Messages in this thread |  | | Date | Wed, 6 May 2026 15:31:52 +0300 | | From | Laurent Pinchart <> | | Subject | Re: [PATCH v2 1/4] media: imx8-isi: fix use-after-free on remove |
| |
Hello Xiaolei,
Thank you for the patch.
On Wed, May 06, 2026 at 11:12:07AM +0800, Xiaolei Wang wrote: > KASAN reports a slab-use-after-free in __media_entity_remove_link() > during rmmod of imx8_isi: > > BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650 > Read of size 2 at addr ffff0000d47cb02a by task rmmod/724 > > Call trace: > __media_entity_remove_link+0x608/0x650 > __media_entity_remove_links+0x78/0x144 > __media_device_unregister_entity+0x150/0x280 > media_device_unregister_entity+0x48/0x68 > v4l2_device_unregister_subdev+0x158/0x300 > v4l2_async_unbind_subdev_one+0x22c/0x358 > v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0 > v4l2_async_nf_unregister+0x5c/0x14c > mxc_isi_remove+0x124/0x2a0 [imx8_isi] > > Allocated by task 249: > __kmalloc_noprof+0x27c/0x690 > mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi] > > Freed by task 724: > kfree+0x1e4/0x5b0 > mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi] > mxc_isi_remove+0x11c/0x2a0 [imx8_isi] > > The problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup() > before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media > entity pads, but the subsequent v4l2 cleanup still tries to remove > media links that reference those pads. > > Fix this by calling mxc_isi_v4l2_cleanup() before > mxc_isi_crossbar_cleanup() to ensure all media entities are properly > unregistered while the pads are still valid. > > Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") > Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com> > Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> --- > drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c > index 4bf8570e1b9e..2d639b789910 100644 > --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c > +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c > @@ -556,8 +556,8 @@ static void mxc_isi_remove(struct platform_device *pdev) > mxc_isi_pipe_cleanup(pipe); > } > > - mxc_isi_crossbar_cleanup(&isi->crossbar); > mxc_isi_v4l2_cleanup(isi); > + mxc_isi_crossbar_cleanup(&isi->crossbar); > } > > static const struct of_device_id mxc_isi_of_match[] = {
-- Regards,
Laurent Pinchart
|  |