mbox series

[0/3] media: imx8-isi: fix resource lifecycle bugs

Message ID 20260424231926.406079-1-xiaolei.wang@windriver.com (mailing list archive)
Headers
Series media: imx8-isi: fix resource lifecycle bugs |

Message

Xiaolei Wang April 24, 2026, 11:19 p.m. UTC 
This series fixes three resource lifecycle issues in the imx8-isi driver,
all introduced by commit cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver").

Patch 1 fixes a use-after-free on rmmod: mxc_isi_remove() called
crossbar cleanup before v4l2 cleanup, freeing the crossbar pads while
the media framework still needed them to remove links. Fix by swapping
the cleanup order.

Patch 2 fixes a memory leak on rmmod: both crossbar and pipe cleanup
paths were missing v4l2_subdev_cleanup() calls to free the subdev
active state allocated by v4l2_subdev_init_finalize().

Patch 3 fixes resource leaks in probe error paths: the pipes array
allocated with kzalloc_objs() was never freed on failure or remove,
and already-initialized pipes were not cleaned up when a later pipe
init or v4l2 init failed. Fix by switching to devm_kcalloc() and
adding pipe cleanup in the error path.

Xiaolei Wang (3):
  media: imx8-isi: fix use-after-free on remove
  media: imx8-isi: add missing v4l2_subdev_cleanup() in crossbar and
    pipe
  media: imx8-isi: fix resource leaks in probe error paths and remove

 drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c     | 7 +++++--
 drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 +
 drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c     | 1 +
 3 files changed, 7 insertions(+), 2 deletions(-)