Re: [PATCH] media: i2c: ov02c10: Fix race condition in remove and relax reset timings

[Hans de Goede <hansg@kernel.org>]

Hi,

On 24-Jan-26 08:43, Saikiran wrote:
> The ov02c10_remove() function has a race condition where v4l2_ctrl_handler
> and media_entity resources are freed before the device is powered off.
> If userspace (e.g., PipeWire/WirePlumber) accesses the device during
> removal, this causes a Use-After-Free leading to kernel oops with
> "Execute from non-executable memory" errors.
> 
> Fix by reordering cleanup: disable runtime PM and power off the device
> BEFORE freeing v4l2_ctrl_handler and media_entity resources.
> 
> Additionally, relax reset timings to prevent CCI I2C timeout errors.
> The sensor microcontroller occasionally fails to boot within the
> original timing windows, causing "master 1 queue 0 timeout" errors:
> - Assert reset delay: 2ms → 5ms
> - Post-reset boot delay: 5ms → 20ms
> 
> These two fixes address different but related stability issues that
> manifest during camera initialization and removal.
> 
> Tested-on: Lenovo Yoga Slim 7x (Snapdragon X Elite)
> Signed-off-by: Saikiran <bjsaikiran@gmail.com>

Please split this into 2 separate patches, 1 for the reset
timing change and one for moving the cleanup to after
the poweroff.

Regards,

Hans



> ---
>  drivers/media/i2c/ov02c10.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/media/i2c/ov02c10.c b/drivers/media/i2c/ov02c10.c
> index cf93d36032e1..b86cae3d2b74 100644
> --- a/drivers/media/i2c/ov02c10.c
> +++ b/drivers/media/i2c/ov02c10.c
> @@ -692,9 +692,9 @@ static int ov02c10_power_on(struct device *dev)
>  
>  	if (ov02c10->reset) {
>  		/* Assert reset for at least 2ms on back to back off-on */
> -		usleep_range(2000, 2200);
> +		usleep_range(5000, 5500);
>  		gpiod_set_value_cansleep(ov02c10->reset, 0);
> -		usleep_range(5000, 5100);
> +		usleep_range(20000, 21000);
>  	}
>  
>  	return 0;
> @@ -864,14 +864,14 @@ static void ov02c10_remove(struct i2c_client *client)
>  	struct ov02c10 *ov02c10 = to_ov02c10(sd);
>  
>  	v4l2_async_unregister_subdev(sd);
> -	v4l2_subdev_cleanup(sd);
> -	media_entity_cleanup(&sd->entity);
> -	v4l2_ctrl_handler_free(sd->ctrl_handler);
>  	pm_runtime_disable(ov02c10->dev);
>  	if (!pm_runtime_status_suspended(ov02c10->dev)) {
>  		ov02c10_power_off(ov02c10->dev);
>  		pm_runtime_set_suspended(ov02c10->dev);
>  	}
> +	v4l2_subdev_cleanup(sd);
> +	media_entity_cleanup(&sd->entity);
> +	v4l2_ctrl_handler_free(sd->ctrl_handler);
>  }
>  
>  static int ov02c10_probe(struct i2c_client *client)