[PATCH 0/3] media: imx8-isi: fix resource lifecycle bugs

Xiaolei Wang
2026-04-24T23:20:36Z

This series fixes three resource lifecycle issues in the imx8-isi driver,
all introduced by commit cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver").

Patch 1 fixes a use-after-free on rmmod: mxc_isi_remove() called
crossbar cleanup before v4l2 cleanup, freeing the crossbar pads while
the media framework still needed them to remove links. Fix by swapping
the cleanup order.

Patch 2 fixes a memory leak on rmmod: both crossbar and pipe cleanup
paths were missing v4l2_subdev_cleanup() calls to free the subdev
active state allocated by v4l2_subdev_init_finalize().

Patch 3 fixes resource leaks in probe error paths: the pipes array
allocated with kzalloc_objs() was never freed on failure or remove,
and already-initialized pipes were not cleaned up when a later pipe
init or v4l2 init failed. Fix by switching to devm_kcalloc() and
adding pipe cleanup in the error path.

Xiaolei Wang (3):
media: imx8-isi: fix use-after-free on remove
media: imx8-isi: add missing v4l2_subdev_cleanup() in crossbar and
pipe
media: imx8-isi: fix resource leaks in probe error paths and remove

drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 7 +++++--
drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 +
drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 1 +
3 files changed, 7 insertions(+), 2 deletions(-)

--
2.43.0