Re: [PATCH v2 1/9] media: synopsys: hdmirx: add media device infrastructure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] media: synopsys: hdmirx: UAF on video device close after unbind
--

commit 19fb95033898b3ee8ada95f78f4121a10de2c8c5
Author: Gerald Loacker <gerald.loacker@wolfvision.net>

media: synopsys: hdmirx: add media device infrastructure
    
Initialize the media device to enable integration with HDMI bridge
devices in the video capture pipeline. This provides the foundation
for representing the hardware topology through the media controller
framework.

> diff --git a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
> index 25f8ca0d6d946..f51a1619b71ec 100644
> --- a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
> +++ b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
[ ... ]
> @@ -2771,6 +2778,7 @@ static int hdmirx_probe(struct platform_device *pdev)
>  	vb2_video_unregister_device(&hdmirx_dev->stream.vdev);
>  err_unreg_v4l2_dev:
>  	v4l2_device_unregister(&hdmirx_dev->v4l2_dev);
> +	media_device_cleanup(&hdmirx_dev->mdev);

[Severity: High]
Could this destructively clean up the media device while entities might still
be actively referencing it asynchronously due to open file descriptors?

In the error path of hdmirx_probe(), media_device_cleanup() is called which
destroys mdev->graph_mutex. Then devres automatically frees the
snps_hdmirx_dev structure containing both the video_device and media_device.

If a local user opens /dev/videoX before the probe failure and keeps the
file descriptor open, closing the file descriptor later will cause the V4L2
core to invoke v4l2_device_release().

This accesses the freed vdev structure and attempts to unregister the media
entity, locking the already destroyed and freed mdev->graph_mutex.

>  err_hdl:
>  	v4l2_ctrl_handler_free(&hdmirx_dev->hdl);
>  err_pm:
[ ... ]
> @@ -2794,6 +2802,7 @@ static void hdmirx_remove(struct platform_device *pdev)
>  	vb2_video_unregister_device(&hdmirx_dev->stream.vdev);
>  	v4l2_ctrl_handler_free(&hdmirx_dev->hdl);
>  	v4l2_device_unregister(&hdmirx_dev->v4l2_dev);
> +	media_device_cleanup(&hdmirx_dev->mdev);

[Severity: High]
Does this code trigger a similar race condition when the driver is unbound?

If a local user opens /dev/videoX and keeps the file descriptor open while
the driver is unbound (e.g., via sysfs or hardware removal), hdmirx_remove()
completes and calls media_device_cleanup() which destroys mdev->graph_mutex.

Like in the probe error path, devres will automatically free the
snps_hdmirx_dev structure. Later, when the user closes the file descriptor,
the V4L2 core invokes v4l2_device_release() which will attempt to use the
freed structures.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924-hdmirx-media-v2-0-c12f641d8b0f@pengutronix.de?part=1