From nobody Sat Jul 25 03:01:19 2026 Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C1953D1A8E for ; Mon, 20 Jul 2026 08:58:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784537906; cv=none; b=QaMuGDofPmjzVekoukTSb4SdxBw7kXcT1Ti4nQWBIGIUp0CrEu6UZFh101+2svrRxOpmnGpisA2GV3qWkt9FtK6+xjn+n75P8Dae45sq8NUivO5dguV0NUlMqZNvZZDz2+HAG2v0nKaVMnttWI1fILO1n0LhaOJdsxVCTqs73RM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784537906; c=relaxed/simple; bh=wZvAUft1XsQt11zE5PHfmNpfM2ivDTKtZI7A5DfH1jI=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qOX7uFw+pmkn1ia37Q04tAzUVsFd5vvgzw4I9FJqTxm54dqSemohbWF+BRK76hNXKMYxu8bm2twIJaWgWiK1FES6zKDcfjMxeK1tRruUFpnsvHSTCZPxazvVYsTHS3Xu5TFUd/iqllSofnXz9SyLhoPu8tbuZv+xKsI0YmWfmKk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IB4U2fSz; arc=none smtp.client-ip=209.85.210.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IB4U2fSz" Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-8487b7b3fc8so9843096b3a.3 for ; Mon, 20 Jul 2026 01:58:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784537904; x=1785142704; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=cOfUy+CQo+u3Sm5zMP7PbJnZMmWfXxmWUpfU0u6aASk=; b=IB4U2fSzXKC/Qq/EpUcPNCZTswB4pbFIq+9JXzcEF5wyhQ2RSSMJPWM+jYYl0cM7kH ohgYm8JcT3dEDjW2mkpLMzijyTjtpmscQBYpcI7tx/s2EIqJ6fr0UW2agsHDF1y29Pqk Dk7MMyEB4not78Hdi7UL0TVgSDmnLi2xHgoI0svhtSU0TaItqzZqmHVKEPjIRkdpAULq HQFFnTkIJ1qaSFy5Bc/iii9NqolbLS7KbgORD/qPQOJZgKGpYzcC7Zr85tuXl48fnzL0 IFn6bm7esHMv2l5kIWLPtFi/TSXSwHXNgGxEMx36Zyu/XubjNjE4xTpKgUKj5kH1YrY2 kxnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784537904; x=1785142704; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=cOfUy+CQo+u3Sm5zMP7PbJnZMmWfXxmWUpfU0u6aASk=; b=mvxsCYwSTVHz62VtTELk01EzEy216K7K+9Ln+6gy9lZBem3QYozGbtZCswe4z1vDkN 0o17x+KDsjYWqTAO7qyXCWr+7tlCpCqZLdvy3z7jMRlirICSsdTkRJ9pep3FRDBTI53M 53jb0K/0jtXpE2KEYnbVAD+UeIKbzskP1EPaLPCevkt+umPigPcNAl+Q0z67ZZUN96DC s66tohPdeYTl8XU/Tw0KNUj14HCif25ppuCWt0uzWbT5TKBsv96uBp8lqyLP1TkSC6CS CIjALsDx3pmXophGGJOYPt+a/lckL49YKiY1fr6mzu0y2PI2grHyVKUb8dfRpyo+cll+ H8/Q== X-Forwarded-Encrypted: i=1; AHgh+RpRCOH07UJFxTAU5o/rnpW5APqD/gC6+3m8u4gz0ZGWtfy6E/uQKMV5g7JwsMUzXEX/cnXhajEiQ4dWK+U=@vger.kernel.org X-Gm-Message-State: AOJu0YwUfV9q4HqidzAKQnMHzYpme2GYhR+RdOqPfq4oOE9BPFl93A0U gTXUn2N+bRRVrfz/1ma/r36dqpPW/QMV9VFEa3dy3T4Gb6srWMhR2vWG X-Gm-Gg: AfdE7ckTguUzdY8qdHKd7oJaauxC+Z0OsPoI8a2DdCusINUecMJ61eJGQKa2f3SF8/q I/fdB8m1NQ1HGFb7Z31BGRf+IbwReBXDxlEGb1b2E+ufK263BnFbIY7LJgeBiJzEobpWzE4APmO Rs68bqVTlXrIEE7y4EQNGrsFOGMNOTpPraqx3gEH8iwsYFGcVoT38w5/L9vE4kWy0FWaOBrGbj4 MnKTLU9nFMHoeYLkUpZr9JTe0t/zN5z/ogH6hhvr52Jid+Zy5Fxiaeelh1od8f30ptbbLPey3J4 T1fi8vP+uXlWqI3ePhmhrNs+mtMQOLobMBvM1rGp/8l9UrmOvnNr47dlxeR3Ve9WRHvt+EjiOyv foOLyp2DOd0p84zAk4l+aEuJhpw45MwIwGF9wVVqI7uu7gF1Tf5gNjKcAuZKDQ490Kzs= X-Received: by 2002:a05:6a00:1888:b0:845:e740:8ba6 with SMTP id d2e1a72fcca58-84c294d43e9mr13050873b3a.43.1784537904420; Mon, 20 Jul 2026 01:58:24 -0700 (PDT) Received: from lgs.. ([118.193.39.55]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84c2adcc78asm5247901b3a.23.2026.07.20.01.58.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 01:58:23 -0700 (PDT) From: Guangshuo Li To: Minghsiu Tsai , Houlong Wei , Andrew-CT Chen , Mauro Carvalho Chehab , Matthias Brugger , AngeloGioacchino Del Regno , Tiffany Lin , Yunfei Dong , Hans Verkuil , Nicolas Dufresne , Chen-Yu Tsai , Fei Shao , Tomasz Figa , Guangshuo Li , Haoxiang Li , Eizan Miyamoto , Enric Balletbo i Serra , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: [PATCH v2 1/3] media: mediatek: vpu: add watchdog handler unregister helper Date: Mon, 20 Jul 2026 16:57:54 +0800 Message-ID: <20260720085756.465667-2-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260720085756.465667-1-lgs201920130244@gmail.com> References: <20260720085756.465667-1-lgs201920130244@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" VPU clients register watchdog reset handlers with private data owned by the client device. The VPU driver currently provides no way to clear a handler when client initialization fails or when the client device is removed. Add vpu_wdt_unreg_handler() to clear the reset callback and its private data while holding the VPU mutex. This allows clients to remove stale watchdog entries before releasing their device references. Signed-off-by: Guangshuo Li --- drivers/media/platform/mediatek/vpu/mtk_vpu.c | 14 ++++++++++++++ drivers/media/platform/mediatek/vpu/mtk_vpu.h | 2 ++ 2 files changed, 16 insertions(+) diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/= platform/mediatek/vpu/mtk_vpu.c index 8d8319f0cd22..a2b937095248 100644 --- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c +++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c @@ -437,6 +437,20 @@ int vpu_wdt_reg_handler(struct platform_device *pdev, } EXPORT_SYMBOL_GPL(vpu_wdt_reg_handler); =20 +void vpu_wdt_unreg_handler(struct platform_device *pdev, enum rst_id id) +{ + struct mtk_vpu *vpu =3D platform_get_drvdata(pdev); + + if (!vpu || id >=3D VPU_RST_MAX) + return; + + mutex_lock(&vpu->vpu_mutex); + vpu->wdt.handler[id].reset_func =3D NULL; + vpu->wdt.handler[id].priv =3D NULL; + mutex_unlock(&vpu->vpu_mutex); +} +EXPORT_SYMBOL_GPL(vpu_wdt_unreg_handler); + unsigned int vpu_get_vdec_hw_capa(struct platform_device *pdev) { struct mtk_vpu *vpu =3D platform_get_drvdata(pdev); diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.h b/drivers/media/= platform/mediatek/vpu/mtk_vpu.h index 3951547e9ec5..2ccb481a04cf 100644 --- a/drivers/media/platform/mediatek/vpu/mtk_vpu.h +++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.h @@ -141,6 +141,8 @@ int vpu_wdt_reg_handler(struct platform_device *pdev, void vpu_wdt_reset_func(void *priv), void *priv, enum rst_id id); =20 +void vpu_wdt_unreg_handler(struct platform_device *pdev, enum rst_id id); + /** * vpu_get_vdec_hw_capa - get video decoder hardware capability * --=20 2.43.0 From nobody Sat Jul 25 03:01:19 2026 Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00EDE3D16EF for ; Mon, 20 Jul 2026 08:58:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784537916; cv=none; b=TkC229NoSCUgKpXr/qf6MrSL9SzjvOPDP1j5Y2MlCSt3L+MEGisU2iNXwsNZH78biHdTLshjeJknKz7U1KDKFjaUNFAS8dCUT4BQjyvQ5hG//zgAwOWLB53UylAmZJ82UwoeDZX/ocZ17PHQjwEIEiPSfol1RGtXvTXoZM9tco8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784537916; c=relaxed/simple; bh=fvlAbSacer15HDU3morDcCk441WF9liOY8rynCb+b9E=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eTh2SsJfaJ5EArRUsqGykCzqMwMkd9YncAEGIwiHWvOsqs26eMgof3yfEKiltR0rxfmKu1JUwJNLN3FXh6AR66tAo9ncL+OHO7yVSGU1dd0WnNskfh+5ozPOK6sudYTwW+Xlhhqb+lue1NajyKwi/+rYRXhGeST+edWa1srZ4/Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SMrlo1fa; arc=none smtp.client-ip=209.85.210.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SMrlo1fa" Received: by mail-pf1-f180.google.com with SMTP id d2e1a72fcca58-8484a0b998fso9556022b3a.2 for ; Mon, 20 Jul 2026 01:58:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784537914; x=1785142714; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=/5WnsBAYG56YcYpIFG68fmgIsTfeIiu5tlkG2mA3FEU=; b=SMrlo1faJi394gju1xAxEy/q65unszTYqJE25dK3ZOwUtk08v+NuTTFb46Icbk97uh n6MdPYv+LOAa/cYdBLqTFYaTezRPCbhhxmtzB1qg77i3MuJXbgfHOv3N4AkuaaWKN41k 54pjWFMlMMSWiKIjiYlZIYY8fagMrOgMSeiQKN+hFdJnMPibV8OpWdHTmGVxJ9WlmziK b5EDXa2aprZBFj0miNT43aL7yV3ANSS10Bu9K9LhVOmpmvnBlGrqaU+4kLKMO6paq/gV 0Py+kNXdUkM4jjnXBqlpwq2yDFgjlr4m5iAi/ql4CJ0cyoKIFnn0eua7VnhkaGK9VMsA 62gQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784537914; x=1785142714; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=/5WnsBAYG56YcYpIFG68fmgIsTfeIiu5tlkG2mA3FEU=; b=d/VBJtpHggqNSCIh+BFG27ZONOrsVr8GCFbYyb6plXpC3VRxQ0zbnBY2Zq4Z+dxfkx cSwPQxLTIqmAQycxl0lS0NJ/zeLAwjk+/IK//Rm0TVY5vDb4VLAkh5bcAYw5MrVA/MYR +Ry1PctzOB6KwQrPLcqonsdg+Hfg22J+XjnMbDSfqL/QaL0F+e4w9NdiTZy6U5agfpq2 wzXOTnbh5CcWlX4HzpfCgbYFzKToIN204bebQ56XWGb8FDRV0qAxdg5tA3hai3od5Ezp 84OYyY/r0mJ7lON2rmRiw1T/Eu306Eu+nMXR7ct69/1wRZ0deeESfrAC/7t184BxSlYu gLmQ== X-Forwarded-Encrypted: i=1; AHgh+RqyhKPyYVgG4Pui8ewqbNCSXNJIxtBUwpUr4r7dALMuy+kD4sqFJvwZFYGzzW1nfarP75dKYVlA/PG6rEk=@vger.kernel.org X-Gm-Message-State: AOJu0Yy5294+C9h2KsEd3ixE8f0KsHH7bWA6omx+PT3hVnW6VIHkVkCj UhlbEOlZRentOAK0PNf9RkVXWehDivWSQULkd4iy5Cnok0cdG5Yb2KAp X-Gm-Gg: AfdE7cmLiHJBYBNtcXkfztcVxvTPWnuVdHefIksl9OTgBFYJ1xeLgVBY9hemSrRhJEO gRAl90VNwf46I3XRczjzLRh4C3Nzx57JHBUO665wLXbselc8qV0CBvn0GaZn5r0qp8ghDKtJPSi uWK/GISXoUFD9jYXa7Ad1LbGqLAphm5D2SxkyHZ6ErKVJwAZ4ksTDb+Pd+JFEfteEeV8jOkaOxr mhWlpVtZHsye77Auo95n8h2TKR26K1dxPS97QR1ZFvTrhknA4YiOdlOx6+GjB7sykPoo1Q1WBqR s4TOV/zmnjCtFUnOiEe2jE/mq2QGbLtscyzJOAnDQGzY129c+BDFzq0rU0fv4eO8T4qK5I3xpzm OjvUtUPyZcBo3vtSUNGYTbyLT+4zEKVlP8d9haxzg3bIopDoFa/wl7x79V3C3kNxgSxP+l/Vo4R tWUQ== X-Received: by 2002:a05:6a00:288d:b0:845:d650:b75f with SMTP id d2e1a72fcca58-84c29270e93mr13637631b3a.8.1784537914434; Mon, 20 Jul 2026 01:58:34 -0700 (PDT) Received: from lgs.. ([118.193.39.55]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84c2adcc78asm5247901b3a.23.2026.07.20.01.58.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 01:58:33 -0700 (PDT) From: Guangshuo Li To: Minghsiu Tsai , Houlong Wei , Andrew-CT Chen , Mauro Carvalho Chehab , Matthias Brugger , AngeloGioacchino Del Regno , Tiffany Lin , Yunfei Dong , Hans Verkuil , Nicolas Dufresne , Chen-Yu Tsai , Fei Shao , Tomasz Figa , Guangshuo Li , Haoxiang Li , Eizan Miyamoto , Enric Balletbo i Serra , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: [PATCH v2 2/3] media: mediatek: vcodec: unregister VPU watchdog handler Date: Mon, 20 Jul 2026 16:57:55 +0800 Message-ID: <20260720085756.465667-3-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260720085756.465667-1-lgs201920130244@gmail.com> References: <20260720085756.465667-1-lgs201920130244@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mtk_vcodec_fw_vpu_init() registers a VPU watchdog reset handler and passes the vcodec device as the private data. The handler is stored in the VPU device and can outlive the vcodec device. If firmware initialization fails after the handler has been registered, or if the firmware object is later released, the watchdog table can retain a pointer to a vcodec device that is about to be released. A later watchdog reset can then call the reset handler with a stale pointer and dereference freed memory while walking the vcodec context list. Unregister the watchdog handler in the firmware initialization failure path and in the firmware release path before dropping the VPU device reference. Fixes: 01abf5fbb081 ("media: mediatek: vcodec: separate struct 'mtk_vcodec_= ctx'") Signed-off-by: Guangshuo Li --- .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vp= u.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c index 3632037f78f5..ee50a794077f 100644 --- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c @@ -40,6 +40,11 @@ static int mtk_vcodec_vpu_ipi_send(struct mtk_vcodec_fw = *fw, int id, void *buf, =20 static void mtk_vcodec_vpu_release(struct mtk_vcodec_fw *fw) { + enum rst_id rst_id; + + rst_id =3D fw->fw_use =3D=3D ENCODER ? VPU_RST_ENC : VPU_RST_DEC; + vpu_wdt_unreg_handler(fw->pdev, rst_id); + put_device(&fw->pdev->dev); } =20 @@ -120,6 +125,7 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_vpu_init(void *priv= , enum mtk_vcodec_fw_use =20 fw =3D devm_kzalloc(&plat_dev->dev, sizeof(*fw), GFP_KERNEL); if (!fw) { + vpu_wdt_unreg_handler(fw_pdev, rst_id); put_device(&fw_pdev->dev); return ERR_PTR(-ENOMEM); } --=20 2.43.0 From nobody Sat Jul 25 03:01:19 2026 Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3606B3D1715 for ; Mon, 20 Jul 2026 08:58:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784537924; cv=none; b=XMv20/nIuZSCgjLOlMg4xmVl1KgQ3QZMXWOOrRPSDAiafYlpgQVdrp2begXzGYiX2S2JSl/QbWWFWNiEkrO0LLnfojfDnBHOhk7vGupOxCmp+DR6Lv2JAKnTAofmy0N/OcN70touL4dcfxKZ+iheosNPSjjd1lBqVCxmMak6JG4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784537924; c=relaxed/simple; bh=C8AEiXCDpVJ4T6CZGEvCJ5xIZmzvMLOejU2iVUFF5Q8=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cRN4Kgl5nmL85nVqMmXRHGgUJz1v3NXSfpUBah068EFpeTZW3H+Cxls3955Zx+EeNL0imoCPDisjI3PjAjBA53YrNogDhB7tNTXyF5f0F+EPnfBB2QNGRhUv/b0H6Bnqsr2O9NIxQtKTh2jKo5MryYhkj496StFsEZT7MYG4QvQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=pAnXrMwv; arc=none smtp.client-ip=209.85.210.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="pAnXrMwv" Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-848882fdb18so7019230b3a.0 for ; Mon, 20 Jul 2026 01:58:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784537922; x=1785142722; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RUKJxr+1tIy/FI363caVVmoJTRInNyqm1ZI8xlDvLAU=; b=pAnXrMwvYNZnVS/gYwMEkN4JN4U6GCMvdq++9saFFB7EEHlTHaS1lZJQJIJed4MAgp fNKH7SZpIWOIl8pm5i9KiOqVZRpqXwd1VO+OfNryGgW8El1SX2yZ0Lwkf9mRQVbYrEWf tAHYguZOTDlDyhPXWHGyibqmegZfq+GzN/Pr1mdWimij2byGwurkL3CtEebZWciShloW XohFTj3m9mc4xawdajamnr9tf92u2ggKGWdRxiCtXDvplu/M8pKLqGqTKjwcyThOh6/v z18Vmh2rr/7fiq3IQ+Anld+hatwNL1bVBKUMjmMVpdsuNUsGaOXNmltIo9V74/nDOekq Uf9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784537922; x=1785142722; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=RUKJxr+1tIy/FI363caVVmoJTRInNyqm1ZI8xlDvLAU=; b=Jm4b9KmLOQOwDgk4o/bUv3swFOTYilfYLf19Pyu/DvrwkET4he725ouHIEnB7cYM8U P7mFGGGAa40sMCLKTKbGUuvndSM4QSJEqmFetSpDBlE6XGTWyXHEIRvMyAICdmbKvM+Z 6fcNAKXvSYiO1SyhVpjTMaHaaY3dFvceXxU51/wL+Sa6/4iUAlb1rCxtmcFbKlu9SU8E xPBpUGP+vYQ4l8tEPhG5nFdToNV7QS73SimT4ELXbc1w+Gqplgbpdo5g8RYEWwyQ5Ckr la4JHd+6AK9oOnsOBbOG1bzXd2Zj48IwnYLZJQKQFO77TmBbVixW5mmQBdctM5efP2TG NQ8g== X-Forwarded-Encrypted: i=1; AHgh+RrJBE/iZioDuwWrleTDEkVEdnzzhq1arCMt4HYj2EKc2h4XVugwwziZMaDEiTBQym70Gm6N+B9ZQ88uHRs=@vger.kernel.org X-Gm-Message-State: AOJu0Yzh+kaKVSUk1wDv2FS0ZtygdOS6QWlV1meGHyzMNA/IczuLk2mG TUky1VbSsP1TOEsWNhJURhnTc9nxnMAVZIaJLddhoai069a5c+g1XfQH X-Gm-Gg: AfdE7cn/pDDmgTwnr30aUiGpW02iVLHS0Y7DX3OrtmyJF4js6S26Bfa5nIOajJoFTUj tTkIZwFP2Q8w9xyk8bOto3Pi5DzigHL62hX/jf9h5j3u8p2CMVX8k9pXAZfofvp43fhn64C3lG1 sPukJQy7aeZuZiQ46CRLAdy3L3XR4fHzVIfuzJKmmm+p0OQDWPDP1jyHIw+1kJ2WHu/5c2ZSHpe wNspJERwYF+wpR817f4avFMPSCDfjyAI4m5fFHp2rXrpkpYfRjBu4178bMghtJdkHSpyuDstznY NKVRLtLE1qjD46ZVVabvqPk8mZ9E+fJXLceoC42R3Hyy0v95CRtkiHgZgXsJWUhI7LMS6NAneil A2F7mLl4jxMxEHi3EnUoyU/AtkS9gcPWl+rW3H0hnqCDnZOb+HCxO6lyfkYnehjx//Ck= X-Received: by 2002:a05:6a00:14d1:b0:848:6c37:cd74 with SMTP id d2e1a72fcca58-84c29288282mr13097826b3a.22.1784537922386; Mon, 20 Jul 2026 01:58:42 -0700 (PDT) Received: from lgs.. ([118.193.39.55]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84c2adcc78asm5247901b3a.23.2026.07.20.01.58.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 01:58:41 -0700 (PDT) From: Guangshuo Li To: Minghsiu Tsai , Houlong Wei , Andrew-CT Chen , Mauro Carvalho Chehab , Matthias Brugger , AngeloGioacchino Del Regno , Tiffany Lin , Yunfei Dong , Hans Verkuil , Nicolas Dufresne , Chen-Yu Tsai , Fei Shao , Tomasz Figa , Guangshuo Li , Haoxiang Li , Eizan Miyamoto , Enric Balletbo i Serra , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: [PATCH v2 3/3] media: mtk-mdp: unregister VPU watchdog handler Date: Mon, 20 Jul 2026 16:57:56 +0800 Message-ID: <20260720085756.465667-4-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260720085756.465667-1-lgs201920130244@gmail.com> References: <20260720085756.465667-1-lgs201920130244@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mtk_mdp_probe() registers the MDP reset handler with the VPU watchdog code and passes the MDP device as the private data. The handler is stored in the VPU device and can outlive the MDP probe or remove path. If probe fails after the handler has been registered, or if the MDP device is removed, the watchdog table can retain a pointer to an MDP object that is about to be released. A later VPU watchdog reset can then call mtk_mdp_reset_handler() with a stale pointer and dereference freed memory while queuing the MDP watchdog work. Unregister the watchdog handler in the probe error path and in the remove path before dropping the VPU device reference. Fixes: ee18fc7b0b95 ("media: mtk-mdp: handle vpu_wdt_reg_handler() errors d= uring probe") Reviewed-by: Nicolas Dufresne Signed-off-by: Guangshuo Li --- drivers/media/platform/mediatek/mdp/mtk_mdp_core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c b/drivers/m= edia/platform/mediatek/mdp/mtk_mdp_core.c index 8432833814f3..5ccb7aa925d9 100644 --- a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c +++ b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c @@ -221,6 +221,7 @@ static int mtk_mdp_probe(struct platform_device *pdev) return 0; =20 err_reg_handler: + vpu_wdt_unreg_handler(mdp->vpu_dev, VPU_RST_MDP); platform_device_put(mdp->vpu_dev); =20 err_vpu_get_dev: @@ -254,6 +255,7 @@ static void mtk_mdp_remove(struct platform_device *pdev) =20 pm_runtime_disable(&pdev->dev); vb2_dma_contig_clear_max_seg_size(&pdev->dev); + vpu_wdt_unreg_handler(mdp->vpu_dev, VPU_RST_MDP); platform_device_put(mdp->vpu_dev); mtk_mdp_unregister_m2m_device(mdp); v4l2_device_unregister(&mdp->v4l2_dev); --=20 2.43.0