Re: [syzbot] [media?] WARNING in call_s_stream

Nikita Zhandarovich
2025-02-24T15:01:24Z

Test a simple fix for vimc.

Also enable a fix from [1] to combat a KASAN issue in android (?).

[1] https://syzkaller.appspot.com/bug?extid=7015dcf45953112c8b45

#syz test
---
drivers/android/binderfs.c | 1 +
drivers/media/test-drivers/vimc/vimc-streamer.c | 6 ++++++
2 files changed, 7 insertions(+)

diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index bc6bae76ccaf..94c6446604fc 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -274,6 +274,7 @@ static void binderfs_evict_inode(struct inode *inode)
mutex_unlock(&binderfs_minors_mutex);

if (refcount_dec_and_test(&device->ref)) {
+ hlist_del_init(&device->hlist);
kfree(device->context.name);
kfree(device);
}
diff --git a/drivers/media/test-drivers/vimc/vimc-streamer.c b/drivers/media/test-drivers/vimc/vimc-streamer.c
index 807551a5143b..64dd7e0ea5ad 100644
--- a/drivers/media/test-drivers/vimc/vimc-streamer.c
+++ b/drivers/media/test-drivers/vimc/vimc-streamer.c
@@ -59,6 +59,12 @@ static void vimc_streamer_pipeline_terminate(struct vimc_stream *stream)
continue;

sd = media_entity_to_v4l2_subdev(ved->ent);
+ /*
+ * Do not call .s_stream() to stop an already
+ * stopped/unstarted subdev.
+ */
+ if (!sd->s_stream_enabled)
+ continue;
v4l2_subdev_call(sd, video, s_stream, 0);
}
}