From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B79A83769F5; Thu, 30 Jul 2026 15:16:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785424564; cv=none; b=flAsq1D3PtTDhLK6veBuBhCF1CjbNFE0mAUSJMt2s6GVeOjCES/mzCf33wlmsb8KJPRKUOhhtbI2QRhr+bYtYEdwU6cX8pxtXPE7KkzecDshAJ/5gLgfcQtNDGqjYvPEQyGWNPED3uX2RihRh2R+wL/T9Jq1alPDQlkeSbnwCLY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785424564; c=relaxed/simple; bh=0Akqm2FuBgNg5SU2bOItGKbrq9r7Omvpp6J+5sDWtUU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dgVHF7gVW4aSQEGDqJUtTdnep+bo6thubB9gynBSOM98kM6W7UiESCi+TNIfEFLXrb+Zs5hcs1kw9gtLQ5FiBhAYC8gqSuo6I8boIAVEJ4yKoabz9bLBSVdMzjH6FiEeHzeXeWcj6bc89X7KrtTjTzE2LbvhQwuKYfURV2VVQYE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YVPJnpKo; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="YVPJnpKo" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1E3501F000E9; Thu, 30 Jul 2026 15:16:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785424563; bh=QMGwPc9nSfLVEzaM8VWMMnCSrY+AW42N8LkrPlDofFU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=YVPJnpKoA2Sv/W3fjx+6npGOv5OJNY1R9Y8PIN9f+cIggsy0t+A7NXX9IBzYkcRYY IlJOdzDEfQ+Hv9G/+97OACw1E3jSVF/A7DuibR5aOf8TRQ0zYpUZNJKieOqBp2uuz2 CmfJNo+Q7FxZjEbjKKhAw/+keD+MRVUDX7W/1nvg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Frank Li , Mirela Rabulea , Laurent Pinchart , Sakari Ailus Subject: [PATCH 6.18 437/675] media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Date: Thu, 30 Jul 2026 16:12:47 +0200 Message-ID: <20260730141454.428218127@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141445.110192266@linuxfoundation.org> References: <20260730141445.110192266@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mirela Rabulea commit 06cb687a5132fcffe624c0070576ab852ac6b568 upstream. The v4l2 helper v4l2_async_register_subdev_sensor() calls v4l2_async_register_subdev(), which is a macro that expands to __v4l2_async_register_subdev(sd,THIS_MODULE). Since the macro is expanded inside v4l2-fwnode.c, THIS_MODULE resolves to the v4l2-fwnode module rather than the sensor driver module that originally set sd->owner. When v4l2-fwnode is built-in, THIS_MODULE evaluates to NULL, which then overwrites the sensor driver's owner with NULL. This causes the problem that the sensor module's reference count is never incremented during async registration, so the module can be removed while the subdevice is still in use by a notifier (e.g., a CSI-2 receiver bridge driver). Fix this by renaming v4l2_async_register_subdev_sensor() to __v4l2_async_register_subdev_sensor() with an added explicit module argument and introducing a wrapper macro: #define v4l2_async_register_subdev_sensor(sd) \ __v4l2_async_register_subdev_sensor(sd, THIS_MODULE) This ensures the sensor driver module is properly referenced even when the sensor driver does not init the owner field before calling v4l2_async_register_subdev_sensor() and prevents premature module removal. Fixes: aef69d54755d ("media: v4l: fwnode: Add a convenience function for registering sensors") Cc: stable@vger.kernel.org Suggested-by: Frank Li Link: https://lore.kernel.org/linux-media/20240315073125.275501-2-sakari.ailus@linux.intel.com/ Signed-off-by: Mirela Rabulea Reviewed-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Sakari Ailus Signed-off-by: Greg Kroah-Hartman --- drivers/media/v4l2-core/v4l2-fwnode.c | 6 +++--- include/media/v4l2-async.h | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-) --- a/drivers/media/v4l2-core/v4l2-fwnode.c +++ b/drivers/media/v4l2-core/v4l2-fwnode.c @@ -1246,7 +1246,7 @@ v4l2_async_nf_parse_fwnode_sensor(struct return 0; } -int v4l2_async_register_subdev_sensor(struct v4l2_subdev *sd) +int __v4l2_async_register_subdev_sensor(struct v4l2_subdev *sd, struct module *module) { struct v4l2_async_notifier *notifier; int ret; @@ -1272,7 +1272,7 @@ int v4l2_async_register_subdev_sensor(st if (ret < 0) goto out_cleanup; - ret = v4l2_async_register_subdev(sd); + ret = __v4l2_async_register_subdev(sd, module); if (ret < 0) goto out_unregister; @@ -1290,7 +1290,7 @@ out_cleanup: return ret; } -EXPORT_SYMBOL_GPL(v4l2_async_register_subdev_sensor); +EXPORT_SYMBOL_GPL(__v4l2_async_register_subdev_sensor); MODULE_DESCRIPTION("V4L2 fwnode binding parsing library"); MODULE_LICENSE("GPL"); --- a/include/media/v4l2-async.h +++ b/include/media/v4l2-async.h @@ -333,8 +333,10 @@ int __v4l2_async_register_subdev(struct * An error is returned if the module is no longer loaded on any attempts * to register it. */ +#define v4l2_async_register_subdev_sensor(sd) \ + __v4l2_async_register_subdev_sensor(sd, THIS_MODULE) int __must_check -v4l2_async_register_subdev_sensor(struct v4l2_subdev *sd); +__v4l2_async_register_subdev_sensor(struct v4l2_subdev *sd, struct module *module); /** * v4l2_async_unregister_subdev - unregisters a sub-device to the asynchronous