[PATCH] media: nxp: imx8-isi: Register the media device only once

[PATCH] media: nxp: imx8-isi: Register the media device only once

[Aristo Chen]

The v4l2-async framework calls the notifier .complete() operation every
time the last missing subdev gets bound. This happens again each time a
remote subdev is unbound and bound again, for instance when the sensor
driver is unbound and rebound through sysfs.

mxc_isi_async_notifier_complete() calls media_device_register()
unconditionally. Each call allocates and registers a new media devnode
and overwrites mdev->devnode, so every rebind creates an additional
/dev/mediaN for the same media device, and leaks the previous devnode
and its minor number. As media_device_unregister() only unregisters
the most recent devnode, the older ones also stay registered after the
ISI is removed, and ioctls on them dereference the freed media_device.

On an i.MX93 board with an AP1302 ISP, every unbind/bind cycle of the
AP1302 driver adds one /dev/mediaN: after three binds, /dev/media0,
/dev/media1 and /dev/media2 all expose the same media graph.

Register the media device only if it isn't registered yet. Keep the
v4l2_device_register_subdev_nodes() call unconditional, as it has to
create the device nodes of the rebound subdevs, and it already skips
the subdevs that have one.

The issue was found while debugging an unbind crash in the AP1302
driver of the NXP BSP kernel. An AI coding assistant helped to find
it, and wrote this fix and its changelog.

Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
---
Tested on an i.MX93 FRDM board running the NXP BSP kernel
(lf-6.18.20-2.0.0), whose mxc_isi_async_notifier_complete() is identical
to mainline, with the AP1302 driver from the same BSP plus a local fix
that makes it possible to unbind it:

- Without this patch, three unbind/bind cycles of the AP1302 driver
  left /dev/media0, /dev/media1 and /dev/media2.
- With this patch, after each of three unbind/bind cycles only
  /dev/media0 exists, and media-ctl -p on it shows the rebound AP1302
  and sensor entities. No kernel warnings.

Not tested: the ISI removal path, where the stale devnodes would be
dereferenced. Build-tested on top of 330517c63aa9 with W=1, no new
warnings; sparse was not run.

 drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
index 0ae5f35e017c..82a03742405d 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
@@ -90,6 +90,10 @@ static int mxc_isi_async_notifier_complete(struct v4l2_async_notifier *notifier)
 		return ret;
 	}
 
+	/* .complete() is called again every time a subdev gets rebound. */
+	if (media_devnode_is_registered(isi->media_dev.devnode))
+		return 0;
+
 	return media_device_register(&isi->media_dev);
 }
 

base-commit: 330517c63aa9b48227b6ab45f01003effac77ae4
-- 
2.53.0

Re: [PATCH] media: nxp: imx8-isi: Register the media device only once

[Laurent Pinchart]

Hello,

This is an automated reply.

You have sent a patch that appears to have been generated by an LLM. The
commit message and/or code show little to no real understanding of the
changes being proposed.

Such patches require a large amount of work to review. They rely on the
maintainer to propose - and often even implement - a proper design. The
probability that the author will learn from the experience to improve
their future contributions is close to zero.

As a result, to make good use of maintainer time and keep the kernel
development process sustainable, your patch has been rejected.

If you believe the change you proposed is important, take time to study
the problem, learn, and develop a solution without AI assistance.
Answering this e-mail or generating a new version of the patch by
feeding this reply to an LLM will only result in your e-mails being
ignored.

Please note that if your patch attempted to address an important
problem, maintainers or other contributors can submit and merge a
similar or entirely different fix without crediting you.

Your contributions to the Linux kernel will be welcome if you genuinely
desire to invest your time and learn.

Thank you,

Laurent's mail bot

On Sun, 25 Oct 2026 08:24:18 +0000, Aristo Chen <aristo.chen@canonical.com> wrote:
> The v4l2-async framework calls the notifier .complete() operation every
> time the last missing subdev gets bound. This happens again each time a
> remote subdev is unbound and bound again, for instance when the sensor
> driver is unbound and rebound through sysfs.
> 
> mxc_isi_async_notifier_complete() calls media_device_register()
> unconditionally. Each call allocates and registers a new media devnode
> and overwrites mdev->devnode, so every rebind creates an additional
> /dev/mediaN for the same media device, and leaks the previous devnode
> and its minor number. As media_device_unregister() only unregisters
> the most recent devnode, the older ones also stay registered after the
> ISI is removed, and ioctls on them dereference the freed media_device.
> 
> On an i.MX93 board with an AP1302 ISP, every unbind/bind cycle of the
> AP1302 driver adds one /dev/mediaN: after three binds, /dev/media0,
> /dev/media1 and /dev/media2 all expose the same media graph.
> 
> Register the media device only if it isn't registered yet. Keep the
> v4l2_device_register_subdev_nodes() call unconditional, as it has to
> create the device nodes of the rebound subdevs, and it already skips
> the subdevs that have one.
> 
> The issue was found while debugging an unbind crash in the AP1302
> driver of the NXP BSP kernel. An AI coding assistant helped to find
> it, and wrote this fix and its changelog.
> 
> Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
> ---
> Tested on an i.MX93 FRDM board running the NXP BSP kernel
> (lf-6.18.20-2.0.0), whose mxc_isi_async_notifier_complete() is identical
> to mainline, with the AP1302 driver from the same BSP plus a local fix
> that makes it possible to unbind it:
> 
> - Without this patch, three unbind/bind cycles of the AP1302 driver
>   left /dev/media0, /dev/media1 and /dev/media2.
> - With this patch, after each of three unbind/bind cycles only
>   /dev/media0 exists, and media-ctl -p on it shows the rebound AP1302
>   and sensor entities. No kernel warnings.
> 
> Not tested: the ISI removal path, where the stale devnodes would be
> dereferenced. Build-tested on top of 330517c63aa9 with W=1, no new
> warnings; sparse was not run.
> 
>  drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> index 0ae5f35e017c..82a03742405d 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> @@ -90,6 +90,10 @@ static int mxc_isi_async_notifier_complete(struct v4l2_async_notifier *notifier)
>  		return ret;
>  	}
>  
> +	/* .complete() is called again every time a subdev gets rebound. */
> +	if (media_devnode_is_registered(isi->media_dev.devnode))
> +		return 0;
> +
>  	return media_device_register(&isi->media_dev);
>  }
>  
> 
> base-commit: 330517c63aa9b48227b6ab45f01003effac77ae4