In the Linux kernel, the following vulnerability has been resolved:

Revert "media: iris: Add sanity check for stop streaming"

This reverts commit ad699fa78b59241c9d71a8cafb51525f3dab04d4.

Revert the check that skipped stopstreaming when the instance was in IRISINSTERROR, as it caused multiple regressions:

1. Buffers were not returned to vb2 when the instance was already in error state, triggering warnings in the vb2 core because buffer completion was skipped.

2. If a session failed early (e.g. unsupported configuration), the instance transitioned to IRISINSTERROR. When userspace attempted to stop streaming for cleanup, stopstreaming was skipped due to the added check, preventing proper teardown and leaving the firmware in an inconsistent state.

In the Linux kernel, the following vulnerability has been resolved:

media: iris: Add buffer to list only after successful allocation

Move listaddtail() to after dmaallocattrs() succeeds when creating internal buffers. Previously, the buffer was enqueued in buffers->list before the DMA allocation. If the allocation failed, the function returned -ENOMEM while leaving a partially initialized buffer in the list, which could lead to inconsistent state and potential leaks.

By adding the buffer to the list only after dmaallocattrs() succeeds, we ensure the list contains only valid, fully initialized buffers.

In the Linux kernel, the following vulnerability has been resolved:

media: iris: Add missing platform data entries for SM8750

Two platform-data fields for SM8750 were missed:

- getvpubuffersize = irisvpu33bufsize Without this, the driver fails to allocate the required internal buffers, leading to basic decode/encode failures during session bring-up.

- maxcorembps = ((7680 4320) / 256) 60 Without this capability exposed, capability checks are incomplete and v4l2-compliance for encoder fails.