From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 24CA8369D5D for ; Sat, 8 Aug 2026 11:17:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786187859; cv=none; b=V5zmz91sz6e8DAlt+e7z3uoloaJRYE1q6CdVtBBtiS09DGtD7izO3QD9nJNg5e1He6SEwoLpnPfRPWxnkqqk9sii703upeB1cgqa17Xw6DoNsl2ZerD8LIdESFvUADeetiKkjs641gAjPiawrKIGl2jBmeF3tbzLzP5r2vms3p8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786187859; c=relaxed/simple; bh=ON1kS1no0SPn9XlGXhFU53i+x3fCGvAcs6uB4rd1MZ8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=U8b2/1ls/50ala7y1k1Uc1KBwTFHFh3F8787zd5tVTFcFj+p2Ou43tmD9Ef+zIWz/vb7Yfh6X9I/VKEI8nnu7g9jEelzBKMR1pW0r/uc9CrYzGD5z9LeK/+Jz0CNkSEgG5d3m3sCh6x5Ee5ZjPMhub0a2oKzPUg0umdNtdlf+5U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=pUzWV/cE; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="pUzWV/cE" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38ea87caafeso236212a91.3 for ; Sat, 08 Aug 2026 04:17:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786187857; x=1786792657; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3Vav1/IZDRyi5TmIe+ztFcmW7gzOkBU4RfYMZP3HSBU=; b=pUzWV/cEKxVtYw6+fECFaQXltF9VwTzQXLEtd/vTMo6iBvLinHEm6zUtwoC5W6Mdjs tPPs+gEmfGmWhRx0jCMao1v/QmMt3dDXBIHTpVUl5UFrtRdaM4Kpr2DUgu5sbF0ZRL1m mj2XaK16tfsGb6WndGRmDljrxRrdc2j3EmxWA1GyI6Kgqmfl78ZI22aepz9ULtqpJs0c qRwCMQb9QJkUyEZDnSMHifwzK40mXCXcXsXUWmVbQ929/KgAkWMgbNNxvd2+OZ2/Rldn UORvJbjOPwbrH9EgxfYHbDhiSPx3baybXdfACmR6PMjbR5BrB0m9UYstQOY3L4qr5Buj bVJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786187857; x=1786792657; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=3Vav1/IZDRyi5TmIe+ztFcmW7gzOkBU4RfYMZP3HSBU=; b=Izh528ICZtSV6h0cl7ZsNmqF8W182XQ7+THsOn5lDUHM5jOxFbTewgABht4vgTkJbH n5kQEe8yhiik0rydMjiSUC3Y0EmbHSsL5kyal7+FSRnzNMNEaAtv8rT5FTrZAZcAjPs+ KHyzYpE+KzMi6LAAHgstB1iC1XsM8/DVHpckudW4xCw1F4wWppcECOVWtAfvE5G8H2/9 Fu3BC8NEzeX7HBYf0g3S2qVLRd4BenQCxMY5LZCoPGlVxDa7GLAyxE2eQp3aWM5WmZ+3 tmzP4tapbZwPzXBHKREKzn9Vk/K6FkZ9pTKEd2hB42PJSdVnedk4YSJbN1ZVs1/NS7QQ AKJA== X-Forwarded-Encrypted: i=1; AHgh+RoUubdF3DxY2CFqPH73U8TrbVc3zTUJWWoCxwdaf+XG8g8W7IfeF2o5bZoWEdgQZ1KL/HEUmRXyaIELj3c=@vger.kernel.org X-Gm-Message-State: AOJu0YywBl//5mWgRwwhgaMaMLXa8KTjKvgLE3W/W10bNBNFOfpC0Ynl 0QVmpwEuP+Xo0+aa9oXHeXCL4oYu6I3xP702iDe/YLysf2cTVETiKrW7 X-Gm-Gg: AR+sD13Kwv5ZLIoxizF3xE6wjSO4qcdQKhY13V76X2jZWhX6LHNTtcbv7yk/tKbvSmb zeU6uD0k6l4u8FEUYRzray3DeU+PBthhlUmiSz8M9zDMRT2j4iCObULqwy5DcjExIDGVsGaRLhy 0STgMZ5ueb029/yMTsdVXukyb5PQ3NccLQptvBSSTnaEeg70R07cWvI2PVtAF+/x3xXpkcADpOX vfIgb7ZU4kCeYQQ0c1kSdi71RYqn6WHrYL9AO0l8trZVIjEMT66PoL1Djn4uB1HvEGXbM3IAVKO ClwSd9TMZ9k+xdn+vkKSac3KhzPSD1wrqDPvjMwb0+Vez/EJ5dQx2rHAsPjP6RT1PEYKJGbQ368 NggMqZ07zzBOnsiWYr9ALdEkHXWm4Ni7OZ1ygeYd7y8aPdY0nkaXR0AnT20s+R4KraLL724JnsD bNIVUmYulX7eTtjSjjI55jHsM4G1XUo66VTqmoH7qrCr/2Plw3TYdxGryf14gYrmO+pHMItRehz ulZtQ== X-Received: by 2002:a17:90b:448b:b0:38e:524:8797 with SMTP id 98e67ed59e1d1-3909d8c3b9cmr13238521a91.13.1786187857487; Sat, 08 Aug 2026 04:17:37 -0700 (PDT) Received: from SGN-LDSENG.tasernet.com ([2405:4800:5cc3:11a:1ac0:4dff:fe8b:4a69]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315bebde308sm18356313eec.20.2026.08.08.04.17.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 08 Aug 2026 04:17:37 -0700 (PDT) From: Cong Nguyen To: Maxime Ripard , Mauro Carvalho Chehab , linux-media@vger.kernel.org Cc: Chen-Yu Tsai , Jernej Skrabec , Samuel Holland , Sakari Ailus , linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, Cong Nguyen , stable@vger.kernel.org Subject: [PATCH v1 3/3] media: sun4i-csi: add notifier unbind callback to drop the source subdev Date: Sat, 8 Aug 2026 18:17:28 +0700 Message-Id: <61d4901af20a4d2d0f9484328c173bbdfc52ec05.1786184456.git.congnt264@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit sun4i_csi_notify_ops only implements .bound and .complete. When the remote sensor's subdevice goes away (e.g. its module is unloaded), the V4L2 async core unbinds and frees it, but the driver keeps the stale pointer in csi->src_subdev and leaves the video node registered. A subsequent VIDIOC_STREAMON reaches sun4i_csi_start_streaming(), which calls v4l2_subdev_call(csi->src_subdev, video, s_stream, 1) on the freed subdev, resulting in a use-after-free. Add an .unbind callback that unregisters the video device so userspace can no longer start streaming, and clears csi->src_subdev. Unregistering the already-unregistered video device again in sun4i_csi_remove() is harmless (vb2_video_unregister_device() is a no-op when it is not registered). Fixes: 577bbf23b758 ("media: sunxi: Add A10 CSI driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4 Signed-off-by: Cong Nguyen --- .../media/platform/sunxi/sun4i-csi/sun4i_csi.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c index a8711336a754..6610ada1c06d 100644 --- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c +++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c @@ -122,8 +122,25 @@ static int sun4i_csi_notify_complete(struct v4l2_async_notifier *notifier) return ret; } +static void sun4i_csi_notify_unbind(struct v4l2_async_notifier *notifier, + struct v4l2_subdev *subdev, + struct v4l2_async_connection *asd) +{ + struct sun4i_csi *csi = container_of(notifier, struct sun4i_csi, + notifier); + + /* + * The remote subdev is being freed. Tear down the video node so + * userspace can no longer reach sun4i_csi_start_streaming() and + * dereference the now dangling source subdev, and drop the pointer. + */ + vb2_video_unregister_device(&csi->vdev); + csi->src_subdev = NULL; +} + static const struct v4l2_async_notifier_operations sun4i_csi_notify_ops = { .bound = sun4i_csi_notify_bound, + .unbind = sun4i_csi_notify_unbind, .complete = sun4i_csi_notify_complete, }; -- 2.25.1