* Re: [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload
2026-01-15 9:22 [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload Tomi Valkeinen
@ 2026-01-15 14:20 ` Jacopo Mondi
2026-01-15 16:14 ` Kieran Bingham
` (2 subsequent siblings)
3 siblings, 0 replies; 9+ messages in thread
From: Jacopo Mondi @ 2026-01-15 14:20 UTC (permalink / raw)
To: Tomi Valkeinen
Cc: Laurent Pinchart, Kieran Bingham, Mauro Carvalho Chehab,
Hans Verkuil, Jacopo Mondi, linux-media, linux-renesas-soc,
linux-kernel, Laurent Pinchart, Tomi Valkeinen
Hi Tomi
On Thu, Jan 15, 2026 at 11:22:35AM +0200, Tomi Valkeinen wrote:
> From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
>
> When unloading the module on gen 4, we hit a NULL pointer dereference.
> This is caused by the cleanup code calling vsp1_drm_cleanup() where it
> should be calling vsp1_vspx_cleanup().
>
> Fix this by checking the IP version and calling the drm or vspx function
> accordingly, the same way as the init code does.
>
> Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support")
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
Thank you! This indeed was not correct
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Thanks
j
> ---
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> ---
> drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/platform/renesas/vsp1/vsp1_drv.c b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> index 6c64657fc4f3..30df9b36642d 100644
> --- a/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> +++ b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> @@ -240,8 +240,12 @@ static void vsp1_destroy_entities(struct vsp1_device *vsp1)
> media_device_unregister(&vsp1->media_dev);
> media_device_cleanup(&vsp1->media_dev);
>
> - if (!vsp1->info->uapi)
> - vsp1_drm_cleanup(vsp1);
> + if (!vsp1->info->uapi) {
> + if (vsp1->info->version == VI6_IP_VERSION_MODEL_VSPX_GEN4)
> + vsp1_vspx_cleanup(vsp1);
> + else
> + vsp1_drm_cleanup(vsp1);
> + }
> }
>
> static int vsp1_create_entities(struct vsp1_device *vsp1)
>
> ---
> base-commit: 7d0a66e4bb9081d75c82ec4957c50034cb0ea449
> change-id: 20260115-rcar-vsp-crash-fix-8d4871f0f39e
>
> Best regards,
> --
> Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
>
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload
2026-01-15 9:22 [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload Tomi Valkeinen
2026-01-15 14:20 ` Jacopo Mondi
@ 2026-01-15 16:14 ` Kieran Bingham
2026-03-11 6:15 ` Tomi Valkeinen
2026-03-18 19:42 ` Laurent Pinchart
3 siblings, 0 replies; 9+ messages in thread
From: Kieran Bingham @ 2026-01-15 16:14 UTC (permalink / raw)
To: Hans Verkuil, Jacopo Mondi, Laurent Pinchart,
Mauro Carvalho Chehab, Tomi Valkeinen
Cc: linux-media, linux-renesas-soc, linux-kernel, Laurent Pinchart,
Tomi Valkeinen, Tomi Valkeinen
Quoting Tomi Valkeinen (2026-01-15 09:22:35)
> From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
>
> When unloading the module on gen 4, we hit a NULL pointer dereference.
> This is caused by the cleanup code calling vsp1_drm_cleanup() where it
> should be calling vsp1_vspx_cleanup().
>
> Fix this by checking the IP version and calling the drm or vspx function
> accordingly, the same way as the init code does.
Looks reasonable to me:
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
>
> Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support")
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
> ---
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> ---
> drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/platform/renesas/vsp1/vsp1_drv.c b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> index 6c64657fc4f3..30df9b36642d 100644
> --- a/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> +++ b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> @@ -240,8 +240,12 @@ static void vsp1_destroy_entities(struct vsp1_device *vsp1)
> media_device_unregister(&vsp1->media_dev);
> media_device_cleanup(&vsp1->media_dev);
>
> - if (!vsp1->info->uapi)
> - vsp1_drm_cleanup(vsp1);
> + if (!vsp1->info->uapi) {
> + if (vsp1->info->version == VI6_IP_VERSION_MODEL_VSPX_GEN4)
> + vsp1_vspx_cleanup(vsp1);
> + else
> + vsp1_drm_cleanup(vsp1);
> + }
> }
>
> static int vsp1_create_entities(struct vsp1_device *vsp1)
>
> ---
> base-commit: 7d0a66e4bb9081d75c82ec4957c50034cb0ea449
> change-id: 20260115-rcar-vsp-crash-fix-8d4871f0f39e
>
> Best regards,
> --
> Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
>
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload
2026-01-15 9:22 [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload Tomi Valkeinen
2026-01-15 14:20 ` Jacopo Mondi
2026-01-15 16:14 ` Kieran Bingham
@ 2026-03-11 6:15 ` Tomi Valkeinen
2026-03-11 9:06 ` Jacopo Mondi
2026-03-18 19:42 ` Laurent Pinchart
3 siblings, 1 reply; 9+ messages in thread
From: Tomi Valkeinen @ 2026-03-11 6:15 UTC (permalink / raw)
To: Laurent Pinchart, Mauro Carvalho Chehab, Hans Verkuil,
Sakari Ailus
Cc: linux-media, linux-renesas-soc, linux-kernel, Laurent Pinchart,
Jacopo Mondi, Kieran Bingham
Hi,
Ping. Would be good to have this fix merged.
Tomi
On 15/01/2026 11:22, Tomi Valkeinen wrote:
> From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
>
> When unloading the module on gen 4, we hit a NULL pointer dereference.
> This is caused by the cleanup code calling vsp1_drm_cleanup() where it
> should be calling vsp1_vspx_cleanup().
>
> Fix this by checking the IP version and calling the drm or vspx function
> accordingly, the same way as the init code does.
>
> Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support")
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
> ---
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> ---
> drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/platform/renesas/vsp1/vsp1_drv.c b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> index 6c64657fc4f3..30df9b36642d 100644
> --- a/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> +++ b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> @@ -240,8 +240,12 @@ static void vsp1_destroy_entities(struct vsp1_device *vsp1)
> media_device_unregister(&vsp1->media_dev);
> media_device_cleanup(&vsp1->media_dev);
>
> - if (!vsp1->info->uapi)
> - vsp1_drm_cleanup(vsp1);
> + if (!vsp1->info->uapi) {
> + if (vsp1->info->version == VI6_IP_VERSION_MODEL_VSPX_GEN4)
> + vsp1_vspx_cleanup(vsp1);
> + else
> + vsp1_drm_cleanup(vsp1);
> + }
> }
>
> static int vsp1_create_entities(struct vsp1_device *vsp1)
>
> ---
> base-commit: 7d0a66e4bb9081d75c82ec4957c50034cb0ea449
> change-id: 20260115-rcar-vsp-crash-fix-8d4871f0f39e
>
> Best regards,
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload
2026-03-11 6:15 ` Tomi Valkeinen
@ 2026-03-11 9:06 ` Jacopo Mondi
2026-03-11 9:07 ` Tomi Valkeinen
0 siblings, 1 reply; 9+ messages in thread
From: Jacopo Mondi @ 2026-03-11 9:06 UTC (permalink / raw)
To: Tomi Valkeinen
Cc: Laurent Pinchart, Mauro Carvalho Chehab, Hans Verkuil,
Sakari Ailus, linux-media, linux-renesas-soc, linux-kernel,
Laurent Pinchart, Jacopo Mondi, Kieran Bingham
Hi Tomi
I intend to send out soon a series for other Renesas components
which shouldn't be controversial. If I can get tags quickly I intend
to send a pull request for v7.0 next week.
I can include this patch and your other one which I don't see collected yet:
[PATCH] media: renesas: vin: Fix RAW8 (again)
unless someone else intends to handle it.
On Wed, Mar 11, 2026 at 08:15:43AM +0200, Tomi Valkeinen wrote:
> Hi,
>
> Ping. Would be good to have this fix merged.
>
> Tomi
>
> On 15/01/2026 11:22, Tomi Valkeinen wrote:
> > From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
> >
> > When unloading the module on gen 4, we hit a NULL pointer dereference.
> > This is caused by the cleanup code calling vsp1_drm_cleanup() where it
> > should be calling vsp1_vspx_cleanup().
> >
> > Fix this by checking the IP version and calling the drm or vspx function
> > accordingly, the same way as the init code does.
> >
> > Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support")
> > Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
> > ---
> > Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> > ---
> > drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 ++++++--
> > 1 file changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/media/platform/renesas/vsp1/vsp1_drv.c b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> > index 6c64657fc4f3..30df9b36642d 100644
> > --- a/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> > +++ b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> > @@ -240,8 +240,12 @@ static void vsp1_destroy_entities(struct vsp1_device *vsp1)
> > media_device_unregister(&vsp1->media_dev);
> > media_device_cleanup(&vsp1->media_dev);
> >
> > - if (!vsp1->info->uapi)
> > - vsp1_drm_cleanup(vsp1);
> > + if (!vsp1->info->uapi) {
> > + if (vsp1->info->version == VI6_IP_VERSION_MODEL_VSPX_GEN4)
> > + vsp1_vspx_cleanup(vsp1);
> > + else
> > + vsp1_drm_cleanup(vsp1);
> > + }
> > }
> >
> > static int vsp1_create_entities(struct vsp1_device *vsp1)
> >
> > ---
> > base-commit: 7d0a66e4bb9081d75c82ec4957c50034cb0ea449
> > change-id: 20260115-rcar-vsp-crash-fix-8d4871f0f39e
> >
> > Best regards,
>
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload
2026-03-11 9:06 ` Jacopo Mondi
@ 2026-03-11 9:07 ` Tomi Valkeinen
2026-03-11 9:17 ` Sakari Ailus
0 siblings, 1 reply; 9+ messages in thread
From: Tomi Valkeinen @ 2026-03-11 9:07 UTC (permalink / raw)
To: Jacopo Mondi
Cc: Laurent Pinchart, Mauro Carvalho Chehab, Hans Verkuil,
Sakari Ailus, linux-media, linux-renesas-soc, linux-kernel,
Laurent Pinchart, Jacopo Mondi, Kieran Bingham
Hi,
On 11/03/2026 11:06, Jacopo Mondi wrote:
> Hi Tomi
>
> I intend to send out soon a series for other Renesas components
> which shouldn't be controversial. If I can get tags quickly I intend
> to send a pull request for v7.0 next week.
>
> I can include this patch and your other one which I don't see collected yet:
> [PATCH] media: renesas: vin: Fix RAW8 (again)
>
> unless someone else intends to handle it.
Sounds fine to me.
Tomi
>
> On Wed, Mar 11, 2026 at 08:15:43AM +0200, Tomi Valkeinen wrote:
>> Hi,
>>
>> Ping. Would be good to have this fix merged.
>>
>> Tomi
>>
>> On 15/01/2026 11:22, Tomi Valkeinen wrote:
>>> From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
>>>
>>> When unloading the module on gen 4, we hit a NULL pointer dereference.
>>> This is caused by the cleanup code calling vsp1_drm_cleanup() where it
>>> should be calling vsp1_vspx_cleanup().
>>>
>>> Fix this by checking the IP version and calling the drm or vspx function
>>> accordingly, the same way as the init code does.
>>>
>>> Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support")
>>> Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
>>> ---
>>> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
>>> ---
>>> drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 ++++++--
>>> 1 file changed, 6 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/drivers/media/platform/renesas/vsp1/vsp1_drv.c b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
>>> index 6c64657fc4f3..30df9b36642d 100644
>>> --- a/drivers/media/platform/renesas/vsp1/vsp1_drv.c
>>> +++ b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
>>> @@ -240,8 +240,12 @@ static void vsp1_destroy_entities(struct vsp1_device *vsp1)
>>> media_device_unregister(&vsp1->media_dev);
>>> media_device_cleanup(&vsp1->media_dev);
>>>
>>> - if (!vsp1->info->uapi)
>>> - vsp1_drm_cleanup(vsp1);
>>> + if (!vsp1->info->uapi) {
>>> + if (vsp1->info->version == VI6_IP_VERSION_MODEL_VSPX_GEN4)
>>> + vsp1_vspx_cleanup(vsp1);
>>> + else
>>> + vsp1_drm_cleanup(vsp1);
>>> + }
>>> }
>>>
>>> static int vsp1_create_entities(struct vsp1_device *vsp1)
>>>
>>> ---
>>> base-commit: 7d0a66e4bb9081d75c82ec4957c50034cb0ea449
>>> change-id: 20260115-rcar-vsp-crash-fix-8d4871f0f39e
>>>
>>> Best regards,
>>
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload
2026-03-11 9:07 ` Tomi Valkeinen
@ 2026-03-11 9:17 ` Sakari Ailus
2026-03-18 19:46 ` Laurent Pinchart
0 siblings, 1 reply; 9+ messages in thread
From: Sakari Ailus @ 2026-03-11 9:17 UTC (permalink / raw)
To: Tomi Valkeinen
Cc: Jacopo Mondi, Laurent Pinchart, Mauro Carvalho Chehab,
Hans Verkuil, linux-media, linux-renesas-soc, linux-kernel,
Laurent Pinchart, Jacopo Mondi, Kieran Bingham
On Wed, Mar 11, 2026 at 11:07:50AM +0200, Tomi Valkeinen wrote:
> Hi,
>
> On 11/03/2026 11:06, Jacopo Mondi wrote:
> > Hi Tomi
> >
> > I intend to send out soon a series for other Renesas components
> > which shouldn't be controversial. If I can get tags quickly I intend
> > to send a pull request for v7.0 next week.
> >
> > I can include this patch and your other one which I don't see collected yet:
> > [PATCH] media: renesas: vin: Fix RAW8 (again)
> >
> > unless someone else intends to handle it.
>
> Sounds fine to me.
Both are already in my tree.
--
Sakari Ailus
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload
2026-03-11 9:17 ` Sakari Ailus
@ 2026-03-18 19:46 ` Laurent Pinchart
0 siblings, 0 replies; 9+ messages in thread
From: Laurent Pinchart @ 2026-03-18 19:46 UTC (permalink / raw)
To: Sakari Ailus
Cc: Tomi Valkeinen, Jacopo Mondi, Mauro Carvalho Chehab, Hans Verkuil,
linux-media, linux-renesas-soc, linux-kernel, Jacopo Mondi,
Kieran Bingham
Hi Sakari,
On Wed, Mar 11, 2026 at 11:17:40AM +0200, Sakari Ailus wrote:
> On Wed, Mar 11, 2026 at 11:07:50AM +0200, Tomi Valkeinen wrote:
> > On 11/03/2026 11:06, Jacopo Mondi wrote:
> > > Hi Tomi
> > >
> > > I intend to send out soon a series for other Renesas components
> > > which shouldn't be controversial. If I can get tags quickly I intend
> > > to send a pull request for v7.0 next week.
> > >
> > > I can include this patch and your other one which I don't see collected yet:
> > > [PATCH] media: renesas: vin: Fix RAW8 (again)
> > >
> > > unless someone else intends to handle it.
> >
> > Sounds fine to me.
>
> Both are already in my tree.
I have more patches for vsp1 for the next release. I notice that your
last pull request was just one day before you replied you took it in
your tree. Will you send another pull request for v7.1 with this patch ?
Otherwise I can include it in mine.
--
Regards,
Laurent Pinchart
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload
2026-01-15 9:22 [PATCH] media: renesas: vsp1: Fix NULL pointer deref on module unload Tomi Valkeinen
` (2 preceding siblings ...)
2026-03-11 6:15 ` Tomi Valkeinen
@ 2026-03-18 19:42 ` Laurent Pinchart
3 siblings, 0 replies; 9+ messages in thread
From: Laurent Pinchart @ 2026-03-18 19:42 UTC (permalink / raw)
To: Tomi Valkeinen
Cc: Kieran Bingham, Mauro Carvalho Chehab, Hans Verkuil, Jacopo Mondi,
linux-media, linux-renesas-soc, linux-kernel, Tomi Valkeinen
On Thu, Jan 15, 2026 at 11:22:35AM +0200, Tomi Valkeinen wrote:
> From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
>
> When unloading the module on gen 4, we hit a NULL pointer dereference.
> This is caused by the cleanup code calling vsp1_drm_cleanup() where it
> should be calling vsp1_vspx_cleanup().
>
> Fix this by checking the IP version and calling the drm or vspx function
> accordingly, the same way as the init code does.
>
> Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support")
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> ---
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
One SoB is enough :-)
> ---
> drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/platform/renesas/vsp1/vsp1_drv.c b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> index 6c64657fc4f3..30df9b36642d 100644
> --- a/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> +++ b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
> @@ -240,8 +240,12 @@ static void vsp1_destroy_entities(struct vsp1_device *vsp1)
> media_device_unregister(&vsp1->media_dev);
> media_device_cleanup(&vsp1->media_dev);
>
> - if (!vsp1->info->uapi)
> - vsp1_drm_cleanup(vsp1);
> + if (!vsp1->info->uapi) {
> + if (vsp1->info->version == VI6_IP_VERSION_MODEL_VSPX_GEN4)
> + vsp1_vspx_cleanup(vsp1);
> + else
> + vsp1_drm_cleanup(vsp1);
> + }
> }
>
> static int vsp1_create_entities(struct vsp1_device *vsp1)
>
> ---
> base-commit: 7d0a66e4bb9081d75c82ec4957c50034cb0ea449
> change-id: 20260115-rcar-vsp-crash-fix-8d4871f0f39e
--
Regards,
Laurent Pinchart
^ permalink raw reply [flat|nested] 9+ messages in thread