From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 913B93D6493 for ; Tue, 30 Jun 2026 09:58:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782813538; cv=none; b=nIYe+BrW6WwyZnbV9bwSVShXRyDmbVen5qHHltWmpiFt0/cCr71w9f78B9/AC07pi5hgPa+F/+uPDwHDIG+tCLS96AHPh9HUHCiIUpWZZwrx1muTa/zzVL1n0jJE3IWUpUSRCeWr5KY3dsfxaaboPmb+G49C2MGdQx8g40FSlsw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782813538; c=relaxed/simple; bh=9qQhuSHrnraxV2wEZtmQUIORoPwLsWK30FJDBQiGRhs=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=td2fzo1LlklGv0uM0DcVJG2q/y3m/ZWDW5+rgFrA4DqkAJcvU5fcq6q6ahmcJG8QQZeGz/fvPDZSBzOIXkd5tQx/BKSj1Rs8N8mDyLruY/dUVnYRuT2b5U6YELgFryl8zHoM2zR+nHm17utTCWU7DnU7ss0dzk/5wwwbCoXsctk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dxA6zHrP; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dxA6zHrP" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2c9c1779fc8so9631415ad.3 for ; Tue, 30 Jun 2026 02:58:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782813537; x=1783418337; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=AuNJ6Khls5W9ANuvEwh0h69IOEnu+WTccUiXg1wsIgI=; b=dxA6zHrPySouqAbUBqaKmNV2MP0xxZ9KJKxdlQ5AEXlGqkOP8eZgRYsEi+O2tLAtTH EbMVk48P+vC/0ViSFvjnFrEXIwc9Wr3jI4f3facFrMbnN6TfnYhIH6yoLqR5+s8x+9sb ySwd1l8NJrJsaPkpqmGMGhHtFrsViLobIhw/TSl7XOZJXTvkxSOYF+ULgbh+ohe36jl+ e1LvIwifzBqpVyKUHl8WMW3vxjdnHTvTx1UHy6Rrog0gAY+h2P7FTQxhhQdL9T/9CUxp jogfVnjiulg7VG65sT+6m0iO0TZd6Drj3lx7t9u7lNWso8Irb0GVoGtHaiT3kPafNdjy t1Lg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782813537; x=1783418337; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=AuNJ6Khls5W9ANuvEwh0h69IOEnu+WTccUiXg1wsIgI=; b=Lv6FlpQq8D9OAOBE2NWX10FeLzWxEUQOK5Jii6Anx4ld/sZ+et2zWSG8CPOJf/shFs IHsBxZOYBlaMzcMAjSBtNR1Zrh8muGk2OyRwjJzZK26jIC8ahrIpVuJSRlyKnaIO1gTr HLNhbK1Qg8FdYyNBkm3iXG4a6dKMbK5IAF6CpV7aiohfnZUjKJEp/30Yz1O8TCotm9ik S8kodpcxF9feEu9sPujlIKMwxHOWz2aoFOcGKBt/NLQxkFDS0iB9rkODb0ROpn9BLqKj RTkh9hdliWEVkjOvTa7k8T+dZa2mKaFX5WAZHdNMxUF4xUiI3a6MiO4134qgoFczS4FI 4C5w== X-Forwarded-Encrypted: i=1; AHgh+RrXomQj+4dO0tSVh4WbV6iP7Brr4Z5tpUQEWr8vHGCUuFcgeRvWLxJc7sHuRygHogE9JQbr9/i+8j7staI=@vger.kernel.org X-Gm-Message-State: AOJu0Yx5U0LiDTTonh3MQWQ/mmnWGBTeQE+Cbsc/qyZ64zBGMbU7vRXb MHq25Dj8BF3206uSIubiXLkVmq5HztyqIWcO6SC2frg/vCfKhPUT2Bwy X-Gm-Gg: AfdE7cmRI+zeAGsoNhrPz6BoNX1RgBS84DWtmMRy2N9WqFznqDEgdZGoV0b8PhTNmiO hFjF3SHqaeknS08yp5gBg1IEg+bjsEYgrw/QTO0ZtcGt5/bmCMkJjW5V7/+VxtVVL0QYrLyNh0K T00gBy4K2asvyugCXUbIBMODZMYRGMU18GBadIKvY98BlKMxVly91cSnE8k7CrpNRGWqbIjN1Uk FFb94eAXDivLnmRPHc+7Tt/OpNQnJSY0pQR2j3ybxnJZz73H1efwz321Er4b4MGW5CUN63lIUfY sqKBGzfBI660O1dlhAMKIrAo5j0x4ojJmvJaLY6MIGjxlYpZqt96GMFMlg01SWA+n6uU0UjKsaf 4GLi4lYNBaolhlkdtg4v1SajfGRdANDPh3zQMv1/Wrt6blx3CUG2JiHz2D2VFAJ021T3L//TZKi NvxUnvAGeB1aj5GjywSq2Zx/s7VQQc+1ooGXDaXrvkY9LLHB2UkwAbLkWi34EtcJUaTxDbbOMQu WqLMxsS1EJNEejPqyefffY= X-Received: by 2002:a17:902:ce0d:b0:2c9:c083:cd3e with SMTP id d9443c01a7336-2ca2ea1750fmr20931925ad.32.1782813536808; Tue, 30 Jun 2026 02:58:56 -0700 (PDT) Received: from fourcolor-Home.. (2001-b011-7010-d7cf-1ecc-f3e6-c652-23d3.dynamic-ip6.hinet.net. [2001:b011:7010:d7cf:1ecc:f3e6:c652:23d3]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ca37a70bf5sm10234455ad.2.2026.06.30.02.58.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 30 Jun 2026 02:58:56 -0700 (PDT) From: Shih-Sheng Yang To: mchehab@kernel.org Cc: hverkuil+cisco@kernel.org, kees@kernel.org, laurent.pinchart+renesas@ideasonboard.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Shih-Sheng Yang Subject: [PATCH v2] media: v4l2-dev: fix media controller registration error handling Date: Tue, 30 Jun 2026 17:58:40 +0800 Message-Id: <20260630095840.1749448-1-yshihsheng@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit __video_register_device() ignores failures from video_register_media_controller(). If media_devnode_create() fails, vdev->intf_devnode remains NULL but the video device is still marked as registered. A later video_unregister_device() reaches v4l2_device_release(), which calls media_devnode_remove() and dereferences the NULL pointer. If media_create_intf_link() fails, video_register_media_controller() removes vdev->intf_devnode but leaves the stale pointer behind. Fix this by propagating video_register_media_controller() failures from __video_register_device(). Since device_register() has already succeeded, unwind the device with device_unregister(). Also make media_devnode_remove() tolerate NULL devnodes and clear vdev->intf_devnode after removing it in the link failure path. Suggested-by: Laurent Pinchart Signed-off-by: Shih-Sheng Yang --- v1: https://lore.kernel.org/r/20260625193916.3562596-1-yshihsheng@gmail.com Changes in v2: - Move the NULL check to media_devnode_remove(). - Use device_unregister() after device_register() has succeeded. - Keep clearing vdev->intf_devnode in the link failure path. drivers/media/mc/mc-entity.c | 3 +++ drivers/media/v4l2-core/v4l2-dev.c | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c index 3fa0bc687851..79f55375e9d6 100644 --- a/drivers/media/mc/mc-entity.c +++ b/drivers/media/mc/mc-entity.c @@ -1563,6 +1563,9 @@ EXPORT_SYMBOL_GPL(media_devnode_create); void media_devnode_remove(struct media_intf_devnode *devnode) { + if (!devnode) + return; + media_remove_intf_links(&devnode->intf); media_gobj_destroy(&devnode->intf.graph_obj); kfree(devnode); diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c index 5516b2bbb08f..56b51d5d49ae 100644 --- a/drivers/media/v4l2-core/v4l2-dev.c +++ b/drivers/media/v4l2-core/v4l2-dev.c @@ -896,6 +896,7 @@ static int video_register_media_controller(struct video_device *vdev) MEDIA_LNK_FL_IMMUTABLE); if (!link) { media_devnode_remove(vdev->intf_devnode); + vdev->intf_devnode = NULL; media_device_unregister_entity(&vdev->entity); return -ENOMEM; } @@ -1092,6 +1093,11 @@ int __video_register_device(struct video_device *vdev, /* Part 5: Register the entity. */ ret = video_register_media_controller(vdev); + if (ret < 0) { + mutex_unlock(&videodev_lock); + device_unregister(&vdev->dev); + return ret; + } /* Part 6: Activate this minor. The char device can now be used. */ set_bit(V4L2_FL_REGISTERED, &vdev->flags); -- 2.34.1