[PATCH v2 0/4] media: imx8-isi: fix resource cleanup issues

[PATCH v2 0/4] media: imx8-isi: fix resource cleanup issues

[Xiaolei Wang]

This series fixes several resource management bugs in the imx8-isi driver:

- A use-after-free triggered during rmmod because crossbar pads were
  freed before media links referencing them were removed.
- A memory leak of subdev active state due to missing
  v4l2_subdev_cleanup() calls in crossbar and pipe cleanup paths.
- A memory leak of isi->pipes on probe failure and normal unbind.
- Missing cleanup of already-initialized pipes when probe fails
  partway through the channel loop or during v4l2 init.

All four issues trace back to the original driver introduction in
cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver").

Changes in V2:
  - Split the previous patch 3 ("media: imx8-isi: fix isi->pipes memory leak
    in probe and remove") into two separate patches:
  - Patch 3/4: fix isi->pipes memory leak by switching to devm_kcalloc()
  - Patch 4/4: clean up already-initialized pipes on probe failure
  - Link to V1: https://patchwork.linuxtv.org/project/linux-media/cover/20260424231926.406079-1-xiaolei.wang@windriver.com/

Xiaolei Wang (4):
  media: imx8-isi: fix use-after-free on remove
  media: imx8-isi: add missing v4l2_subdev_cleanup() in crossbar and
    pipe
  media: imx8-isi: fix isi->pipes memory leak in probe and remove
  media: imx8-isi: clean up already-initialized pipes on probe failure

 drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c     | 7 +++++--
 drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 +
 drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c     | 1 +
 3 files changed, 7 insertions(+), 2 deletions(-)

-- 
2.43.0

[PATCH v2 1/4] media: imx8-isi: fix use-after-free on remove

[Xiaolei Wang]

KASAN reports a slab-use-after-free in __media_entity_remove_link()
during rmmod of imx8_isi:

  BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650
  Read of size 2 at addr ffff0000d47cb02a by task rmmod/724

  Call trace:
   __media_entity_remove_link+0x608/0x650
   __media_entity_remove_links+0x78/0x144
   __media_device_unregister_entity+0x150/0x280
   media_device_unregister_entity+0x48/0x68
   v4l2_device_unregister_subdev+0x158/0x300
   v4l2_async_unbind_subdev_one+0x22c/0x358
   v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0
   v4l2_async_nf_unregister+0x5c/0x14c
   mxc_isi_remove+0x124/0x2a0 [imx8_isi]

  Allocated by task 249:
   __kmalloc_noprof+0x27c/0x690
   mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi]

  Freed by task 724:
   kfree+0x1e4/0x5b0
   mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi]
   mxc_isi_remove+0x11c/0x2a0 [imx8_isi]

The problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup()
before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media
entity pads, but the subsequent v4l2 cleanup still tries to remove
media links that reference those pads.

Fix this by calling mxc_isi_v4l2_cleanup() before
mxc_isi_crossbar_cleanup() to ensure all media entities are properly
unregistered while the pads are still valid.

Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
---
 drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
index 4bf8570e1b9e..2d639b789910 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
@@ -556,8 +556,8 @@ static void mxc_isi_remove(struct platform_device *pdev)
 		mxc_isi_pipe_cleanup(pipe);
 	}
 
-	mxc_isi_crossbar_cleanup(&isi->crossbar);
 	mxc_isi_v4l2_cleanup(isi);
+	mxc_isi_crossbar_cleanup(&isi->crossbar);
 }
 
 static const struct of_device_id mxc_isi_of_match[] = {
-- 
2.43.0

[PATCH v2 2/4] media: imx8-isi: add missing v4l2_subdev_cleanup() in crossbar and pipe

[Xiaolei Wang]

Both mxc_isi_crossbar_init() and mxc_isi_pipe_init() call
v4l2_subdev_init_finalize() which allocates the subdev active state,
but neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup()
calls v4l2_subdev_cleanup() to free it.

This causes a memory leak on every rmmod, reported by kmemleak:

  unreferenced object 0xffff0000d06fc800 (size 192):
    comm "(udev-worker)", pid 254, jiffies 4294913455
    backtrace (crc 36eeae58):
      kmemleak_alloc+0x34/0x40
      __kvmalloc_node_noprof+0x5f8/0x7d8
      __v4l2_subdev_state_alloc+0x1fc/0x30c
      __v4l2_subdev_init_finalize+0x178/0x368

Add the missing v4l2_subdev_cleanup() calls before media_entity_cleanup()
in both crossbar and pipe cleanup paths.

Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
---
 drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 +
 drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
index 605a45124103..c580c831972e 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
@@ -491,6 +491,7 @@ int mxc_isi_crossbar_init(struct mxc_isi_dev *isi)
 
 void mxc_isi_crossbar_cleanup(struct mxc_isi_crossbar *xbar)
 {
+	v4l2_subdev_cleanup(&xbar->sd);
 	media_entity_cleanup(&xbar->sd.entity);
 	kfree(xbar->pads);
 	kfree(xbar->inputs);
diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
index a41c51dd9ce0..cb50af2270f6 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
@@ -819,6 +819,7 @@ void mxc_isi_pipe_cleanup(struct mxc_isi_pipe *pipe)
 {
 	struct v4l2_subdev *sd = &pipe->sd;
 
+	v4l2_subdev_cleanup(sd);
 	media_entity_cleanup(&sd->entity);
 	mutex_destroy(&pipe->lock);
 }
-- 
2.43.0

[PATCH v2 3/4] media: imx8-isi: fix isi->pipes memory leak in probe and remove

[Xiaolei Wang]

mxc_isi_probe() allocates isi->pipes with kzalloc_objs() but never
frees it on any probe failure path or in mxc_isi_remove(), leaking
the allocation on every failed probe and every normal unbind.

Fix this by switching from kzalloc_objs() to devm_kcalloc(), which
ties the allocation lifetime to the device and eliminates the need
for explicit kfree() in all error paths and in mxc_isi_remove().

Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
---
 drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
index 2d639b789910..2b76fb9c18f6 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
@@ -485,7 +485,8 @@ static int mxc_isi_probe(struct platform_device *pdev)
 
 	isi->pdata = of_device_get_match_data(dev);
 
-	isi->pipes = kzalloc_objs(isi->pipes[0], isi->pdata->num_channels);
+	isi->pipes = devm_kcalloc(dev, isi->pdata->num_channels,
+				  sizeof(*isi->pipes), GFP_KERNEL);
 	if (!isi->pipes)
 		return -ENOMEM;
 
-- 
2.43.0

[PATCH v2 4/4] media: imx8-isi: clean up already-initialized pipes on probe failure

[Xiaolei Wang]

When mxc_isi_pipe_init() fails partway through the channel loop or
when mxc_isi_v4l2_init() fails, the already initialized pipes are
not cleaned up.

Fix this by calling mxc_isi_pipe_cleanup() for each already-initialized
pipe in the err_xbar error path.

Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
---
 drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
index 2b76fb9c18f6..8533a979d60a 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
@@ -539,6 +539,8 @@ static int mxc_isi_probe(struct platform_device *pdev)
 	return 0;
 
 err_xbar:
+	while (i--)
+		mxc_isi_pipe_cleanup(&isi->pipes[i]);
 	mxc_isi_crossbar_cleanup(&isi->crossbar);
 
 	return ret;
-- 
2.43.0

Re: [PATCH v2 1/4] media: imx8-isi: fix use-after-free on remove

[Laurent Pinchart]

Hello Xiaolei,

Thank you for the patch.

On Wed, May 06, 2026 at 11:12:07AM +0800, Xiaolei Wang wrote:
> KASAN reports a slab-use-after-free in __media_entity_remove_link()
> during rmmod of imx8_isi:
> 
>   BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650
>   Read of size 2 at addr ffff0000d47cb02a by task rmmod/724
> 
>   Call trace:
>    __media_entity_remove_link+0x608/0x650
>    __media_entity_remove_links+0x78/0x144
>    __media_device_unregister_entity+0x150/0x280
>    media_device_unregister_entity+0x48/0x68
>    v4l2_device_unregister_subdev+0x158/0x300
>    v4l2_async_unbind_subdev_one+0x22c/0x358
>    v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0
>    v4l2_async_nf_unregister+0x5c/0x14c
>    mxc_isi_remove+0x124/0x2a0 [imx8_isi]
> 
>   Allocated by task 249:
>    __kmalloc_noprof+0x27c/0x690
>    mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi]
> 
>   Freed by task 724:
>    kfree+0x1e4/0x5b0
>    mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi]
>    mxc_isi_remove+0x11c/0x2a0 [imx8_isi]
> 
> The problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup()
> before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media
> entity pads, but the subsequent v4l2 cleanup still tries to remove
> media links that reference those pads.
> 
> Fix this by calling mxc_isi_v4l2_cleanup() before
> mxc_isi_crossbar_cleanup() to ensure all media entities are properly
> unregistered while the pads are still valid.
> 
> Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
> Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
> Reviewed-by: Frank Li <Frank.Li@nxp.com>

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> index 4bf8570e1b9e..2d639b789910 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> @@ -556,8 +556,8 @@ static void mxc_isi_remove(struct platform_device *pdev)
>  		mxc_isi_pipe_cleanup(pipe);
>  	}
>  
> -	mxc_isi_crossbar_cleanup(&isi->crossbar);
>  	mxc_isi_v4l2_cleanup(isi);
> +	mxc_isi_crossbar_cleanup(&isi->crossbar);
>  }
>  
>  static const struct of_device_id mxc_isi_of_match[] = {

-- 
Regards,

Laurent Pinchart

Re: [PATCH v2 2/4] media: imx8-isi: add missing v4l2_subdev_cleanup() in crossbar and pipe

[Laurent Pinchart]

Hello Xiaolei,

Thank you for the patch.

On Wed, May 06, 2026 at 11:12:08AM +0800, Xiaolei Wang wrote:
> Both mxc_isi_crossbar_init() and mxc_isi_pipe_init() call
> v4l2_subdev_init_finalize() which allocates the subdev active state,
> but neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup()
> calls v4l2_subdev_cleanup() to free it.
> 
> This causes a memory leak on every rmmod, reported by kmemleak:
> 
>   unreferenced object 0xffff0000d06fc800 (size 192):
>     comm "(udev-worker)", pid 254, jiffies 4294913455
>     backtrace (crc 36eeae58):
>       kmemleak_alloc+0x34/0x40
>       __kvmalloc_node_noprof+0x5f8/0x7d8
>       __v4l2_subdev_state_alloc+0x1fc/0x30c
>       __v4l2_subdev_init_finalize+0x178/0x368
> 
> Add the missing v4l2_subdev_cleanup() calls before media_entity_cleanup()
> in both crossbar and pipe cleanup paths.
> 
> Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
> Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
> ---
>  drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 +
>  drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c     | 1 +
>  2 files changed, 2 insertions(+)
> 
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
> index 605a45124103..c580c831972e 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
> @@ -491,6 +491,7 @@ int mxc_isi_crossbar_init(struct mxc_isi_dev *isi)
>  
>  void mxc_isi_crossbar_cleanup(struct mxc_isi_crossbar *xbar)
>  {
> +	v4l2_subdev_cleanup(&xbar->sd);
>  	media_entity_cleanup(&xbar->sd.entity);
>  	kfree(xbar->pads);
>  	kfree(xbar->inputs);
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
> index a41c51dd9ce0..cb50af2270f6 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
> @@ -819,6 +819,7 @@ void mxc_isi_pipe_cleanup(struct mxc_isi_pipe *pipe)
>  {
>  	struct v4l2_subdev *sd = &pipe->sd;
>  
> +	v4l2_subdev_cleanup(sd);

v4l2_subdev_cleanup() should also be called in some of the error paths
of mxc_isi_pipe_init(). This can be done in a separate patch, so

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

>  	media_entity_cleanup(&sd->entity);
>  	mutex_destroy(&pipe->lock);
>  }

-- 
Regards,

Laurent Pinchart

Re: [PATCH v2 3/4] media: imx8-isi: fix isi->pipes memory leak in probe and remove

[Laurent Pinchart]

Hello Xiaolei,

Thank you for the patch.

On Wed, May 06, 2026 at 11:12:09AM +0800, Xiaolei Wang wrote:
> mxc_isi_probe() allocates isi->pipes with kzalloc_objs() but never
> frees it on any probe failure path or in mxc_isi_remove(), leaking
> the allocation on every failed probe and every normal unbind.
> 
> Fix this by switching from kzalloc_objs() to devm_kcalloc(), which
> ties the allocation lifetime to the device and eliminates the need
> for explicit kfree() in all error paths and in mxc_isi_remove().

There's ongoing work to add a devm_kzalloc_objs(), to I'd rather not
revert to kcalloc. If you want to fix this leak now without waiting for
devm_kzalloc_objs(), I would prefer adding kfree() in error paths and in
mxc_isi_remove().

> Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
> Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
> ---
>  drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> index 2d639b789910..2b76fb9c18f6 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> @@ -485,7 +485,8 @@ static int mxc_isi_probe(struct platform_device *pdev)
>  
>  	isi->pdata = of_device_get_match_data(dev);
>  
> -	isi->pipes = kzalloc_objs(isi->pipes[0], isi->pdata->num_channels);
> +	isi->pipes = devm_kcalloc(dev, isi->pdata->num_channels,
> +				  sizeof(*isi->pipes), GFP_KERNEL);
>  	if (!isi->pipes)
>  		return -ENOMEM;
>  

-- 
Regards,

Laurent Pinchart

Re: [PATCH v2 4/4] media: imx8-isi: clean up already-initialized pipes on probe failure

[Laurent Pinchart]

Hello Xiaolei,

Thank you for the patch.

On Wed, May 06, 2026 at 11:12:10AM +0800, Xiaolei Wang wrote:
> When mxc_isi_pipe_init() fails partway through the channel loop or
> when mxc_isi_v4l2_init() fails, the already initialized pipes are
> not cleaned up.
> 
> Fix this by calling mxc_isi_pipe_cleanup() for each already-initialized
> pipe in the err_xbar error path.
> 
> Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
> Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> index 2b76fb9c18f6..8533a979d60a 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> @@ -539,6 +539,8 @@ static int mxc_isi_probe(struct platform_device *pdev)
>  	return 0;
>  
>  err_xbar:
> +	while (i--)
> +		mxc_isi_pipe_cleanup(&isi->pipes[i]);
>  	mxc_isi_crossbar_cleanup(&isi->crossbar);
>  
>  	return ret;

-- 
Regards,

Laurent Pinchart

Re: [PATCH v2 2/4] media: imx8-isi: add missing v4l2_subdev_cleanup() in crossbar and pipe

[xiaolei wang]

Hi Laurent,

Thank you for the review.

On 5/6/26 20:35, Laurent Pinchart wrote:
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
> Hello Xiaolei,
>
> Thank you for the patch.
>
> On Wed, May 06, 2026 at 11:12:08AM +0800, Xiaolei Wang wrote:
>> Both mxc_isi_crossbar_init() and mxc_isi_pipe_init() call
>> v4l2_subdev_init_finalize() which allocates the subdev active state,
>> but neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup()
>> calls v4l2_subdev_cleanup() to free it.
>>
>> This causes a memory leak on every rmmod, reported by kmemleak:
>>
>>    unreferenced object 0xffff0000d06fc800 (size 192):
>>      comm "(udev-worker)", pid 254, jiffies 4294913455
>>      backtrace (crc 36eeae58):
>>        kmemleak_alloc+0x34/0x40
>>        __kvmalloc_node_noprof+0x5f8/0x7d8
>>        __v4l2_subdev_state_alloc+0x1fc/0x30c
>>        __v4l2_subdev_init_finalize+0x178/0x368
>>
>> Add the missing v4l2_subdev_cleanup() calls before media_entity_cleanup()
>> in both crossbar and pipe cleanup paths.
>>
>> Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
>> Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
>> Reviewed-by: Frank Li <Frank.Li@nxp.com>
>> ---
>>   drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 +
>>   drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c     | 1 +
>>   2 files changed, 2 insertions(+)
>>
>> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
>> index 605a45124103..c580c831972e 100644
>> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
>> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
>> @@ -491,6 +491,7 @@ int mxc_isi_crossbar_init(struct mxc_isi_dev *isi)
>>
>>   void mxc_isi_crossbar_cleanup(struct mxc_isi_crossbar *xbar)
>>   {
>> +     v4l2_subdev_cleanup(&xbar->sd);
>>        media_entity_cleanup(&xbar->sd.entity);
>>        kfree(xbar->pads);
>>        kfree(xbar->inputs);
>> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
>> index a41c51dd9ce0..cb50af2270f6 100644
>> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
>> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
>> @@ -819,6 +819,7 @@ void mxc_isi_pipe_cleanup(struct mxc_isi_pipe *pipe)
>>   {
>>        struct v4l2_subdev *sd = &pipe->sd;
>>
>> +     v4l2_subdev_cleanup(sd);
> v4l2_subdev_cleanup() should also be called in some of the error paths
> of mxc_isi_pipe_init(). This can be done in a separate patch, so
Yes, I'll send a follow-up patch to add v4l2_subdev_cleanup() in the
error paths of mxc_isi_pipe_init() after v4l2_subdev_init_finalize()

succeeds.

thanks

xiaolei

>
> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
>
>>        media_entity_cleanup(&sd->entity);
>>        mutex_destroy(&pipe->lock);
>>   }
> --
> Regards,
>
> Laurent Pinchart

Re: [PATCH v2 4/4] media: imx8-isi: clean up already-initialized pipes on probe failure

[Frank Li]

On Wed, May 06, 2026 at 11:12:10AM +0800, Xiaolei Wang wrote:
> When mxc_isi_pipe_init() fails partway through the channel loop or
> when mxc_isi_v4l2_init() fails, the already initialized pipes are
> not cleaned up.
>
> Fix this by calling mxc_isi_pipe_cleanup() for each already-initialized
> pipe in the err_xbar error path.
>
> Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
> Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> index 2b76fb9c18f6..8533a979d60a 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> @@ -539,6 +539,8 @@ static int mxc_isi_probe(struct platform_device *pdev)
>  	return 0;
>
>  err_xbar:
> +	while (i--)
> +		mxc_isi_pipe_cleanup(&isi->pipes[i]);
>  	mxc_isi_crossbar_cleanup(&isi->crossbar);
>
>  	return ret;
> --
> 2.43.0
>

Re: [PATCH v2 3/4] media: imx8-isi: fix isi->pipes memory leak in probe and remove

[xiaolei wang]

Hi Laurent,

Thanks for the review

On 5/6/26 20:41, Laurent Pinchart wrote:
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
> Hello Xiaolei,
>
> Thank you for the patch.
>
> On Wed, May 06, 2026 at 11:12:09AM +0800, Xiaolei Wang wrote:
>> mxc_isi_probe() allocates isi->pipes with kzalloc_objs() but never
>> frees it on any probe failure path or in mxc_isi_remove(), leaking
>> the allocation on every failed probe and every normal unbind.
>>
>> Fix this by switching from kzalloc_objs() to devm_kcalloc(), which
>> ties the allocation lifetime to the device and eliminates the need
>> for explicit kfree() in all error paths and in mxc_isi_remove().
> There's ongoing work to add a devm_kzalloc_objs(), to I'd rather not
> revert to kcalloc. If you want to fix this leak now without waiting for
> devm_kzalloc_objs(), I would prefer adding kfree() in error paths and in
> mxc_isi_remove().

Thanks for the suggestion. I agree that waiting for devm_kzalloc_objs()

is the reasonable approach.

thanks

xiaolei

>
>> Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
>> Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
>> ---
>>   drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
>> index 2d639b789910..2b76fb9c18f6 100644
>> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
>> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
>> @@ -485,7 +485,8 @@ static int mxc_isi_probe(struct platform_device *pdev)
>>
>>        isi->pdata = of_device_get_match_data(dev);
>>
>> -     isi->pipes = kzalloc_objs(isi->pipes[0], isi->pdata->num_channels);
>> +     isi->pipes = devm_kcalloc(dev, isi->pdata->num_channels,
>> +                               sizeof(*isi->pipes), GFP_KERNEL);
>>        if (!isi->pipes)
>>                return -ENOMEM;
>>
> --
> Regards,
>
> Laurent Pinchart