From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 11D26C44515 for ; Mon, 20 Jul 2026 08:58:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:To:From:Reply-To: Cc:Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=RUKJxr+1tIy/FI363caVVmoJTRInNyqm1ZI8xlDvLAU=; b=MFsu8dg/PMmjBQun6iGM8eWNiI RGa9IvqnVIm+DP0J47H2tC5w0zTLkPabbe8zQIgWz/dIrpHNKwRRA2EO+Gm/PMp8J+kiRSnoF6yCW nQtesTMPGEukwIolRCE94pGeK+YbTKkel1H80sHS4nY2dhGytfL1WR6SQrbFgQhmAQ0fVoN7p4FW5 iC8eolmGYBPO4mQRK1FH6VFJe+2L9+/qQG0Xd+3LzOJb2+0oFwVPXLzrUM5hDsXGQXbSeDOCsCfIS AydzeYnbM5B/1su7aP2I07o74BBC93LqD/xTDS2+zFWmeXJJThHcyERAsVAyMDwlBGR7rBB6qBItR pBcqorww==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wljpl-00000006G0k-1Zig; Mon, 20 Jul 2026 08:58:45 +0000 Received: from mail-pf1-x433.google.com ([2607:f8b0:4864:20::433]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wljpj-00000006FyS-1PTi for linux-mediatek@lists.infradead.org; Mon, 20 Jul 2026 08:58:44 +0000 Received: by mail-pf1-x433.google.com with SMTP id d2e1a72fcca58-848882fdb18so7019232b3a.0 for ; Mon, 20 Jul 2026 01:58:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784537922; x=1785142722; darn=lists.infradead.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RUKJxr+1tIy/FI363caVVmoJTRInNyqm1ZI8xlDvLAU=; b=kcgJNcX4MPEaKum8phnD3iXK7obGARykhjalw18w9ZNLDW6QN7Kh+TUkEv5hJssDB7 6jG+Pyc9HRYsxumOlr+02Zt8QKcHbdRgCdAUC7GP6t75XUKbfBqhDFh6UaVORhJi2/nI 3dkWJVeNtd2fmtSoAM5ts+RzVbnnNFHkki2RxhI1Jdz1nE9CmdLq7KXx4u1XdRBIJGs1 cCo0He846Sbi2TxRG5L+x/m61Cc9/w7dhDBYFPvfoG1R/Mp9wfJ6BGNghN4UZ3YoVXuW DpASuHgyb5dVAKDmxrQNaJlPxXy0rqpUQ1EdMYZNwBaXUOW4NpSrnObT+KWdx3csLXU1 e6cg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784537922; x=1785142722; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=RUKJxr+1tIy/FI363caVVmoJTRInNyqm1ZI8xlDvLAU=; b=r7TlWURvTKhTzbHlOjEEYXLBEvyUbgEMmFL/66aBv+uoWXx0A5CQtmXIXEYdwjsu12 OSLaYnigeJlmOuN4KS4J8m3AfdpdRtzwvBVszAP6jKKM12pGaKTpD+oKJ9z4RvG5nZPg zv7GHZqGloIyORFjSwTkg+PKU+q87LPAqfB0CLYbf0uvBtNE6DogAyOXF4fKxvzb5XSX blrnstFNzNdex2K5aIpMytNoRfOsTbYUGXkkSk6UTomn/bcA/pG95y0O89XAUJVTJyzt LzIbeUKEunjvXP9MYG28RvByc9SpeEguf5LtrbGYCQ1agLQWZgXGZt30+k68IIoUrHlP 899A== X-Forwarded-Encrypted: i=1; AHgh+Rr9JwbapOh5ZpeUxcDWQeDPu1hdW+PtjcgkVMOa2loxUfPBI+ujkOW4RF/zL4sUQwI1OGMbOLnQoqzHmI+99Q==@lists.infradead.org X-Gm-Message-State: AOJu0YyCTtw0ALYaabvaYZUkl+hMUTK3spIqKW/rNTGieusI8qVxjLiL MV5LyveA9NxBmCnrkvyGuxvRaYKi9CwhoEgfNsqWWO2dT6JGpbqJ+WRD X-Gm-Gg: AfdE7cl+ShoJumWcj6kHGcZ1O2LJwYBzajJbS8fA4hqkNyHaoLPL7FNWosKPvhnFZM7 pqtSZYVIx/JfN0ykLsW6wJQ3llHc6PirBsMH/nGbOhaBVEEtlwbtHHZewnZGdu4Ba+3Id/DB6J9 ctC+2+a54746jHnmT1qWZT+hbP3zMVGv4dZ+m9TCDa7LQhKr66iLr8h5MdHTmadIl495/3RQez3 m2GCgt574fgmICQLBgpH5JR8tgiaOtqLiBubE1IIxXbtWiC18GeWLzM7se+MLOsVK3j81aNpnlD 4E1n6+KT150QghlhF1zbxE7bujmZ3Pd9K95tr7Hqk/d84a1Zn8jA8fxvnGJvJdTLir/1IeJnAu8 E9yJTiibw0NmC8SKsZTehQ1wx4aeJwy6qqq9P0KnDOH7B12j6KAYgJNFXewp40qQLmRs= X-Received: by 2002:a05:6a00:14d1:b0:848:6c37:cd74 with SMTP id d2e1a72fcca58-84c29288282mr13097826b3a.22.1784537922386; Mon, 20 Jul 2026 01:58:42 -0700 (PDT) Received: from lgs.. ([118.193.39.55]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84c2adcc78asm5247901b3a.23.2026.07.20.01.58.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 01:58:41 -0700 (PDT) From: Guangshuo Li To: Minghsiu Tsai , Houlong Wei , Andrew-CT Chen , Mauro Carvalho Chehab , Matthias Brugger , AngeloGioacchino Del Regno , Tiffany Lin , Yunfei Dong , Hans Verkuil , Nicolas Dufresne , Chen-Yu Tsai , Fei Shao , Tomasz Figa , Guangshuo Li , Haoxiang Li , Eizan Miyamoto , Enric Balletbo i Serra , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: [PATCH v2 3/3] media: mtk-mdp: unregister VPU watchdog handler Date: Mon, 20 Jul 2026 16:57:56 +0800 Message-ID: <20260720085756.465667-4-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260720085756.465667-1-lgs201920130244@gmail.com> References: <20260720085756.465667-1-lgs201920130244@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260720_015843_378411_32BDD380 X-CRM114-Status: GOOD ( 12.97 ) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org mtk_mdp_probe() registers the MDP reset handler with the VPU watchdog code and passes the MDP device as the private data. The handler is stored in the VPU device and can outlive the MDP probe or remove path. If probe fails after the handler has been registered, or if the MDP device is removed, the watchdog table can retain a pointer to an MDP object that is about to be released. A later VPU watchdog reset can then call mtk_mdp_reset_handler() with a stale pointer and dereference freed memory while queuing the MDP watchdog work. Unregister the watchdog handler in the probe error path and in the remove path before dropping the VPU device reference. Fixes: ee18fc7b0b95 ("media: mtk-mdp: handle vpu_wdt_reg_handler() errors during probe") Reviewed-by: Nicolas Dufresne Signed-off-by: Guangshuo Li --- drivers/media/platform/mediatek/mdp/mtk_mdp_core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c index 8432833814f3..5ccb7aa925d9 100644 --- a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c +++ b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c @@ -221,6 +221,7 @@ static int mtk_mdp_probe(struct platform_device *pdev) return 0; err_reg_handler: + vpu_wdt_unreg_handler(mdp->vpu_dev, VPU_RST_MDP); platform_device_put(mdp->vpu_dev); err_vpu_get_dev: @@ -254,6 +255,7 @@ static void mtk_mdp_remove(struct platform_device *pdev) pm_runtime_disable(&pdev->dev); vb2_dma_contig_clear_max_seg_size(&pdev->dev); + vpu_wdt_unreg_handler(mdp->vpu_dev, VPU_RST_MDP); platform_device_put(mdp->vpu_dev); mtk_mdp_unregister_m2m_device(mdp); v4l2_device_unregister(&mdp->v4l2_dev); -- 2.43.0