[PATCH] media: atmel-isi: release unregistered video device on remove

[PATCH] media: atmel-isi: release unregistered video device on remove

[Guangshuo Li]

atmel_isi_probe() allocates the video device before registering the
V4L2 async notifier. The video device is registered later from the
notifier complete callback once the remote subdevice has been bound.

The remove path relies on the notifier unbind callback to unregister
the video device. However, if the remote subdevice is never bound, or
the complete callback fails before video_register_device() succeeds,
the video device remains unregistered. In that case the unbind path
does not release the object allocated by video_device_alloc(), and the
remove path leaks it.

Only unregister the video device from the unbind callback when it has
actually been registered, and clear the driver pointer afterwards.
After unregistering and cleaning up the notifier, release the video
device directly if the pointer is still present. This covers devices
that were allocated but never registered while avoiding a second
release of successfully registered devices.

This issue was found by manual code inspection.

Fixes: d12c9088c0b2a ("[media] atmel-isi: remove dependency of the soc-camera framework")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/platform/atmel/atmel-isi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/atmel/atmel-isi.c b/drivers/media/platform/atmel/atmel-isi.c
index a05a744cbb75..6a7e240c5b18 100644
--- a/drivers/media/platform/atmel/atmel-isi.c
+++ b/drivers/media/platform/atmel/atmel-isi.c
@@ -1121,10 +1121,13 @@ static void isi_graph_notify_unbind(struct v4l2_async_notifier *notifier,
 {
 	struct atmel_isi *isi = notifier_to_isi(notifier);
 
+	if (!video_is_registered(isi->vdev))
+		return;
+
 	dev_dbg(isi->dev, "Removing %s\n", video_device_node_name(isi->vdev));
 
-	/* Checks internally if vdev have been init or not */
 	video_unregister_device(isi->vdev);
+	isi->vdev = NULL;
 }
 
 static int isi_graph_notify_bound(struct v4l2_async_notifier *notifier,
@@ -1323,6 +1326,8 @@ static void atmel_isi_remove(struct platform_device *pdev)
 	pm_runtime_disable(&pdev->dev);
 	v4l2_async_nf_unregister(&isi->notifier);
 	v4l2_async_nf_cleanup(&isi->notifier);
+	if (isi->vdev)
+		video_device_release(isi->vdev);
 	v4l2_device_unregister(&isi->v4l2_dev);
 }
 
-- 
2.43.0

Re: [PATCH] media: atmel-isi: release unregistered video device on remove

[Eugen Hristev]

On 9/15/26 14:25, Guangshuo Li wrote:
> atmel_isi_probe() allocates the video device before registering the
> V4L2 async notifier. The video device is registered later from the
> notifier complete callback once the remote subdevice has been bound.
> 
> The remove path relies on the notifier unbind callback to unregister
> the video device. However, if the remote subdevice is never bound, or
> the complete callback fails before video_register_device() succeeds,
> the video device remains unregistered. In that case the unbind path
> does not release the object allocated by video_device_alloc(), and the
> remove path leaks it.
> 
> Only unregister the video device from the unbind callback when it has
> actually been registered, and clear the driver pointer afterwards.
> After unregistering and cleaning up the notifier, release the video
> device directly if the pointer is still present. This covers devices
> that were allocated but never registered while avoiding a second
> release of successfully registered devices.
> 
> This issue was found by manual code inspection.
> 
> Fixes: d12c9088c0b2a ("[media] atmel-isi: remove dependency of the soc-camera framework")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
Reviewed-by: Eugen Hristev <ehristev@kernel.org>