due to -next not happeing last week,this is mostly stuff for laptops - a lot of quirks and small fixes,mainly for x86 and SoundWire. Nothing too big or exciting individually,just two week's worth. List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

4e386547138864d4ded1c39ff75517b89e187964 - Merge tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Tue, 05 May 2026 17:45:41 +0200

Merge tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-mediaPull media fixes from Mauro Carvalho Chehab: - rc: ttusbir: fix inverted error logic - Venus/Iris fixes: - Kconfig cross compile build testing for x86 - Use-after-free fix for internal buffers - dma_free_attrs size fix - Switch to hardware mode clocks - Use-after-free fix for a concurrency path - Fix H265D_MAX_SLICE size for sc7280 devices - camoss: fix some clock-related issues* tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: qcom: camss: avoid format string warning media: qcom: camss: Add missing clocks for VFE lite on sa8775p media: qcom: camss: Fix csid clock configuration for sa8775p media: qcom: camss: Fix csid IRQ offset for sa8775p media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 media: iris: fix use-after-free of fmt_src during MBPF check media: iris: switch to hardware mode after firmware boot media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() media: iris: Fix use-after-free in iris_release_internal_buffers() media: iris: fix QCOM_MDT_LOADER dependency media: venus: fix QCOM_MDT_LOADER dependency List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 - media: iris: fix use-after-free of fmt_src during MBPF check

Thu, 05 Mar 2026 14:28:31 +0100

media: iris: fix use-after-free of fmt_src during MBPF checkDuring concurrency testing, multiple instances can run in parallel, andeach instance uses its own inst->lock while the core->lock protects thelist of active instances. The race happens because these locks coverdifferent scopes, inst->lock protects only the internals of a singleinstance, while the Macro Blocks Per Frame (MBPF) checker walks thecore list under core->lock and reads fields like fmt_src->width andfmt_src->height. At the same time, iris_close() may free fmt_src andfmt_dst under inst->lock while the instance is still present in the corelist. This allows a situation where the MBPF checker, still iteratingthrough the core list, reaches an instance whose fmt_src was alreadyfreed by another thread and ends up dereferencing a dangling pointer,resulting in a use-after-free. This happens because the MBPF checkerassumes that any instance in the core list is fully valid, but thefreeing of fmt_src and fmt_dst without removing the instance from thecore list is not correct.The correct ordering is to defer freeing fmt_src and fmt_dst until afterthe instance has been removed from the core list and all teardown underthe core lock has completed, ensuring that no dangling pointers are everexposed during MBPF checks.Reviewed-by: Vikash Garodia Signed-off-by: Vishnu Reddy Reviewed-by: Dikshita Agarwal Fixes: 5ad964ad5656 ("media: iris: Initialize and deinitialize encoder instance structure")Cc: stable@vger.kernel.orgSigned-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

a4a508df2aa34f8650afde54ea804321c618f45f - Merge tag 'v6.18' into next

Sat, 13 Dec 2025 10:18:20 +0100

Merge tag 'v6.18' into nextSync up with the mainline to bring in the latest APIs. List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

cb9f145f638d7afa633632a9290d6ad06caeb8ee - Merge remote-tracking branch 'drm/drm-next' into msm-next-robclark

Sat, 01 Nov 2025 13:47:30 +0100

Merge remote-tracking branch 'drm/drm-next' into msm-next-robclarkBack-merge drm-next to get caught up.Signed-off-by: Rob Clark List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

82ee50252dc891e3f3b32d923bb4f656d300b772 - Merge drm/drm-next into drm-xe-next

Tue, 14 Oct 2025 11:31:49 +0200

Merge drm/drm-next into drm-xe-nextBackmerging to bring in 6.18-rc1.Signed-off-by: Thomas Hellström List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

2acee98fcc61052d63fab4539fcb6ee677555645 - Merge drm/drm-next into drm-intel-next

Tue, 14 Oct 2025 09:37:11 +0200

Merge drm/drm-next into drm-intel-nextSync to v6.18-rc1.Signed-off-by: Jani Nikula List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

9b966ae42235a88eaea714be09ff3d698535bdfe - Merge drm/drm-next into drm-misc-next

Mon, 13 Oct 2025 09:19:19 +0200

Merge drm/drm-next into drm-misc-nextUpdating drm-misc-next to the state of v6.18-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

f088104d837a991c65e51fa30bb4196169b3244d - Merge drm/drm-next into drm-intel-gt-next

Tue, 16 Sep 2025 12:53:20 +0200

Merge drm/drm-next into drm-intel-gt-nextBackmerge in order to get the commit: 048832a3f400 ("drm/i915: Refactor shmem_pwrite() to use kiocb and write_iter")To drm-intel-gt-next as there are followup fixes to be applied.Signed-off-by: Joonas Lahtinen List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

2ace52718376fdb56aca863da2eebe70d7e2ddb1 - Merge branch 'objtool/core'

Fri, 21 Nov 2025 11:21:20 +0100

Merge branch 'objtool/core'Bring in the UDB and objtool data annotations to avoid conflicts while further extending the bug exceptions.Signed-off-by: Peter Zijlstra List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

a53d0cf7f1cb3182ad533ff5cacfa5fd29c419ad - Merge commit 'linus' into core/bugs, to resolve conflicts

Tue, 05 Aug 2025 11:15:34 +0200

Merge commit 'linus' into core/bugs, to resolve conflictsResolve conflicts with this commit that was developed in parallelduring the merge window: 8c8efa93db68 ("x86/bug: Add ARCH_WARN_ASM macro for BUG/WARN asm code sharing with Rust") Conflicts: arch/riscv/include/asm/bug.h arch/x86/include/asm/bug.hSigned-off-by: Ingo Molnar List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

f39b6c468c52745dbca9a842d91c8373fda208ab - Merge tag 'v6.18-rc6' into for-linus

Tue, 18 Nov 2025 08:16:55 +0100

Merge tag 'v6.18-rc6' into for-linusSync up with the mainline to bring in definition ofINPUT_PROP_HAPTIC_TOUCHPAD. List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

4f38da1f027ea2c9f01bb71daa7a299c191b6940 - spi: Merge up v6.18-rc1

Mon, 13 Oct 2025 14:32:13 +0200

spi: Merge up v6.18-rc1Ensure my CI has a sensible baseline. List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

ec2e0fb07d789976c601bec19ecced7a501c3705 - Merge tag 'asoc-fix-v6.18-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Thu, 16 Oct 2025 20:14:24 +0200

Merge tag 'asoc-fix-v6.18-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v6.18A moderately large collection of driver specific fixes, plus a few newquirks and device IDs. The NAU8821 changes are a little large but morein mechanical ways than in ways that are complex. List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

48a710760e10a4f36e11233a21860796ba204b1e - Merge drm/drm-fixes into drm-misc-fixes

Tue, 14 Oct 2025 10:59:58 +0200

Merge drm/drm-fixes into drm-misc-fixesUpdating drm-misc-fixes to the state of v6.18-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

8b87f67b4c87452e21721887fa8dec1f4c6b2b7c - Merge branch 'next' into for-linus

Wed, 08 Oct 2025 06:53:13 +0200

Merge branch 'next' into for-linusPrepare input updates for 6.18 merge window. List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

4b051897df2375414587a245ecb9bb1a4d26b3b8 - Merge tag 'v6.17-rc2' into HEAD

Thu, 21 Aug 2025 20:46:49 +0200

Merge tag 'v6.17-rc2' into HEADSync up with mainline to bring in changes to include/linux/sprintf.h List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

f79e772258df311c2cb21594ca0996318e720d28 - Merge tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Thu, 02 Oct 2025 22:13:26 +0200

Merge tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-mediaPull media updates from Mauro Carvalho Chehab: - Added a new V4L2 clock helper - New camera sensor drivers - iris: Enable H.264/H.265 encoder support and fixes in iris driver common code - camss: add support for new SoC flavors - venus: add new SoC support - tc358743: support more infoframe types - Various fixes, driver improvements and cleanups* tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (439 commits) media: venus: pm_helpers: add fallback for the opp-table media: qcom: camss: vfe: Fix BPL alignment for QCM2290 media: tuner: xc5000: Fix use-after-free in xc5000_release media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove media: vsp1: Export missing vsp1_isp_free_buffer symbol media: renesas: vsp1: Convert to SYSTEM_SLEEP/RUNTIME_PM_OPS() media: renesas: ceu: Convert to RUNTIME_PM_OPS() media: renesas: fdp1: Convert to RUNTIME_PM_OPS() media: renesas: rcar-vin: Convert to DEFINE_SIMPLE_DEV_PM_OPS() media: renesas: rcar_drif: Convert to DEFINE_SIMPLE_DEV_PM_OPS() media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID media: uvcvideo: Support UVC_CROSXU_CONTROL_IQ_PROFILE media: uvcvideo: Run uvc_ctrl_init_ctrl for all controls media: uvcvideo: Shorten the transfer size non compliance message media: uvcvideo: Do not re-reference dev->udev media: uvcvideo: Use intf instead of udev for printks media: uvcvideo: Move video_device under video_queue media: uvcvideo: Drop stream->mutex media: uvcvideo: Move MSXU_CONTROL_METADATA definition to header ... List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

b4d90dbc4c1bc4bd3eb2d2989330af0eb95c98e8 - Merge drm/drm-next into drm-misc-next-fixes

Mon, 15 Sep 2025 10:23:28 +0200

Merge drm/drm-next into drm-misc-next-fixesBackmerging to drm-misc-next-fixes to get features and fixes fromv6.17-rc6.Signed-off-by: Thomas Zimmermann List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h

702fdf3513b045f596f836d9a4b8672c76f11834 - Merge drm/drm-next into drm-intel-next

Wed, 10 Sep 2025 14:01:42 +0200

Merge drm/drm-next into drm-intel-nextCatching up with some display dependencies.Signed-off-by: Rodrigo Vivi List of files: /linux/drivers/media/platform/qcom/iris/iris_vdec.h