Re: [PATCH 2/2] media: mc: fix race in media_device_unregister_entity()

[laurent.pinchart@ideasonboard.com]

Hello,

This is an automated reply.

You have sent a patch or bug report that appears to have been generated
by an LLM. The commit message, code and/or problem description show
little to no real understanding of the issue and changes being proposed.

Such patches or reports require a large amount of work to handle. They
rely on maintainers to propose - and often even implement - a proper
design. The probability that the author will learn from the experience
to improve their future contributions is close to zero.

As a result, to make good use of maintainer time and keep the kernel
development process sustainable, your contribution has been rejected.

If you believe the change you proposed is important, take time to study
the problem, learn, and develop a solution without AI assistance.
Answering this e-mail or generating a new version of a patch by feeding
this reply to an LLM will only result in your e-mails being ignored.

Please note that if your patch attempted to address an important
problem, maintainers or other contributors can submit and merge a
similar or entirely different fix without crediting you.

Your contributions to the Linux kernel will be welcome if you genuinely
desire to invest your time and learn.

Thank you,

Laurent's mail bot

On Mon, 02 Nov 2026 19:44:39 +0530, Deepanshu Kartikey <kartikey406@gmail.com> wrote:
> media_device_unregister_entity() checks entity->graph_obj.mdev for NULL
> before taking mdev->graph_mutex, but does not check again afterwards.
> If media_device_unregister() runs concurrently (for example on USB
> disconnect), it unregisters every entity and clears graph_obj.mdev while
> this function waits for the mutex. The waiter then calls
> __media_device_unregister_entity() with a NULL mdev and faults in
> ida_free(&mdev->entity_internal_idx, ...):
> 
>   Oops: general protection fault, KASAN: null-ptr-deref in range
>   [0x00000000000000c8-0x00000000000000cf]
>    ida_free
>    __media_device_unregister_entity
>    media_device_unregister_entity
>    v4l2_device_release
>    v4l2_open
> 
> Re-check graph_obj.mdev under the lock and skip the unregister if the
> entity is already gone.
> 
> Found while testing the fix for the syzbot report at
> https://syzkaller.appspot.com/bug?extid=54648a6c1187a7ef46a6
> 
> Fixes: e2c91d4d78ee ("[media] media-device: get rid of the spinlock")
> Cc: stable@vger.kernel.org
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/media/mc/mc-device.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
> index f8ea7cfe10b2..039ef7d04ac7 100644
> --- a/drivers/media/mc/mc-device.c
> +++ b/drivers/media/mc/mc-device.c
> @@ -674,7 +674,8 @@ void media_device_unregister_entity(struct media_entity *entity)
>  		return;
>  
>  	mutex_lock(&mdev->graph_mutex);
> -	__media_device_unregister_entity(entity);
> +	if (entity->graph_obj.mdev)
> +		__media_device_unregister_entity(entity);
>  	mutex_unlock(&mdev->graph_mutex);
>  }
>  EXPORT_SYMBOL_GPL(media_device_unregister_entity);