Changes in iris_vidc.c

2519003dd5fb6f89f10f031e3a97ecb7c9d1b816 - Merge tag 'asoc-fix-v7.1-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Fri, 22 May 2026 08:25:18 +0200

Merge tag 'asoc-fix-v7.1-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v7.1A bigger batch of fixes than usual due to -next not happeing last week,this is mostly stuff for laptops - a lot of quirks and small fixes,mainly for x86 and SoundWire. Nothing too big or exciting individually,just two week's worth. List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

4e386547138864d4ded1c39ff75517b89e187964 - Merge tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Tue, 05 May 2026 17:45:41 +0200

Merge tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-mediaPull media fixes from Mauro Carvalho Chehab: - rc: ttusbir: fix inverted error logic - Venus/Iris fixes: - Kconfig cross compile build testing for x86 - Use-after-free fix for internal buffers - dma_free_attrs size fix - Switch to hardware mode clocks - Use-after-free fix for a concurrency path - Fix H265D_MAX_SLICE size for sc7280 devices - camoss: fix some clock-related issues* tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: qcom: camss: avoid format string warning media: qcom: camss: Add missing clocks for VFE lite on sa8775p media: qcom: camss: Fix csid clock configuration for sa8775p media: qcom: camss: Fix csid IRQ offset for sa8775p media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 media: iris: fix use-after-free of fmt_src during MBPF check media: iris: switch to hardware mode after firmware boot media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() media: iris: Fix use-after-free in iris_release_internal_buffers() media: iris: fix QCOM_MDT_LOADER dependency media: venus: fix QCOM_MDT_LOADER dependency List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 - media: iris: fix use-after-free of fmt_src during MBPF check

Thu, 05 Mar 2026 14:28:31 +0100

media: iris: fix use-after-free of fmt_src during MBPF checkDuring concurrency testing, multiple instances can run in parallel, andeach instance uses its own inst->lock while the core->lock protects thelist of active instances. The race happens because these locks coverdifferent scopes, inst->lock protects only the internals of a singleinstance, while the Macro Blocks Per Frame (MBPF) checker walks thecore list under core->lock and reads fields like fmt_src->width andfmt_src->height. At the same time, iris_close() may free fmt_src andfmt_dst under inst->lock while the instance is still present in the corelist. This allows a situation where the MBPF checker, still iteratingthrough the core list, reaches an instance whose fmt_src was alreadyfreed by another thread and ends up dereferencing a dangling pointer,resulting in a use-after-free. This happens because the MBPF checkerassumes that any instance in the core list is fully valid, but thefreeing of fmt_src and fmt_dst without removing the instance from thecore list is not correct.The correct ordering is to defer freeing fmt_src and fmt_dst until afterthe instance has been removed from the core list and all teardown underthe core lock has completed, ensuring that no dangling pointers are everexposed during MBPF checks.Reviewed-by: Vikash Garodia Signed-off-by: Vishnu Reddy Reviewed-by: Dikshita Agarwal Fixes: 5ad964ad5656 ("media: iris: Initialize and deinitialize encoder instance structure")Cc: stable@vger.kernel.orgSigned-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

f4b369c6fe0ceaba2da2daff8c9eb415f85926dd - Merge branch 'next' into for-linus

Mon, 20 Apr 2026 03:28:57 +0200

Merge branch 'next' into for-linusPrepare input updates for 7.1 merge window. List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

0421ccdfad0d92713a812a5aeb7d07b0ea7213c8 - Merge tag 'v7.0-rc3' into next

Thu, 12 Mar 2026 18:44:42 +0100

Merge tag 'v7.0-rc3' into nextSync up with the mainline to brig up the latest changes, specificallychanges to ALPS driver. List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

42d3b66d4cdbacfc9d120d2301b8de89cc29a914 - Merge drm/drm-next into drm-xe-next

Thu, 12 Mar 2026 15:17:56 +0100

Merge drm/drm-next into drm-xe-nextBackmerging to bring in 7.00-rc3. Important ahead GPU SVM merging THPsupport.Signed-off-by: Matthew Brost List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

f09812b85fa6f41058bcc46e70ac406bf9b0493a - Merge drm/drm-next into drm-intel-next

Wed, 25 Feb 2026 12:23:04 +0100

Merge drm/drm-next into drm-intel-nextSync with v7.0-rc1 which contains a few treewide changes affecting i915.Signed-off-by: Jani Nikula List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

8b85987d3cf50178f67618122d9f3bb202f62f42 - Merge drm/drm-next into drm-misc-next

Mon, 23 Feb 2026 11:48:20 +0100

Merge drm/drm-next into drm-misc-nextLet's merge 7.0-rc1 to start the new drm-misc-next windowSigned-off-by: Maxime Ripard List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

c17ee635fd3a482b2ad2bf5e269755c2eae5f25e - Merge drm/drm-fixes into drm-misc-fixes

Mon, 23 Feb 2026 10:09:45 +0100

Merge drm/drm-fixes into drm-misc-fixes7.0-rc1 was just released, let's merge it to kick the new release cycle.Signed-off-by: Maxime Ripard List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

b7ef56a07672e0d7ebe71c9d9b45f959f0c2f8e8 - Merge tag 'media/v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Wed, 11 Feb 2026 21:20:25 +0100

Merge tag 'media/v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-mediaPull media updates from Mauro Carvalho Chehab: - Add support for GMSL1 and GMSL‑coax modules (PCI mgb4) - Add driver for TI VIP - AV1 – first kernel support (pixel‑format, decoder, transcoder) - Three new camera‑sensor drivers (os05b10, s5k3m5, s5kjn1) - Synopsys CSI‑2 receiver driver - Verisilicon & rkvdec – major fixes and enhancements - IPU6 (and 7) fixes and preparation for metadata - omap3isp: v4l2-compliance updates - Fix DVB streaming, drop wait_prepare/finish (dvb/vb2)* tag 'media/v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (307 commits) media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer media: uvcvideo: Fix allocation for small frame sizes media: uvcvideo: Return queued buffers on start_streaming() failure media: uvcvideo: Create an ID namespace for streaming output terminals media: rkvdec: Add HEVC support for the VDPU383 variant media: rkvdec: Add HEVC support for the VDPU381 variant media: rkvdec: Add H264 support for the VDPU383 variant media: rkvdec: Add H264 support for the VDPU381 variant media: rkvdec: Disable multicore support media: rkvdec: Enable all clocks without naming them media: rkvdec: Support per-variant interrupt handler media: rkvdec: Add RCB and SRAM support media: rkvdec: Add variant specific coded formats list media: rkvdec: Move hevc functions to common file media: rkvdec: Move h264 functions to common file media: rkvdec: Use structs to represent the HW RPS media: rkvdec: Move cabac tables to their own source file media: rkvdec: Switch to using structs instead of writel media: visl: Add HEVC short and long term RPS sets media: v4l2-ctrls: Add hevc_ext_sps_[ls]t_rps controls ... List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

cc4adab164b772a34b3340d644b7c4728498581e - Merge tag 'v6.19-rc1' into msm-next

Tue, 20 Jan 2026 23:06:55 +0100

Merge tag 'v6.19-rc1' into msm-nextMerge Linux 6.19-rc1 in order to catch up with other changes (e.g. UBWCconfig database defining UBWC_6).Signed-off-by: Dmitry Baryshkov List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

8fc707d13df517222db12b465af4aa9df05c99e1 - media: iris: remove v4l2_m2m_ioctl_{de,en}coder_cmd API usage during STOP handling

Sun, 02 Nov 2025 04:40:19 +0100

media: iris: remove v4l2_m2m_ioctl_{de,en}coder_cmd API usage during STOP handlingCurrently v4l2_m2m_ioctl_{de,enc}coder_cmd is being invoked during STOPcommand handling. However, this is not required as the iris driver hasits own drain and stop handling mechanism in place.Using the m2m command API in this context leads to incorrect behavior,where the LAST flag is prematurely attached to a capture buffer,when there are no buffers in m2m source queue. But, in this scenarioeven though the source buffers are returned to client, hardware mightstill need to process the pending capture buffers.Attaching LAST flag prematurely can result in the capture buffer beingremoved from the destination queue before the hardware has finishedprocessing it, causing issues when the buffer is eventually returned bythe hardware.To prevent this, remove the m2m API usage in stop handling.Fixes: d09100763bed ("media: iris: add support for drain sequence")Fixes: 75db90ae067d ("media: iris: Add support for drain sequence in encoder video device")Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Cc: stable@vger.kernel.orgSigned-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

2af481a459a4740c402d2b3346bc4f7b013d74b4 - media: iris: Define AV1-specific platform capabilities and properties

Wed, 10 Dec 2025 19:59:07 +0100

media: iris: Define AV1-specific platform capabilities and propertiesDefining platform specific capabilities specific to AV1 decoder.Set and subscribe to manadatory properties to firmware for AV1.Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Signed-off-by: Deepa Guthyappa Madivalara Tested-by: Val Packett Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

5add3c3c280a35f7e258e9cef7607db5a2e56fdc - Merge drm/drm-next into drm-xe-next

Fri, 19 Dec 2025 11:51:22 +0100

Merge drm/drm-next into drm-xe-nextBackmerging to bring in 6.19-rc1. An important upstream bugfix andto help unblock PTL CI.Signed-off-by: Thomas Hellström List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

ec439c38013550420aecc15988ae6acb670838c1 - Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after 6.19-rc1

Wed, 17 Dec 2025 06:29:38 +0100

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after 6.19-rc1Cross-merge BPF and other fixes after downstream PR.Signed-off-by: Alexei Starovoitov List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

b8304863a3990d0f18c38e5b94191830a63ee1af - Merge drm/drm-next into drm-intel-next

Mon, 15 Dec 2025 14:24:02 +0100

Merge drm/drm-next into drm-intel-nextSync-up some display code needed for Async flips refactor.Signed-off-by: Rodrigo Vivi List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

7f790dd21a931c61167f7bdc327aecf2cebad327 - Merge drm/drm-next into drm-misc-next

Mon, 15 Dec 2025 09:27:39 +0100

Merge drm/drm-next into drm-misc-nextLet's kickstart the v6.20 (7.0?) release cycle.Signed-off-by: Maxime Ripard List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

a4a508df2aa34f8650afde54ea804321c618f45f - Merge tag 'v6.18' into next

Sat, 13 Dec 2025 10:18:20 +0100

Merge tag 'v6.18' into nextSync up with the mainline to bring in the latest APIs. List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

24f171c7e145f43b9f187578e89b0982ce87e54c - Merge tag 'asoc-fix-v6.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Sun, 21 Dec 2025 11:11:11 +0100

Merge tag 'asoc-fix-v6.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v6.19We've been quite busy with fixes since the merge window, though not inany particularly exciting ways - the standout thing is the fix for _SXcontrols which were broken by a change to how we do clamping, otherwiseit's all fairly run of the mill fixes and quirks. List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c

84318277d6334c6981ab326d4acc87c6a6ddc9b8 - Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes

Mon, 15 Dec 2025 12:53:27 +0100

Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixesPull in rc1 to include all changes since the merge window closed,and grab all fixes and changes from drm/drm-next.Signed-off-by: Maarten Lankhorst List of files: /linux/drivers/media/platform/qcom/iris/iris_vidc.c