From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 91E863C1080 for ; Wed, 8 Jul 2026 12:42:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783514570; cv=none; b=Tw9t7rwEW3QRmXckWiJi/oHCH5y62n24N+Eu6Htb6f6o3tpPmbISOd2Ekr8Uu9edUSu7ribLtdRyon3EAOrRniiQVg2DRV4sDhPpgb8sh3IlEvke0IP+f+9LCnZ7yQLGXqdgZWISl+ivp7vqIiXZX7l5kcDjSCjNWcY+tu8levc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783514570; c=relaxed/simple; bh=4Q7/tbUDulKiSLcXZsYlVZ442AGYNyingp0ky/+PJA0=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=CJxoO3bO8K+dAizeX/eXwkYu2h4saFIYRZsZBnF0bT0KOiF4sNF+lTsqRFnee7GZvp23qA+u4UvByIO4GRMZQZinRHocvl05nhjDDVqEqoxMJrTjshfY4pb3qVjPpSxQjbnuQ95UKa8HWVWO4+J0ll2689HQAmI3mMttMQr7/mY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=h3H2Td5p; arc=none smtp.client-ip=209.85.210.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="h3H2Td5p" Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-8478fe07f65so635007b3a.0 for ; Wed, 08 Jul 2026 05:42:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783514569; x=1784119369; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=FeTFZKGeXcKtdGzHWtUv5E1DeHN3B2mS7xb47BxMxw0=; b=h3H2Td5pJOhyeG0DiSBuRwdEnm0VRWzIdBd1I7OmjBoWz5kieaY5ZVeZIVcqR4g1nX yv3A8+bv3Ug9rQuAni7MMP2gEFX3WzWLq48enaGq/f6FMtXSFLaNfCF3cjO3OnpizkhE 7Gp2pJmRCNOYoAC3fGdJEqDuBGE7hgSBJ/koubZEcFluxY4cfX8QcaWxEFRQb/rczjdX Cm1QHQ6pXaXRFlhijQ0I6wqqRB9WecktRkbHZN335wQti+PubYMm65BFNA8tzuUjwQaF 14+9gQ32s5Y+i3xriQUdAb6lB0TsYdNZ8U0OSkVTYe3u2Q1mMCBA5nYKCPk6C6DzziOv c0ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783514569; x=1784119369; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=FeTFZKGeXcKtdGzHWtUv5E1DeHN3B2mS7xb47BxMxw0=; b=GAhHeudpBnLxRIsMZvsp9Mgzj/cTMdhxqUDu8F+hKobTBjINwwQ0iUraloWhj9Yfqy 8rMXq36BFZHGtSHgSoxpD/kOQZRUy3b19j47KDwXqJQ6Jz5dxxpqg1Jkvrbortn9c1Zr 1sTpQ0vw1th/kWTxqwNimhjB7kmjDcvjnM5bdo7suDnpVvChXJgAqPUBB16oX9m//SeO 1/nBMugPle9taS5OfWNaralA2g+GzjiHYxrhmxq0GYg61iRBQSzoBXmxmLs8EuhNoxwl eHxHaHamqrXof8htatpumuYoWa6tZEAMAujKFJVGg89Qu/WkKnznYx1dJNXAa+pZuarm PcaQ== X-Forwarded-Encrypted: i=1; AHgh+Ro5jikMWsLPwYrbT9Qrs1O7TxT4JCvY/T87QbzDudY6dMMnU7xakxgiamGpS2JHkIVoGUdVQMXeAtXcKjE=@vger.kernel.org X-Gm-Message-State: AOJu0Yyts/vZ8La2b3wGZglie4fwvvkQ1XYL+lwvIA+Y29fSn8fVU5sv 4gPFjS59fXuPnbAfOLvL5QCiJG/TDHvT+O8tdaj3u0cDoh4fmzB19sfW X-Gm-Gg: AfdE7cnoahis1pTHByqBS8EiE1XGRDT9GZV+pfkXDAuJvLuDOkHfyAF3zsOqCslcr47 t4OSxaPQj7B9VfHUW0+n+5fiFzsfpcSSsSEWxL0xY6dxHzfS50GxX51x1RhvearKuZxF0iNi36r pHW4z577YEkf6xZlQN6+aM0AHongTvSNd+dFr038nZ7KJEsPq6DCyakpGMyzzPmI7MMQsVNrmuG KsEAa8aa/GcU5XZ15QD13lKxvdY4MnENPFQD2hoJjFcz75pZT93BiwIOUJ1K2YtzqgIdWO2lRaI W3h0gwDBFK1BUge5sdJ08OtjqmdFJ2EBbXhp5qaCkKSN4XpWQ+nY20gTYWkHM7lqPIdWp7Gz40f OfLp58Yntt9NwNRw0glm9QG0iAf6gVluGLCc/9SjWJy0JyEmDiQpwB2Ylp4MmNNRI/jCECFJB+v n+Rw== X-Received: by 2002:a05:6a00:3021:b0:847:8b1d:22fe with SMTP id d2e1a72fcca58-8484341100bmr2523607b3a.50.1783514568759; Wed, 08 Jul 2026 05:42:48 -0700 (PDT) Received: from lgs.. ([101.36.106.88]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847f6d7c2casm6963729b3a.43.2026.07.08.05.42.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Jul 2026 05:42:48 -0700 (PDT) From: Guangshuo Li To: Tiffany Lin , Andrew-CT Chen , Yunfei Dong , Mauro Carvalho Chehab , Matthias Brugger , AngeloGioacchino Del Regno , Minghsiu Tsai , Houlong Wei , Nicolas Dufresne , Hans Verkuil , Tomasz Figa , Guangshuo Li , Chen-Yu Tsai , Haoxiang Li , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: [PATCH] media: mediatek: vcodec: unregister VPU watchdog handler Date: Wed, 8 Jul 2026 20:42:35 +0800 Message-ID: <20260708124235.763036-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit mtk_vcodec_fw_vpu_init() registers a VPU watchdog reset handler and passes the vcodec device as the private data. The handler is stored in the VPU device and can outlive the vcodec device. If firmware initialization fails after the handler has been registered, or if the vcodec device is later removed, the VPU watchdog table can keep a pointer to a vcodec device that is about to be released. A later VPU watchdog reset can then call the reset handler with a stale pointer and dereference freed memory while walking the vcodec context list. Add a VPU watchdog unregister helper and clear the vcodec watchdog handler from both the firmware initialization failure path and the VPU firmware release path before dropping the VPU device reference. Fixes: 01abf5fbb081 ("media: mediatek: vcodec: separate struct 'mtk_vcodec_ctx'") Signed-off-by: Guangshuo Li --- .../mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 4 ++++ drivers/media/platform/mediatek/vpu/mtk_vpu.c | 15 +++++++++++++++ drivers/media/platform/mediatek/vpu/mtk_vpu.h | 2 ++ 3 files changed, 21 insertions(+) diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c index 3632037f78f5..c79a78c371ea 100644 --- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c @@ -40,6 +40,9 @@ static int mtk_vcodec_vpu_ipi_send(struct mtk_vcodec_fw *fw, int id, void *buf, static void mtk_vcodec_vpu_release(struct mtk_vcodec_fw *fw) { + vpu_wdt_unreg_handler(fw->pdev, + fw->fw_use == ENCODER ? VPU_RST_ENC : + VPU_RST_DEC); put_device(&fw->pdev->dev); } @@ -120,6 +123,7 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_vpu_init(void *priv, enum mtk_vcodec_fw_use fw = devm_kzalloc(&plat_dev->dev, sizeof(*fw), GFP_KERNEL); if (!fw) { + vpu_wdt_unreg_handler(fw_pdev, rst_id); put_device(&fw_pdev->dev); return ERR_PTR(-ENOMEM); } diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c index 8d8319f0cd22..f59f45fecc75 100644 --- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c +++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c @@ -437,6 +437,21 @@ int vpu_wdt_reg_handler(struct platform_device *pdev, } EXPORT_SYMBOL_GPL(vpu_wdt_reg_handler); ++void vpu_wdt_unreg_handler(struct platform_device *pdev, enum rst_id id) +{ + struct mtk_vpu *vpu = platform_get_drvdata(pdev); + + if (!vpu || id >= VPU_RST_MAX) + return; + + mutex_lock(&vpu->vpu_mutex); + vpu->wdt.handler[id].reset_func = NULL; + vpu->wdt.handler[id].priv = NULL; + mutex_unlock(&vpu->vpu_mutex); +} +EXPORT_SYMBOL_GPL(vpu_wdt_unreg_handler); + + unsigned int vpu_get_vdec_hw_capa(struct platform_device *pdev) { struct mtk_vpu *vpu = platform_get_drvdata(pdev); diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.h b/drivers/media/platform/mediatek/vpu/mtk_vpu.h index 3951547e9ec5..2ccb481a04cf 100644 --- a/drivers/media/platform/mediatek/vpu/mtk_vpu.h +++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.h @@ -141,6 +141,8 @@ int vpu_wdt_reg_handler(struct platform_device *pdev, void vpu_wdt_reset_func(void *priv), void *priv, enum rst_id id); +void vpu_wdt_unreg_handler(struct platform_device *pdev, enum rst_id id); + /** * vpu_get_vdec_hw_capa - get video decoder hardware capability * -- 2.43.0