* [PATCH] media: imx-jpeg: avoid double free on video register failure
@ 2026-05-18 13:02 Guangshuo Li
2026-05-25 14:04 ` Mirela Rabulea
0 siblings, 1 reply; 3+ messages in thread
From: Guangshuo Li @ 2026-05-18 13:02 UTC (permalink / raw)
To: Mirela Rabulea, Mauro Carvalho Chehab, Frank Li, Sascha Hauer,
Pengutronix Kernel Team, Fabio Estevam, Hans Verkuil, imx,
linux-media, linux-arm-kernel, linux-kernel
Cc: Guangshuo Li
mxc_jpeg_probe() allocates a video_device with video_device_alloc() and
releases it from the err_vdev_register error path if
video_register_device() fails.
This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:
video_register_device()
-> __video_register_device()
-> device_register() fails
-> put_device(&vdev->dev)
-> v4l2_device_release()
-> vdev->release(vdev)
-> video_device_release(vdev)
mxc_jpeg_probe()
-> err_vdev_register
-> video_device_release(jpeg->dec_vdev)
Use video_device_release_empty() while registering the device so that
registration failure paths do not free jpeg->dec_vdev through
vdev->release(). mxc_jpeg_probe() then releases jpeg->dec_vdev exactly
once from err_vdev_register. Restore video_device_release() after
successful registration so the registered device keeps its normal lifetime
handling.
This issue was found by a static analysis tool I am developing.
Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail•com>
---
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
index b442dcba02e7..fe8a373576ef 100644
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -2943,7 +2943,7 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
jpeg->dec_vdev->fops = &mxc_jpeg_fops;
jpeg->dec_vdev->ioctl_ops = &mxc_jpeg_ioctl_ops;
jpeg->dec_vdev->minor = -1;
- jpeg->dec_vdev->release = video_device_release;
+ jpeg->dec_vdev->release = video_device_release_empty;
jpeg->dec_vdev->lock = &jpeg->lock; /* lock for ioctl serialization */
jpeg->dec_vdev->v4l2_dev = &jpeg->v4l2_dev;
jpeg->dec_vdev->vfl_dir = VFL_DIR_M2M;
@@ -2962,6 +2962,8 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
dev_err(dev, "failed to register video device\n");
goto err_vdev_register;
}
+ jpeg->dec_vdev->release = video_device_release;
+
if (mode == MXC_JPEG_ENCODE)
v4l2_info(&jpeg->v4l2_dev,
"encoder device registered as /dev/video%d (%d,%d)\n",
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] media: imx-jpeg: avoid double free on video register failure
2026-05-18 13:02 [PATCH] media: imx-jpeg: avoid double free on video register failure Guangshuo Li
@ 2026-05-25 14:04 ` Mirela Rabulea
2026-05-26 5:52 ` Guangshuo Li
0 siblings, 1 reply; 3+ messages in thread
From: Mirela Rabulea @ 2026-05-25 14:04 UTC (permalink / raw)
To: Guangshuo Li, Mauro Carvalho Chehab, Frank Li, Sascha Hauer,
Pengutronix Kernel Team, Fabio Estevam, Hans Verkuil, imx,
linux-media, linux-arm-kernel, linux-kernel
> [You don't often get email from lgs201920130244@gmail•com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> Caution: This is an external email. Please take care when clicking links or opening attachments. When in doubt, report the message using the 'Report this email' button
>
>
> mxc_jpeg_probe() allocates a video_device with video_device_alloc() and
> releases it from the err_vdev_register error path if
> video_register_device() fails.
>
> This can double free the video_device when __video_register_device()
> reaches device_register() and that call fails:
>
> video_register_device()
> -> __video_register_device()
> -> device_register() fails
> -> put_device(&vdev->dev)
> -> v4l2_device_release()
> -> vdev->release(vdev)
> -> video_device_release(vdev)
>
> mxc_jpeg_probe()
> -> err_vdev_register
> -> video_device_release(jpeg->dec_vdev)
>
> Use video_device_release_empty() while registering the device so that
> registration failure paths do not free jpeg->dec_vdev through
> vdev->release(). mxc_jpeg_probe() then releases jpeg->dec_vdev exactly
> once from err_vdev_register. Restore video_device_release() after
> successful registration so the registered device keeps its normal lifetime
> handling.
>
> This issue was found by a static analysis tool I am developing.
>
> Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail•com>
Hi Guangshuo,
sorry for the late response, so I assume this patch will be dropped in
favor of a fix in v4l2-core, as per discussions here?:
https://lore.kernel.org/linux-media/20260519090819.1041314-1-lgs201920130244@gmail.com/
Thanks,
Mirela
> ---
> drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> index b442dcba02e7..fe8a373576ef 100644
> --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> @@ -2943,7 +2943,7 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
> jpeg->dec_vdev->fops = &mxc_jpeg_fops;
> jpeg->dec_vdev->ioctl_ops = &mxc_jpeg_ioctl_ops;
> jpeg->dec_vdev->minor = -1;
> - jpeg->dec_vdev->release = video_device_release;
> + jpeg->dec_vdev->release = video_device_release_empty;
> jpeg->dec_vdev->lock = &jpeg->lock; /* lock for ioctl serialization */
> jpeg->dec_vdev->v4l2_dev = &jpeg->v4l2_dev;
> jpeg->dec_vdev->vfl_dir = VFL_DIR_M2M;
> @@ -2962,6 +2962,8 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
> dev_err(dev, "failed to register video device\n");
> goto err_vdev_register;
> }
> + jpeg->dec_vdev->release = video_device_release;
> +
> if (mode == MXC_JPEG_ENCODE)
> v4l2_info(&jpeg->v4l2_dev,
> "encoder device registered as /dev/video%d (%d,%d)\n",
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] media: imx-jpeg: avoid double free on video register failure
2026-05-25 14:04 ` Mirela Rabulea
@ 2026-05-26 5:52 ` Guangshuo Li
0 siblings, 0 replies; 3+ messages in thread
From: Guangshuo Li @ 2026-05-26 5:52 UTC (permalink / raw)
To: Mirela Rabulea
Cc: Mauro Carvalho Chehab, Frank Li, Sascha Hauer,
Pengutronix Kernel Team, Fabio Estevam, Hans Verkuil, imx,
linux-media, linux-arm-kernel, linux-kernel
Hi Mirela,
On Mon, 25 May 2026 at 21:57, Mirela Rabulea <mirela.rabulea@nxp•com> wrote:
>
> > [You don't often get email from lgs201920130244@gmail•com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> >
> > Caution: This is an external email. Please take care when clicking links or opening attachments. When in doubt, report the message using the 'Report this email' button
> >
> >
> > mxc_jpeg_probe() allocates a video_device with video_device_alloc() and
> > releases it from the err_vdev_register error path if
> > video_register_device() fails.
> >
> > This can double free the video_device when __video_register_device()
> > reaches device_register() and that call fails:
> >
> > video_register_device()
> > -> __video_register_device()
> > -> device_register() fails
> > -> put_device(&vdev->dev)
> > -> v4l2_device_release()
> > -> vdev->release(vdev)
> > -> video_device_release(vdev)
> >
> > mxc_jpeg_probe()
> > -> err_vdev_register
> > -> video_device_release(jpeg->dec_vdev)
> >
> > Use video_device_release_empty() while registering the device so that
> > registration failure paths do not free jpeg->dec_vdev through
> > vdev->release(). mxc_jpeg_probe() then releases jpeg->dec_vdev exactly
> > once from err_vdev_register. Restore video_device_release() after
> > successful registration so the registered device keeps its normal lifetime
> > handling.
> >
> > This issue was found by a static analysis tool I am developing.
> >
> > Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail•com>
>
> Hi Guangshuo,
>
> sorry for the late response, so I assume this patch will be dropped in
> favor of a fix in v4l2-core, as per discussions here?:
>
> https://lore.kernel.org/linux-media/20260519090819.1041314-1-lgs201920130244@gmail.com/
>
> Thanks,
>
> Mirela
>
> > ---
> > drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> > index b442dcba02e7..fe8a373576ef 100644
> > --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> > +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
> > @@ -2943,7 +2943,7 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
> > jpeg->dec_vdev->fops = &mxc_jpeg_fops;
> > jpeg->dec_vdev->ioctl_ops = &mxc_jpeg_ioctl_ops;
> > jpeg->dec_vdev->minor = -1;
> > - jpeg->dec_vdev->release = video_device_release;
> > + jpeg->dec_vdev->release = video_device_release_empty;
> > jpeg->dec_vdev->lock = &jpeg->lock; /* lock for ioctl serialization */
> > jpeg->dec_vdev->v4l2_dev = &jpeg->v4l2_dev;
> > jpeg->dec_vdev->vfl_dir = VFL_DIR_M2M;
> > @@ -2962,6 +2962,8 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
> > dev_err(dev, "failed to register video device\n");
> > goto err_vdev_register;
> > }
> > + jpeg->dec_vdev->release = video_device_release;
> > +
> > if (mode == MXC_JPEG_ENCODE)
> > v4l2_info(&jpeg->v4l2_dev,
> > "encoder device registered as /dev/video%d (%d,%d)\n",
> > --
> > 2.43.0
> >
Yes, you are right. Please drop this patch.
As discussed in the related thread, this issue should be fixed in
v4l2-core instead of handling it in the imx-jpeg driver.
Thanks for checking.
Best regards,
Guangshuo
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-26 5:53 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-18 13:02 [PATCH] media: imx-jpeg: avoid double free on video register failure Guangshuo Li
2026-05-25 14:04 ` Mirela Rabulea
2026-05-26 5:52 ` Guangshuo Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox