CVE-2026-89875: media: ti: vpe: quiesce overflow recovery before freeing streams
In the Linux kernel, the following vulnerability has been resolved:
media: ti: vpe: quiesce overflow recovery before freeing streams
The VIP overflow recovery worker is armed from the hardirq handler when a FIFO overflow is detected, and the list-complete path looks the stream up through the VPDMA list private pointer. Both keep touching stream, port and device state; the recovery worker also resets the parser and VPDMA, repopulates the descriptor list, and re-enables the per-list IRQs.
vipstopstreaming() masks and clears the per-list IRQs, but it neither synchronizes the hardirq handler nor disables recoverywork. An overflow IRQ that has already queued recoverywork, or a list-complete IRQ in flight when the stream is torn down, can therefore still dereference the stream after its resources are released: the descriptor list is freed by vipreleasestream() on file release, and the stream itself by freestream() on unbind/remove.
Drain the recovery worker and the IRQ handler at both teardown points through a shared vipquiescestream() helper, before any stream-owned resource is released. disableworksync() cancels pending recoverywork, drains a running instance, and raises its disable depth, so a subsequent schedulework() issued by a racing IRQ handler is rejected at the workqueue scheduler: recoverywork cannot be requeued after disableworksync() takes effect. The worker may still re-enable the per-list IRQs before disableworksync() returns; disableirqs() then masks those sources and synchronizeirq() waits for any in-flight handler that still dereferences stream state. In vipstopstreaming() the helper runs before the parser is stopped, since a worker drained by disableworksync() may re-enable the parser before exiting and would otherwise undo the stop. recoverywork is created disabled and enabled in vipstartstreaming() before IRQs, pairing the enable with the teardown disable across the streaming lifecycle.
This issue was found by an in-house static analysis tool and confirmed by manual code review.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel TI VPE/VIP media streaming path are exposed when a stream is being torn down. The vulnerable paths involve VIP overflow recovery, VPDMA descriptor lists, and stream release or unbind/remove operations.
What timing is required for the use-after-free to occur?
A FIFO overflow interrupt must have already queued the recovery worker, or a list-complete interrupt must still be in flight, while the stream is torn down and its resources are released. Those asynchronous paths can then dereference stream state after the descriptor list or stream object has been freed.
What does the fix do to prevent the issue?
The fix adds a shared quiesce step at both teardown points before stream-owned resources are released. It synchronizes the IRQ handler and uses disable_work_sync() to cancel pending overflow recovery work and wait for any running instance to finish.