From: Mirela Rabulea <mirela.rabulea@nxp•com>
To: Guangshuo Li <lgs201920130244@gmail•com>,
Mauro Carvalho Chehab <mchehab@kernel•org>,
Frank Li <Frank.Li@nxp•com>,
Sascha Hauer <s.hauer@pengutronix•de>,
Pengutronix Kernel Team <kernel@pengutronix•de>,
Fabio Estevam <festevam@gmail•com>,
Hans Verkuil <hverkuil@kernel•org>,
imx@lists•linux.dev, linux-media@vger•kernel.org,
linux-arm-kernel@lists•infradead.org,
linux-kernel@vger•kernel.org
Subject: Re: [PATCH] media: imx-jpeg: avoid double free on video register failure
Date: Mon, 25 May 2026 17:04:42 +0300 [thread overview]
Message-ID: <824d2c59-d355-4f8c-a602-bc08e49d52e1@nxp.com> (raw)
In-Reply-To: <20260518130259.1001956-1-lgs201920130244@gmail.com>
> [You don't often get email from lgs201920130244@gmail•com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> Caution: This is an external email. Please take care when clicking links or opening attachments. When in doubt, report the message using the 'Report this email' button
>
>
> mxc_jpeg_probe() allocates a video_device with video_device_alloc() and
> releases it from the err_vdev_register error path if
> video_register_device() fails.
>
> This can double free the video_device when __video_register_device()
> reaches device_register() and that call fails:
>
> video_register_device()
> -> __video_register_device()
> -> device_register() fails
> -> put_device(&vdev->dev)
> -> v4l2_device_release()
> -> vdev->release(vdev)
> -> video_device_release(vdev)
>
> mxc_jpeg_probe()
> -> err_vdev_register
> -> video_device_release(jpeg->dec_vdev)
>
> Use video_device_release_empty() while registering the device so that
> registration failure paths do not free jpeg->dec_vdev through
> vdev->release(). mxc_jpeg_probe() then releases jpeg->dec_vdev exactly
> once from err_vdev_register. Restore video_device_release() after
> successful registration so the registered device keeps its normal lifetime
> handling.
>
> This issue was found by a static analysis tool I am developing.
>
> Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail•com>
Hi Guangshuo,
sorry for the late response, so I assume this patch will be dropped in
favor of a fix in v4l2-core, as per discussions here?:
https://lore.kernel.org/linux-media/20260519090819.1041314-1-lgs201920130244@gmail.com/
Thanks,
Mirela
> ---
> drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> index b442dcba02e7..fe8a373576ef 100644
> --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> @@ -2943,7 +2943,7 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
> jpeg->dec_vdev->fops = &mxc_jpeg_fops;
> jpeg->dec_vdev->ioctl_ops = &mxc_jpeg_ioctl_ops;
> jpeg->dec_vdev->minor = -1;
> - jpeg->dec_vdev->release = video_device_release;
> + jpeg->dec_vdev->release = video_device_release_empty;
> jpeg->dec_vdev->lock = &jpeg->lock; /* lock for ioctl serialization */
> jpeg->dec_vdev->v4l2_dev = &jpeg->v4l2_dev;
> jpeg->dec_vdev->vfl_dir = VFL_DIR_M2M;
> @@ -2962,6 +2962,8 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
> dev_err(dev, "failed to register video device\n");
> goto err_vdev_register;
> }
> + jpeg->dec_vdev->release = video_device_release;
> +
> if (mode == MXC_JPEG_ENCODE)
> v4l2_info(&jpeg->v4l2_dev,
> "encoder device registered as /dev/video%d (%d,%d)\n",
> --
> 2.43.0
>
next prev parent reply other threads:[~2026-05-25 13:57 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-18 13:02 [PATCH] media: imx-jpeg: avoid double free on video register failure Guangshuo Li
2026-05-25 14:04 ` Mirela Rabulea [this message]
2026-05-26 5:52 ` Guangshuo Li
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=824d2c59-d355-4f8c-a602-bc08e49d52e1@nxp.com \
--to=mirela.rabulea@nxp$(echo .)com \
--cc=Frank.Li@nxp$(echo .)com \
--cc=festevam@gmail$(echo .)com \
--cc=hverkuil@kernel$(echo .)org \
--cc=imx@lists$(echo .)linux.dev \
--cc=kernel@pengutronix$(echo .)de \
--cc=lgs201920130244@gmail$(echo .)com \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-media@vger$(echo .)kernel.org \
--cc=mchehab@kernel$(echo .)org \
--cc=s.hauer@pengutronix$(echo .)de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox