[PATCH v2] media: v4l2-dev: fix media controller registration error handling

[PATCH v2] media: v4l2-dev: fix media controller registration error handling

[Shih-Sheng Yang]

__video_register_device() ignores failures from
video_register_media_controller(). If media_devnode_create() fails,
vdev->intf_devnode remains NULL but the video device is still marked as
registered. A later video_unregister_device() reaches
v4l2_device_release(), which calls media_devnode_remove() and
dereferences the NULL pointer.

If media_create_intf_link() fails, video_register_media_controller()
removes vdev->intf_devnode but leaves the stale pointer behind.

Fix this by propagating video_register_media_controller() failures from
__video_register_device(). Since device_register() has already
succeeded, unwind the device with device_unregister(). Also make
media_devnode_remove() tolerate NULL devnodes and clear
vdev->intf_devnode after removing it in the link failure path.

Suggested-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Shih-Sheng Yang <yshihsheng@gmail.com>
---
v1: https://lore.kernel.org/r/20260625193916.3562596-1-yshihsheng@gmail.com

Changes in v2:
- Move the NULL check to media_devnode_remove().
- Use device_unregister() after device_register() has succeeded.
- Keep clearing vdev->intf_devnode in the link failure path.

 drivers/media/mc/mc-entity.c       | 3 +++
 drivers/media/v4l2-core/v4l2-dev.c | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c
index 3fa0bc687851..79f55375e9d6 100644
--- a/drivers/media/mc/mc-entity.c
+++ b/drivers/media/mc/mc-entity.c
@@ -1563,6 +1563,9 @@ EXPORT_SYMBOL_GPL(media_devnode_create);
 
 void media_devnode_remove(struct media_intf_devnode *devnode)
 {
+	if (!devnode)
+		return;
+
 	media_remove_intf_links(&devnode->intf);
 	media_gobj_destroy(&devnode->intf.graph_obj);
 	kfree(devnode);
diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c
index 5516b2bbb08f..56b51d5d49ae 100644
--- a/drivers/media/v4l2-core/v4l2-dev.c
+++ b/drivers/media/v4l2-core/v4l2-dev.c
@@ -896,6 +896,7 @@ static int video_register_media_controller(struct video_device *vdev)
 					      MEDIA_LNK_FL_IMMUTABLE);
 		if (!link) {
 			media_devnode_remove(vdev->intf_devnode);
+			vdev->intf_devnode = NULL;
 			media_device_unregister_entity(&vdev->entity);
 			return -ENOMEM;
 		}
@@ -1092,6 +1093,11 @@ int __video_register_device(struct video_device *vdev,
 
 	/* Part 5: Register the entity. */
 	ret = video_register_media_controller(vdev);
+	if (ret < 0) {
+		mutex_unlock(&videodev_lock);
+		device_unregister(&vdev->dev);
+		return ret;
+	}
 
 	/* Part 6: Activate this minor. The char device can now be used. */
 	set_bit(V4L2_FL_REGISTERED, &vdev->flags);
-- 
2.34.1

Re: [PATCH v2] media: v4l2-dev: fix media controller registration error handling

[hverkuil+cisco]

On 30/06/2026 11:58, Shih-Sheng Yang wrote:
> __video_register_device() ignores failures from
> video_register_media_controller(). If media_devnode_create() fails,
> vdev->intf_devnode remains NULL but the video device is still marked as
> registered. A later video_unregister_device() reaches
> v4l2_device_release(), which calls media_devnode_remove() and
> dereferences the NULL pointer.
> 
> If media_create_intf_link() fails, video_register_media_controller()
> removes vdev->intf_devnode but leaves the stale pointer behind.
> 
> Fix this by propagating video_register_media_controller() failures from
> __video_register_device(). Since device_register() has already
> succeeded, unwind the device with device_unregister(). Also make
> media_devnode_remove() tolerate NULL devnodes and clear
> vdev->intf_devnode after removing it in the link failure path.
> 
> Suggested-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> Signed-off-by: Shih-Sheng Yang <yshihsheng@gmail.com>
> ---
> v1: https://lore.kernel.org/r/20260625193916.3562596-1-yshihsheng@gmail.com
> 
> Changes in v2:
> - Move the NULL check to media_devnode_remove().
> - Use device_unregister() after device_register() has succeeded.
> - Keep clearing vdev->intf_devnode in the link failure path.
> 
>  drivers/media/mc/mc-entity.c       | 3 +++
>  drivers/media/v4l2-core/v4l2-dev.c | 6 ++++++
>  2 files changed, 9 insertions(+)
> 
> diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c
> index 3fa0bc687851..79f55375e9d6 100644
> --- a/drivers/media/mc/mc-entity.c
> +++ b/drivers/media/mc/mc-entity.c
> @@ -1563,6 +1563,9 @@ EXPORT_SYMBOL_GPL(media_devnode_create);
>  
>  void media_devnode_remove(struct media_intf_devnode *devnode)
>  {
> +	if (!devnode)
> +		return;
> +
>  	media_remove_intf_links(&devnode->intf);
>  	media_gobj_destroy(&devnode->intf.graph_obj);
>  	kfree(devnode);
> diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c
> index 5516b2bbb08f..56b51d5d49ae 100644
> --- a/drivers/media/v4l2-core/v4l2-dev.c
> +++ b/drivers/media/v4l2-core/v4l2-dev.c
> @@ -896,6 +896,7 @@ static int video_register_media_controller(struct video_device *vdev)
>  					      MEDIA_LNK_FL_IMMUTABLE);
>  		if (!link) {
>  			media_devnode_remove(vdev->intf_devnode);
> +			vdev->intf_devnode = NULL;
>  			media_device_unregister_entity(&vdev->entity);
>  			return -ENOMEM;
>  		}
> @@ -1092,6 +1093,11 @@ int __video_register_device(struct video_device *vdev,
>  
>  	/* Part 5: Register the entity. */
>  	ret = video_register_media_controller(vdev);
> +	if (ret < 0) {
> +		mutex_unlock(&videodev_lock);
> +		device_unregister(&vdev->dev);

This causes problems. See this series for more information:

https://patchwork.linuxtv.org/project/linux-media/list/?series=27907

I think it is better to limit yourself to just setting vdev->intf_devnode
to NULL and checking for a NULL pointer in media_devnode_remove().

As mentioned in that series, this function really needs to be split into
two parts. But that's a much larger effort.

There is just a lot of history here, and no easy fix.

Regards,

	Hans

> +		return ret;
> +	}
>  
>  	/* Part 6: Activate this minor. The char device can now be used. */
>  	set_bit(V4L2_FL_REGISTERED, &vdev->flags);