On Thu May 7 12:13:15 2026 +0800, Xiaolei Wang wrote:
> KASAN reports a slab-use-after-free in __media_entity_remove_link()
> during rmmod of imx8_isi:
>
> BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650
> Read of size 2 at addr ffff0000d47cb02a by task rmmod/724
>
> Call trace:
> __media_entity_remove_link+0x608/0x650
> __media_entity_remove_links+0x78/0x144
> __media_device_unregister_entity+0x150/0x280
> media_device_unregister_entity+0x48/0x68
> v4l2_device_unregister_subdev+0x158/0x300
> v4l2_async_unbind_subdev_one+0x22c/0x358
> v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0
> v4l2_async_nf_unregister+0x5c/0x14c
> mxc_isi_remove+0x124/0x2a0 [imx8_isi]
>
> Allocated by task 249:
> __kmalloc_noprof+0x27c/0x690
> mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi]
>
> Freed by task 724:
> kfree+0x1e4/0x5b0
> mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi]
> mxc_isi_remove+0x11c/0x2a0 [imx8_isi]
>
> The problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup()
> before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media
> entity pads, but the subsequent v4l2 cleanup still tries to remove
> media links that reference those pads.
>
> Fix this by calling mxc_isi_v4l2_cleanup() before
> mxc_isi_crossbar_cleanup() to ensure all media entities are properly
> unregistered while the pads are still valid.
>
> Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
> Cc: [email protected]
> Signed-off-by: Xiaolei Wang <[email protected]>
> Reviewed-by: Frank Li <[email protected]>
> Reviewed-by: Laurent Pinchart <[email protected]>
> Link:
> https://patch.msgid.link/[email protected]
> Signed-off-by: Laurent Pinchart <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
index 4bf8570e1b9e..2d639b789910 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
@@ -556,8 +556,8 @@ static void mxc_isi_remove(struct platform_device *pdev)
mxc_isi_pipe_cleanup(pipe);
}
- mxc_isi_crossbar_cleanup(&isi->crossbar);
mxc_isi_v4l2_cleanup(isi);
+ mxc_isi_crossbar_cleanup(&isi->crossbar);
}
static const struct of_device_id mxc_isi_of_match[] = {
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
