Re: [PATCH] media: chips-media: wave5: Handle polling IRQ thread failure

[Nicolas Dufresne <nicolas.dufresne@collabora.com>]

[-- Attachment #1: Type: text/plain, Size: 1924 bytes --]

Le vendredi 17 juillet 2026 à 15:13 +0800, Linmao Li a écrit :
> When falling back to polling mode, wave5_vpu_probe() does not check the
> return value of kthread_run().  On failure, dev->irq_thread holds an
> error pointer instead of a valid task pointer.
> 
> Both the probe error path and the remove path only check
> dev->irq_thread against NULL before calling kthread_stop() on it, so an
> error pointer passes the check and kthread_stop() crashes on it.
> 
> Check the kthread_run() result, clear dev->irq_thread and unwind the
> probe on failure.
> 
> Fixes: e66ff2b08e4e ("media: chips-media: wave5: Fix Null reference while
> testing fluster")
> Cc: stable@vger.kernel.org
> Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
> ---
>  drivers/media/platform/chips-media/wave5/wave5-vpu.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
> b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
> index 76d57c6b636a..37df270b5f99 100644
> --- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
> +++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
> @@ -340,6 +340,13 @@ static int wave5_vpu_probe(struct platform_device *pdev)
>  		dev_err(&pdev->dev, "failed to get irq resource, falling back
> to polling\n");
>  		sema_init(&dev->irq_sem, 1);
>  		dev->irq_thread = kthread_run(irq_thread, dev, "irq thread");
> +		if (IS_ERR(dev->irq_thread)) {
> +			ret = PTR_ERR(dev->irq_thread);
> +			dev_err(&pdev->dev, "failed to create irq thread\n");
> +			dev->irq_thread = NULL;
> +			goto err_vdi_release;
> +		}
> +
>  		hrtimer_setup(&dev->hrtimer, &wave5_vpu_timer_callback,
> CLOCK_MONOTONIC,
>  			      HRTIMER_MODE_REL_PINNED);
>  		dev->worker = kthread_run_worker(0, "vpu_irq_thread");

Looks fine to me.

Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]