rkvdec_probe() obtains a provider-owned SRAM pool with
of_gen_pool_get(), but its error path incorrectly destroys the borrowed
pool with gen_pool_destroy().

of_gen_pool_get() returns a pool managed by the SRAM provider. The pool
is not created or owned by the rkvdec driver and is destroyed by the
provider when its own managed resources are released.

Destroying it when rkvdec_v4l2_init() fails can invalidate the pool
while the provider and other consumers still reference it, and can also
result in the provider attempting to destroy it again later.

Remove the incorrect gen_pool_destroy() call from the probe failure
path.

This issue was found by manual code inspection.

Fixes: e5640dbb991c ("media: rkvdec: Add RCB and SRAM support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/platform/rockchip/rkvdec/rkvdec.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/media/platform/rockchip/rkvdec/rkvdec.c b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
index 061281f903f3..4541ef9ee3b9 100644
--- a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
+++ b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
@@ -1857,9 +1857,6 @@ static int rkvdec_probe(struct platform_device *pdev)
 	pm_runtime_dont_use_autosuspend(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 
-	if (rkvdec->sram_pool)
-		gen_pool_destroy(rkvdec->sram_pool);
-
 	return ret;
 }
 
-- 
2.43.0

Hi Guangshuo,

On Tuesday, 15 September 2026 10:05:11 EDT Guangshuo Li wrote:
> rkvdec_probe() obtains a provider-owned SRAM pool with
> of_gen_pool_get(), but its error path incorrectly destroys the borrowed
> pool with gen_pool_destroy().
> 
> of_gen_pool_get() returns a pool managed by the SRAM provider. The pool
> is not created or owned by the rkvdec driver and is destroyed by the
> provider when its own managed resources are released.
> 
> Destroying it when rkvdec_v4l2_init() fails can invalidate the pool
> while the provider and other consumers still reference it, and can also
> result in the provider attempting to destroy it again later.
> 
> Remove the incorrect gen_pool_destroy() call from the probe failure
> path.

This is indeed invalid, as the gen_pool is already created when this driver is 
being probe()'d.
The sram module can only be built-in, not a module, so we know that the 
gen_pool will never be destroyed while rkvdec uses it. That allows rkvdec to 
just get the pool pointer and not have to call a matching put() function as 
there is no need for ref counting.

Reviewed-by: Detlev Casanova <detlev.casanova@collabora.com>

> This issue was found by manual code inspection.
> 
> Fixes: e5640dbb991c ("media: rkvdec: Add RCB and SRAM support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/media/platform/rockchip/rkvdec/rkvdec.c | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> b/drivers/media/platform/rockchip/rkvdec/rkvdec.c index
> 061281f903f3..4541ef9ee3b9 100644
> --- a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> +++ b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> @@ -1857,9 +1857,6 @@ static int rkvdec_probe(struct platform_device *pdev)
>  	pm_runtime_dont_use_autosuspend(&pdev->dev);
>  	pm_runtime_disable(&pdev->dev);
> 
> -	if (rkvdec->sram_pool)
> -		gen_pool_destroy(rkvdec->sram_pool);
> -
>  	return ret;
>  }

Regards,
Detlev.