Skip to content

media: sun4i-csi: fix probe/streaming lifecycle bugs

Cong Nguyen linux-arm-kernel linux-media linux-sunxi lkml stable 2 versions – New

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v2 Latest3 patches 0 repliesNew
  2. v13 patches 0 repliesSuperseded

Changes in v2 from the cover letter

- 2/3: read CSI_INT_EN_REG back after disabling it to flush the posted write before synchronize_irq() (Sashiko AI review).
- 2/3: apply the same interrupt teardown to the start_streaming() error path (err_disable_device), which had the identical defect - the IRQ is enabled and capture started before the s_stream call that can fail. Both paths now share a new sun4i_csi_disable_irq() helper.
- 3/3: only clear csi->src_subdev in .unbind; drop the vb2_video_unregister_device() call. Since notify_complete() registers the video device, unregistering it on unbind would make it re-register an already-unregistered embedded video_device on a subsequent re-bind. Clearing the cached pointer alone prevents the use-after-free.
- No functional changes to 1/3.

Patches in v2 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/3media: sun4i-csi: fix video device and subdev leak in notify_complete()drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c+6 -20 replies
2/3media: sun4i-csi: disable interrupts when stopping streamingdrivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c+21 -00 replies
3/3media: sun4i-csi: add notifier unbind callback to drop the source subdevdrivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c+17 -00 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v2 yet.

Read the v2 thread

Cover letter [PATCH v2 0/3] media: sun4i-csi: fix probe/streaming lifecycle bugs

This series fixes three independent, pre-existing lifecycle bugs in the sun4i-csi driver, all present since the driver was added (577bbf23b758):

1/3 - notify_complete() left the video device and bridge subdev
registered if a later step failed, so /dev/videoX stayed live over the freed devm context.
2/3 - the frame-done interrupt was never disabled on the stop path, so a
late IRQ could touch a gated block after runtime suspend.
3/3 - the async notifier had no .unbind, so the cached source subdev
pointer dangled after the sensor unbound.

Changes in v2:
- 2/3: read CSI_INT_EN_REG back after disabling it to flush the posted write before synchronize_irq() (Sashiko AI review).
- 2/3: apply the same interrupt teardown to the start_streaming() error path (err_disable_device), which had the identical defect - the IRQ is enabled and capture started before the s_stream call that can fail. Both paths now share a new sun4i_csi_disable_irq() helper.
- 3/3: only clear csi->src_subdev in .unbind; drop the vb2_video_unregister_device() call. Since notify_complete() registers the video device, unregistering it on unbind would make it re-register an already-unregistered embedded video_device on a subsequent re-bind. Clearing the cached pointer alone prevents the use-after-free.
- No functional changes to 1/3.

Two further pre-existing issues raised in review are not addressed here, as they are out of scope for these fixes: the embedded video_device using video_device_release_empty in a devm-allocated struct (a broader lifetime rework), and notify_complete() not being re-bind safe (it re-registers the bridge subdev, which needs a larger restructuring of the notifier flow).

Cong Nguyen (3):
media: sun4i-csi: fix video device and subdev leak in
notify_complete()
media: sun4i-csi: disable interrupts when stopping streaming
media: sun4i-csi: add notifier unbind callback to drop the source
subdev

 .../platform/sunxi/sun4i-csi/sun4i_csi.c      | 25 +++++++++++++++++--
 .../platform/sunxi/sun4i-csi/sun4i_csi.h      |  1 +
 .../platform/sunxi/sun4i-csi/sun4i_dma.c      | 20 +++++++++++++++
 3 files changed, 44 insertions(+), 2 deletions(-)
Signature · 1 line
2.25.1