[PATCH] media: mediatek: vcodec: unregister VPU watchdog handler

[PATCH] media: mediatek: vcodec: unregister VPU watchdog handler

[Guangshuo Li]

mtk_vcodec_fw_vpu_init() registers a VPU watchdog reset handler and
passes the vcodec device as the private data.

The handler is stored in the VPU device and can outlive the vcodec
device. If firmware initialization fails after the handler has been
registered, or if the vcodec device is later removed, the VPU watchdog
table can keep a pointer to a vcodec device that is about to be released.
A later VPU watchdog reset can then call the reset handler with a stale
pointer and dereference freed memory while walking the vcodec context
list.

Add a VPU watchdog unregister helper and clear the vcodec watchdog
handler from both the firmware initialization failure path and the VPU
firmware release path before dropping the VPU device reference.

Fixes: 01abf5fbb081 ("media: mediatek: vcodec: separate struct 'mtk_vcodec_ctx'")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 .../mediatek/vcodec/common/mtk_vcodec_fw_vpu.c    |  4 ++++
 drivers/media/platform/mediatek/vpu/mtk_vpu.c     | 15 +++++++++++++++
 drivers/media/platform/mediatek/vpu/mtk_vpu.h     |  2 ++
 3 files changed, 21 insertions(+)

diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
index 3632037f78f5..c79a78c371ea 100644
--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
@@ -40,6 +40,9 @@ static int mtk_vcodec_vpu_ipi_send(struct mtk_vcodec_fw *fw, int id, void *buf,
 
 static void mtk_vcodec_vpu_release(struct mtk_vcodec_fw *fw)
 {
+	vpu_wdt_unreg_handler(fw->pdev,
+			      fw->fw_use == ENCODER ? VPU_RST_ENC :
+				       VPU_RST_DEC);
 	put_device(&fw->pdev->dev);
 }
 
@@ -120,6 +123,7 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_vpu_init(void *priv, enum mtk_vcodec_fw_use
 
 	fw = devm_kzalloc(&plat_dev->dev, sizeof(*fw), GFP_KERNEL);
 	if (!fw) {
+		vpu_wdt_unreg_handler(fw_pdev, rst_id);
 		put_device(&fw_pdev->dev);
 		return ERR_PTR(-ENOMEM);
 	}
diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
index 8d8319f0cd22..f59f45fecc75 100644
--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
@@ -437,6 +437,21 @@ int vpu_wdt_reg_handler(struct platform_device *pdev,
 }
 EXPORT_SYMBOL_GPL(vpu_wdt_reg_handler);
 
++void vpu_wdt_unreg_handler(struct platform_device *pdev, enum rst_id id)
+{
+	struct mtk_vpu *vpu = platform_get_drvdata(pdev);
+
+	if (!vpu || id >= VPU_RST_MAX)
+		return;
+
+	mutex_lock(&vpu->vpu_mutex);
+	vpu->wdt.handler[id].reset_func = NULL;
+	vpu->wdt.handler[id].priv = NULL;
+	mutex_unlock(&vpu->vpu_mutex);
+}
+EXPORT_SYMBOL_GPL(vpu_wdt_unreg_handler);
+
+
 unsigned int vpu_get_vdec_hw_capa(struct platform_device *pdev)
 {
 	struct mtk_vpu *vpu = platform_get_drvdata(pdev);
diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.h b/drivers/media/platform/mediatek/vpu/mtk_vpu.h
index 3951547e9ec5..2ccb481a04cf 100644
--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.h
+++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.h
@@ -141,6 +141,8 @@ int vpu_wdt_reg_handler(struct platform_device *pdev,
 			void vpu_wdt_reset_func(void *priv),
 			void *priv, enum rst_id id);
 
+void vpu_wdt_unreg_handler(struct platform_device *pdev, enum rst_id id);
+
 /**
  * vpu_get_vdec_hw_capa - get video decoder hardware capability
  *
-- 
2.43.0

Re: [PATCH] media: mediatek: vcodec: unregister VPU watchdog handler

[Nicolas Dufresne]

[-- Attachment #1: Type: text/plain, Size: 4056 bytes --]

Hi,

Le mercredi 08 juillet 2026 à 20:42 +0800, Guangshuo Li a écrit :
> mtk_vcodec_fw_vpu_init() registers a VPU watchdog reset handler and
> passes the vcodec device as the private data.
> 
> The handler is stored in the VPU device and can outlive the vcodec
> device. If firmware initialization fails after the handler has been
> registered, or if the vcodec device is later removed, the VPU watchdog
> table can keep a pointer to a vcodec device that is about to be released.
> A later VPU watchdog reset can then call the reset handler with a stale
> pointer and dereference freed memory while walking the vcodec context
> list.
> 
> Add a VPU watchdog unregister helper and clear the vcodec watchdog

The helper is already added in previous patch.

> handler from both the firmware initialization failure path and the VPU
> firmware release path before dropping the VPU device reference.

I'm changing my mind. Please resubmit with proper commit message, and make this
a series of 3 patches.

- 1/3 Add vpu_wdt_unreg_handler to vpu driver
- 2/3 Fix WPU watchdog
- 3/3 Fix MDP watchdog

Nicolas

> 
> Fixes: 01abf5fbb081 ("media: mediatek: vcodec: separate struct 'mtk_vcodec_ctx'")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  .../mediatek/vcodec/common/mtk_vcodec_fw_vpu.c    |  4 ++++
>  	    | 15 +++++++++++++++
>  drivers/media/platform/mediatek/vpu/mtk_vpu.h     |  2 ++
>  3 files changed, 21 insertions(+)
> 
> diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
> index 3632037f78f5..c79a78c371ea 100644
> --- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
> +++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
> @@ -40,6 +40,9 @@ static int mtk_vcodec_vpu_ipi_send(struct mtk_vcodec_fw *fw, int id, void *buf,
>  
>  static void mtk_vcodec_vpu_release(struct mtk_vcodec_fw *fw)
>  {
> +	vpu_wdt_unreg_handler(fw->pdev,
> +			      fw->fw_use == ENCODER ? VPU_RST_ENC :
> +				       VPU_RST_DEC);
>  	put_device(&fw->pdev->dev);
>  }
>  
> @@ -120,6 +123,7 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_vpu_init(void *priv, enum mtk_vcodec_fw_use
>  
>  	fw = devm_kzalloc(&plat_dev->dev, sizeof(*fw), GFP_KERNEL);
>  	if (!fw) {
> +		vpu_wdt_unreg_handler(fw_pdev, rst_id);
>  		put_device(&fw_pdev->dev);
>  		return ERR_PTR(-ENOMEM);
>  	}
> diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
> index 8d8319f0cd22..f59f45fecc75 100644
> --- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
> +++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
> @@ -437,6 +437,21 @@ int vpu_wdt_reg_handler(struct platform_device *pdev,
>  }
>  EXPORT_SYMBOL_GPL(vpu_wdt_reg_handler);
>  
> ++void vpu_wdt_unreg_handler(struct platform_device *pdev, enum rst_id id)
> +{
> +	struct mtk_vpu *vpu = platform_get_drvdata(pdev);
> +
> +	if (!vpu || id >= VPU_RST_MAX)
> +		return;
> +
> +	mutex_lock(&vpu->vpu_mutex);
> +	vpu->wdt.handler[id].reset_func = NULL;
> +	vpu->wdt.handler[id].priv = NULL;
> +	mutex_unlock(&vpu->vpu_mutex);
> +}
> +EXPORT_SYMBOL_GPL(vpu_wdt_unreg_handler);
> +
> +
>  unsigned int vpu_get_vdec_hw_capa(struct platform_device *pdev)
>  {
>  	struct mtk_vpu *vpu = platform_get_drvdata(pdev);
> diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.h b/drivers/media/platform/mediatek/vpu/mtk_vpu.h
> index 3951547e9ec5..2ccb481a04cf 100644
> --- a/drivers/media/platform/mediatek/vpu/mtk_vpu.h
> +++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.h
> @@ -141,6 +141,8 @@ int vpu_wdt_reg_handler(struct platform_device *pdev,
>  			void vpu_wdt_reset_func(void *priv),
>  			void *priv, enum rst_id id);
>  
> +void vpu_wdt_unreg_handler(struct platform_device *pdev, enum rst_id id);
> +
>  /**
>   * vpu_get_vdec_hw_capa - get video decoder hardware capability
>   *

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH] media: mediatek: vcodec: unregister VPU watchdog handler

[kernel test robot]

Hi Guangshuo,

kernel test robot noticed the following build errors:

[auto build test ERROR on linuxtv-media-pending/master]
[also build test ERROR on media-tree/master linus/master v7.2-rc6 next-20260803]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Guangshuo-Li/media-mediatek-vcodec-unregister-VPU-watchdog-handler/20260804-140933
base:   https://git.linuxtv.org/media-ci/media-pending.git master
patch link:    https://lore.kernel.org/r/20260708124235.763036-1-lgs201920130244%40gmail.com
patch subject: [PATCH] media: mediatek: vcodec: unregister VPU watchdog handler
config: alpha-allmodconfig (https://download.01.org/0day-ci/archive/20260804/202608041721.qBlQgdnE-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260804/202608041721.qBlQgdnE-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608041721.qBlQgdnE-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/media/platform/mediatek/vpu/mtk_vpu.c:440:1: error: expected identifier or '(' before '+' token
     440 | +void vpu_wdt_unreg_handler(struct platform_device *pdev, enum rst_id id)
         | ^


vim +440 drivers/media/platform/mediatek/vpu/mtk_vpu.c

   439	
 > 440	+void vpu_wdt_unreg_handler(struct platform_device *pdev, enum rst_id id)
   441	{
   442		struct mtk_vpu *vpu = platform_get_drvdata(pdev);
   443	
   444		if (!vpu || id >= VPU_RST_MAX)
   445			return;
   446	
   447		mutex_lock(&vpu->vpu_mutex);
   448		vpu->wdt.handler[id].reset_func = NULL;
   449		vpu->wdt.handler[id].priv = NULL;
   450		mutex_unlock(&vpu->vpu_mutex);
   451	}
   452	EXPORT_SYMBOL_GPL(vpu_wdt_unreg_handler);
   453	
   454	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki