media: sun4i-csi: fix probe/streaming lifecycle bugs
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest3 patches 0 repliesNew
- v13 patches 0 repliesSuperseded
Changes in v2 from the cover letter
- 2/3: read CSI_INT_EN_REG back after disabling it to flush the posted write before synchronize_irq() (Sashiko AI review).
- 2/3: apply the same interrupt teardown to the start_streaming() error path (err_disable_device), which had the identical defect - the IRQ is enabled and capture started before the s_stream call that can fail. Both paths now share a new sun4i_csi_disable_irq() helper.
- 3/3: only clear csi->src_subdev in .unbind; drop the vb2_video_unregister_device() call. Since notify_complete() registers the video device, unregistering it on unbind would make it re-register an already-unregistered embedded video_device on a subsequent re-bind. Clearing the cached pointer alone prevents the use-after-free.
- No functional changes to 1/3.
Patches in v2 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/3 | media: sun4i-csi: fix video device and subdev leak in notify_complete()drivers/ | +6 | 0 replies | |
| 2/3 | media: sun4i-csi: disable interrupts when stopping streamingdrivers/ drivers/ | +21 | 0 replies | |
| 3/3 | media: sun4i-csi: add notifier unbind callback to drop the source subdevdrivers/ | +17 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v2 yet.
Cover letter [PATCH v2 0/3] media: sun4i-csi: fix probe/streaming lifecycle bugs
This series fixes three independent, pre-existing lifecycle bugs in the sun4i-csi driver, all present since the driver was added (577bbf23b758):
1/3 - notify_complete() left the video device and bridge subdev
registered if a later step failed, so /dev/videoX stayed live over the freed devm context.
2/3 - the frame-done interrupt was never disabled on the stop path, so a
late IRQ could touch a gated block after runtime suspend.
3/3 - the async notifier had no .unbind, so the cached source subdev
pointer dangled after the sensor unbound.
Changes in v2:
- 2/3: read CSI_INT_EN_REG back after disabling it to flush the posted write before synchronize_irq() (Sashiko AI review).
- 2/3: apply the same interrupt teardown to the start_streaming() error path (err_disable_device), which had the identical defect - the IRQ is enabled and capture started before the s_stream call that can fail. Both paths now share a new sun4i_csi_disable_irq() helper.
- 3/3: only clear csi->src_subdev in .unbind; drop the vb2_video_unregister_device() call. Since notify_complete() registers the video device, unregistering it on unbind would make it re-register an already-unregistered embedded video_device on a subsequent re-bind. Clearing the cached pointer alone prevents the use-after-free.
- No functional changes to 1/3.
Two further pre-existing issues raised in review are not addressed here, as they are out of scope for these fixes: the embedded video_device using video_device_release_empty in a devm-allocated struct (a broader lifetime rework), and notify_complete() not being re-bind safe (it re-registers the bridge subdev, which needs a larger restructuring of the notifier flow).
Cong Nguyen (3):
media: sun4i-csi: fix video device and subdev leak in
notify_complete()
media: sun4i-csi: disable interrupts when stopping streaming
media: sun4i-csi: add notifier unbind callback to drop the source
subdev
.../platform/sunxi/sun4i-csi/sun4i_csi.c | 25 +++++++++++++++++-- .../platform/sunxi/sun4i-csi/sun4i_csi.h | 1 + .../platform/sunxi/sun4i-csi/sun4i_dma.c | 20 +++++++++++++++ 3 files changed, 44 insertions(+), 2 deletions(-)
Signature · 1 line
2.25.1