[PATCH v4 0/2] media: amphion: fix VPU core lifetime during teardown

[PATCH v4 0/2] media: amphion: fix VPU core lifetime during teardown

[Myeonghun Pak]

vpu_core_unregister() releases the message FIFO buffer and VPU reference
before draining queued message work. An open video instance can also keep
a pointer to devm-allocated core state while sysfs unbind removes the core
or its parent.

The first patch drains message work before releasing core state. The
second prevents manual unbind on both platform drivers and warns if core
removal encounters a live instance.

Changes in v4:
- Resend through git send-email after the v3 Gmail submission altered
  diff headers and whitespace in transit. No code changes.

Changes in v3:
- Resend with intact diff headers after the v2 mail submission wrapped
  the diff --git lines. No code changes.

Changes in v2:
- Move vpu_core_put_vpu() after the work drain.
- Keep runtime PM and mailbox teardown unchanged.
- Address sysfs unbind in a separate patch.

Myeonghun Pak (2):
  media: amphion: drain message work before releasing core state
  media: amphion: prevent unbind while video instances are open

 drivers/media/platform/amphion/vpu_core.c | 18 +++++++++++-------
 drivers/media/platform/amphion/vpu_drv.c  |  1 +
 2 files changed, 12 insertions(+), 7 deletions(-)


base-commit: 4efa625593e1e9c76346232413997556dea1d89f
-- 
2.53.0

[PATCH v4 1/2] media: amphion: drain message work before releasing core state

[Myeonghun Pak]

vpu_core_unregister() frees core->msg_buffer before cancelling the message
workers, although core->msg_fifo still uses the buffer as its backing
storage. A queued worker can read it after it has been freed.

Drain the core and instance message work first, then release core->vpu
and the FIFO buffer. This follows the ordering in vpu_core_suspend().

Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/media/platform/amphion/vpu_core.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index 85cc4a14f8ed..a0c58ec97a42 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -299,22 +299,23 @@ static void vpu_core_put_vpu(struct vpu_core *core)
 	core->vpu->put_vpu(core->vpu);
 }
 
+static void vpu_core_cancel_work(struct vpu_core *core);
+
 static int vpu_core_unregister(struct device *dev, struct vpu_core *core)
 {
 	list_del_init(&core->list);
 
-	vpu_core_put_vpu(core);
-	core->vpu = NULL;
-	kfree(core->msg_buffer);
-	core->msg_buffer = NULL;
-
 	if (core->workqueue) {
-		cancel_work_sync(&core->msg_work);
-		cancel_delayed_work_sync(&core->msg_delayed_work);
+		vpu_core_cancel_work(core);
 		destroy_workqueue(core->workqueue);
 		core->workqueue = NULL;
 	}
 
+	vpu_core_put_vpu(core);
+	core->vpu = NULL;
+	kfree(core->msg_buffer);
+	core->msg_buffer = NULL;
+
 	return 0;
 }
 
-- 
2.53.0

Re: [PATCH v4 1/2] media: amphion: drain message work before releasing core state

[Ming Qian(OSS)]

On 9/26/2026 3:17 AM, Myeonghun Pak wrote:
> vpu_core_unregister() frees core->msg_buffer before cancelling the message
> workers, although core->msg_fifo still uses the buffer as its backing
> storage. A queued worker can read it after it has been freed.
> 
> Drain the core and instance message work first, then release core->vpu
> and the FIFO buffer. This follows the ordering in vpu_core_suspend().
> 
> Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
> Cc: stable@vger.kernel.org
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>

Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>

> ---
>   drivers/media/platform/amphion/vpu_core.c | 15 ++++++++-------
>   1 file changed, 8 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
> index 85cc4a14f8ed..a0c58ec97a42 100644
> --- a/drivers/media/platform/amphion/vpu_core.c
> +++ b/drivers/media/platform/amphion/vpu_core.c
> @@ -299,22 +299,23 @@ static void vpu_core_put_vpu(struct vpu_core *core)
>   	core->vpu->put_vpu(core->vpu);
>   }
>   
> +static void vpu_core_cancel_work(struct vpu_core *core);
> +
>   static int vpu_core_unregister(struct device *dev, struct vpu_core *core)
>   {
>   	list_del_init(&core->list);
>   
> -	vpu_core_put_vpu(core);
> -	core->vpu = NULL;
> -	kfree(core->msg_buffer);
> -	core->msg_buffer = NULL;
> -
>   	if (core->workqueue) {
> -		cancel_work_sync(&core->msg_work);
> -		cancel_delayed_work_sync(&core->msg_delayed_work);
> +		vpu_core_cancel_work(core);
>   		destroy_workqueue(core->workqueue);
>   		core->workqueue = NULL;
>   	}
>   
> +	vpu_core_put_vpu(core);
> +	core->vpu = NULL;
> +	kfree(core->msg_buffer);
> +	core->msg_buffer = NULL;
> +
>   	return 0;
>   }
>   

[PATCH v4 2/2] media: amphion: prevent unbind while video instances are open

[Myeonghun Pak]

An open video instance holds a plain pointer to its devm-allocated core.
Unbinding the core or its parent through sysfs can release that memory
while the instance remains open. A later ioctl or close then uses the
stale pointer.

The video file operations pin the module, but sysfs unbind bypasses that
protection. Suppress manual bind and unbind for both platform drivers,
and warn if core removal ever encounters a live instance.

Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/media/platform/amphion/vpu_core.c | 3 +++
 drivers/media/platform/amphion/vpu_drv.c  | 1 +
 2 files changed, 4 insertions(+)

diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index a0c58ec97a42..2e8e08e05de7 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -696,6 +696,8 @@ static void vpu_core_remove(struct platform_device *pdev)
 	struct vpu_core *core = platform_get_drvdata(pdev);
 	int ret;
 
+	WARN_ON(!list_empty(&core->instances));
+
 	vpu_core_remove_dbgfs_file(core);
 	ret = pm_runtime_resume_and_get(dev);
 	WARN_ON(ret < 0);
@@ -846,6 +848,7 @@ static struct platform_driver amphion_vpu_core_driver = {
 	.remove = vpu_core_remove,
 	.driver = {
 		.name = "amphion-vpu-core",
+		.suppress_bind_attrs = true,
 		.of_match_table = vpu_core_dt_match,
 		.pm = &vpu_core_pm_ops,
 	},
diff --git a/drivers/media/platform/amphion/vpu_drv.c b/drivers/media/platform/amphion/vpu_drv.c
index 2cca61f41bea..9c6f32c5eae9 100644
--- a/drivers/media/platform/amphion/vpu_drv.c
+++ b/drivers/media/platform/amphion/vpu_drv.c
@@ -205,6 +205,7 @@ static struct platform_driver amphion_vpu_driver = {
 	.remove = vpu_remove,
 	.driver = {
 		.name = "amphion-vpu",
+		.suppress_bind_attrs = true,
 		.of_match_table = vpu_dt_match,
 	},
 };
-- 
2.53.0

Re: [PATCH v4 2/2] media: amphion: prevent unbind while video instances are open

[Ming Qian(OSS)]

On 9/26/2026 3:17 AM, Myeonghun Pak wrote:
> An open video instance holds a plain pointer to its devm-allocated core.
> Unbinding the core or its parent through sysfs can release that memory
> while the instance remains open. A later ioctl or close then uses the
> stale pointer.
> 
> The video file operations pin the module, but sysfs unbind bypasses that
> protection. Suppress manual bind and unbind for both platform drivers,
> and warn if core removal ever encounters a live instance.
> 
> Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
> Cc: stable@vger.kernel.org
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>

Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>

> ---
>   drivers/media/platform/amphion/vpu_core.c | 3 +++
>   drivers/media/platform/amphion/vpu_drv.c  | 1 +
>   2 files changed, 4 insertions(+)
> 
> diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
> index a0c58ec97a42..2e8e08e05de7 100644
> --- a/drivers/media/platform/amphion/vpu_core.c
> +++ b/drivers/media/platform/amphion/vpu_core.c
> @@ -696,6 +696,8 @@ static void vpu_core_remove(struct platform_device *pdev)
>   	struct vpu_core *core = platform_get_drvdata(pdev);
>   	int ret;
>   
> +	WARN_ON(!list_empty(&core->instances));
> +
>   	vpu_core_remove_dbgfs_file(core);
>   	ret = pm_runtime_resume_and_get(dev);
>   	WARN_ON(ret < 0);
> @@ -846,6 +848,7 @@ static struct platform_driver amphion_vpu_core_driver = {
>   	.remove = vpu_core_remove,
>   	.driver = {
>   		.name = "amphion-vpu-core",
> +		.suppress_bind_attrs = true,
>   		.of_match_table = vpu_core_dt_match,
>   		.pm = &vpu_core_pm_ops,
>   	},
> diff --git a/drivers/media/platform/amphion/vpu_drv.c b/drivers/media/platform/amphion/vpu_drv.c
> index 2cca61f41bea..9c6f32c5eae9 100644
> --- a/drivers/media/platform/amphion/vpu_drv.c
> +++ b/drivers/media/platform/amphion/vpu_drv.c
> @@ -205,6 +205,7 @@ static struct platform_driver amphion_vpu_driver = {
>   	.remove = vpu_remove,
>   	.driver = {
>   		.name = "amphion-vpu",
> +		.suppress_bind_attrs = true,
>   		.of_match_table = vpu_dt_match,
>   	},
>   };