From patchwork Tue Mar 14 11:55:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vaishnav Achath X-Patchwork-Id: 663869 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A6FCC7618D for ; Tue, 14 Mar 2023 11:56:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231663AbjCNL40 (ORCPT ); Tue, 14 Mar 2023 07:56:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46254 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231630AbjCNL4Q (ORCPT ); Tue, 14 Mar 2023 07:56:16 -0400 Received: from lelv0143.ext.ti.com (lelv0143.ext.ti.com [198.47.23.248]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 14CDF9FBF8; Tue, 14 Mar 2023 04:55:59 -0700 (PDT) Received: from lelv0266.itg.ti.com ([10.180.67.225]) by lelv0143.ext.ti.com (8.15.2/8.15.2) with ESMTP id 32EBtLjc118609; Tue, 14 Mar 2023 06:55:21 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; s=ti-com-17Q1; t=1678794921; bh=hoH8JvDJMF9kb6jtv86aNPb3gPGJn4rtX1ltZYZwBtA=; h=From:To:CC:Subject:Date:In-Reply-To:References; b=BTzJFcM5QVeEDKZeJuZm66vU2YfiyRbTZ4jFP0aMW3/GA1RmUYuLgt77I4GJtcMIP qIOjj2RRNJnjJQb87r9Bfq6YQ72V21409rMB0J0TQbqG09yuHsUxtKqIrxsmgJuqlN VCGxiCKnr0XbOvGxDfjSaJcayA8747fC9uOMDEDg= Received: from DFLE110.ent.ti.com (dfle110.ent.ti.com [10.64.6.31]) by lelv0266.itg.ti.com (8.15.2/8.15.2) with ESMTPS id 32EBtLTV112465 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 14 Mar 2023 06:55:21 -0500 Received: from DFLE108.ent.ti.com (10.64.6.29) by DFLE110.ent.ti.com (10.64.6.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2507.16; Tue, 14 Mar 2023 06:55:20 -0500 Received: from lelv0326.itg.ti.com (10.180.67.84) by DFLE108.ent.ti.com (10.64.6.29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2507.16 via Frontend Transport; Tue, 14 Mar 2023 06:55:20 -0500 Received: from localhost (ileaxei01-snat.itg.ti.com [10.180.69.5]) by lelv0326.itg.ti.com (8.15.2/8.15.2) with ESMTP id 32EBtJ31002271; Tue, 14 Mar 2023 06:55:20 -0500 From: Vaishnav Achath To: , , , , , , , , CC: , , , , , , , , , , Subject: [PATCH v7 01/13] media: cadence: csi2rx: Unregister v4l2 async notifier Date: Tue, 14 Mar 2023 17:25:04 +0530 Message-ID: <20230314115516.667-2-vaishnav.a@ti.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230314115516.667-1-vaishnav.a@ti.com> References: <20230314115516.667-1-vaishnav.a@ti.com> MIME-Version: 1.0 X-EXCLAIMER-MD-CONFIG: e1e8a2fd-e40a-4ac6-ac9b-f7e9cc9ee180 Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Pratyush Yadav The notifier is added to the global notifier list when registered. When the module is removed, the struct csi2rx_priv in which the notifier is embedded, is destroyed. As a result the notifier list has a reference to a notifier that no longer exists. This causes invalid memory accesses when the list is iterated over. Similar for when the probe fails. Unregister and clean up the notifier to avoid this. Fixes: 1fc3b37f34f6 ("media: v4l: cadence: Add Cadence MIPI-CSI2 RX driver") Signed-off-by: Pratyush Yadav Signed-off-by: Vaishnav Achath Reviewed-by: Laurent Pinchart --- (no changes since v5) Changes in v5: - Cleanup notifier in csi2rx_parse_dt() after the call to v4l2_async_nf_add_fwnode_remote(). Changes in v3: - New in v3. drivers/media/platform/cadence/cdns-csi2rx.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/cadence/cdns-csi2rx.c b/drivers/media/platform/cadence/cdns-csi2rx.c index cc3ebb0d96f6..2a23da6a0b8e 100644 --- a/drivers/media/platform/cadence/cdns-csi2rx.c +++ b/drivers/media/platform/cadence/cdns-csi2rx.c @@ -404,8 +404,10 @@ static int csi2rx_parse_dt(struct csi2rx_priv *csi2rx) asd = v4l2_async_nf_add_fwnode_remote(&csi2rx->notifier, fwh, struct v4l2_async_subdev); of_node_put(ep); - if (IS_ERR(asd)) + if (IS_ERR(asd)) { + v4l2_async_nf_cleanup(&csi2rx->notifier); return PTR_ERR(asd); + } csi2rx->notifier.ops = &csi2rx_notifier_ops; @@ -467,6 +469,7 @@ static int csi2rx_probe(struct platform_device *pdev) return 0; err_cleanup: + v4l2_async_nf_unregister(&csi2rx->notifier); v4l2_async_nf_cleanup(&csi2rx->notifier); err_free_priv: kfree(csi2rx); @@ -477,6 +480,8 @@ static int csi2rx_remove(struct platform_device *pdev) { struct csi2rx_priv *csi2rx = platform_get_drvdata(pdev); + v4l2_async_nf_unregister(&csi2rx->notifier); + v4l2_async_nf_cleanup(&csi2rx->notifier); v4l2_async_unregister_subdev(&csi2rx->subdev); kfree(csi2rx);