[PATCH] media: staging/ipu7: fix async notifier leak on init error

[PATCH] media: staging/ipu7: fix async notifier leak on init error

[Cong Nguyen]

isys_notifier_init() initialises a v4l2 async notifier and then, for
each CSI-2 port, adds a remote sensor subdev to the notifier's
waiting_list via v4l2_async_nf_add_fwnode_remote(), which allocates a
sensor_async_sd descriptor and takes a fwnode reference.

If parsing or adding a later port fails, the code jumps to the
"err_parse" label, which only drops the current endpoint fwnode
reference and returns, without calling v4l2_async_nf_cleanup(). Any
descriptors already added to the notifier for earlier ports are
therefore leaked, and the caller's error path does not clean up the
notifier either.

Call v4l2_async_nf_cleanup() on the error path, matching the cleanup
already performed when v4l2_async_nf_register() fails. This is safe as
the notifier is always initialised before the loop is entered.

Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device driver")
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
---
 drivers/staging/media/ipu7/ipu7-isys.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/media/ipu7/ipu7-isys.c b/drivers/staging/media/ipu7/ipu7-isys.c
index cb2f49f3e0fa..c626de051898 100644
--- a/drivers/staging/media/ipu7/ipu7-isys.c
+++ b/drivers/staging/media/ipu7/ipu7-isys.c
@@ -233,6 +233,7 @@ static int isys_notifier_init(struct ipu7_isys *isys)
 
 err_parse:
 		fwnode_handle_put(ep);
+		v4l2_async_nf_cleanup(&isys->notifier);
 		return ret;
 	}
 
-- 
2.25.1

Re: [PATCH] media: staging/ipu7: fix async notifier leak on init error

[Sakari Ailus]

Hi Cong,

Thanks for the patch.

On Mon, Jul 27, 2026 at 06:22:39PM +0700, Cong Nguyen wrote:
> isys_notifier_init() initialises a v4l2 async notifier and then, for
> each CSI-2 port, adds a remote sensor subdev to the notifier's
> waiting_list via v4l2_async_nf_add_fwnode_remote(), which allocates a
> sensor_async_sd descriptor and takes a fwnode reference.
> 
> If parsing or adding a later port fails, the code jumps to the
> "err_parse" label, which only drops the current endpoint fwnode
> reference and returns, without calling v4l2_async_nf_cleanup(). Any
> descriptors already added to the notifier for earlier ports are
> therefore leaked, and the caller's error path does not clean up the
> notifier either.
> 
> Call v4l2_async_nf_cleanup() on the error path, matching the cleanup
> already performed when v4l2_async_nf_register() fails. This is safe as
> the notifier is always initialised before the loop is entered.
> 
> Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device driver")
> Signed-off-by: Cong Nguyen <congnt264@gmail.com>

The patch is fine, but there's another issue there, see
<URL:https://linuxtv.org/mailman3/hyperkitty/list/media-ci@linuxtv.org/message/G5DTPKTRTWM5PBTFQJP2HI7T324FZF5D/>.

Feel free to post a patch for that, too.

-- 
Kind regards,

Sakari Ailus

Re: [PATCH] media: staging/ipu7: fix async notifier leak on init error

[Nguyễn Công]

Good catch, thanks. You're right: isys_register_devices() registers the
notifier via isys_notifier_init(), and if isys_fw_log_init() later fails,
out_cleanup only calls isys_unregister_devices(), which never unregisters
or cleans up the notifier. The remove path already does this correctly
(isys_notifier_cleanup() followed by isys_unregister_devices()).

As it's a distinct, pre-existing bug I've sent it as a separate patch
rather than folding it into this one:
https://lore.kernel.org/linux-staging/20260730103754.1480367-1-congnt264@gmail.com/

I kept this patch (the init-error leak fix) unchanged.


On Wed, Jul 29, 2026 at 12:17 AM Sakari Ailus
<sakari.ailus@linux.intel.com> wrote:
>
> Hi Cong,
>
> Thanks for the patch.
>
> On Mon, Jul 27, 2026 at 06:22:39PM +0700, Cong Nguyen wrote:
> > isys_notifier_init() initialises a v4l2 async notifier and then, for
> > each CSI-2 port, adds a remote sensor subdev to the notifier's
> > waiting_list via v4l2_async_nf_add_fwnode_remote(), which allocates a
> > sensor_async_sd descriptor and takes a fwnode reference.
> >
> > If parsing or adding a later port fails, the code jumps to the
> > "err_parse" label, which only drops the current endpoint fwnode
> > reference and returns, without calling v4l2_async_nf_cleanup(). Any
> > descriptors already added to the notifier for earlier ports are
> > therefore leaked, and the caller's error path does not clean up the
> > notifier either.
> >
> > Call v4l2_async_nf_cleanup() on the error path, matching the cleanup
> > already performed when v4l2_async_nf_register() fails. This is safe as
> > the notifier is always initialised before the loop is entered.
> >
> > Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device driver")
> > Signed-off-by: Cong Nguyen <congnt264@gmail.com>
>
> The patch is fine, but there's another issue there, see
> <URL:https://linuxtv.org/mailman3/hyperkitty/list/media-ci@linuxtv.org/message/G5DTPKTRTWM5PBTFQJP2HI7T324FZF5D/>.
>
> Feel free to post a patch for that, too.
>
> --
> Kind regards,
>
> Sakari Ailus