On Wed Sep 9 08:13:41 2026 +0000, Fan Wu wrote:
> vivid_dev_release() cancels update_hdmi_ctrl_work but not its sibling
> update_svid_ctrl_work, which vivid_vid_cap_s_ctrl() queues on
> update_svid_ctrls_workqueue when a VIVID_CID_SVID_IS_CONNECTED_TO_OUTPUT
> control is changed. The two work items were added together, but only
> one of them is cancelled on release.
>
> If the svid work is still pending or running when the last v4l2_device
> reference is dropped, update_svid_ctrls_work_handler() runs after
> kfree(dev): the handler iterates the global vivid_devs[] array and
> calls v4l2_ctrl_modify_range() on every vivid_dev instance, including
> this one after it has been freed.
>
> Add the missing cancel_work_sync() next to the hdmi sibling, before
> vivid_free_controls() releases the control handlers the work uses.
>
> This issue was found by an in-house static analysis tool.
>
> Fixes: d7c969f37515 ("media: vivid: Add 'Is Connected To' menu controls")
> Cc: [email protected]
> Assisted-by: Codex:gpt-5.6
> Co-developed-by: Song Li <[email protected]>
> Signed-off-by: Song Li <[email protected]>
> Signed-off-by: Fan Wu <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/test-drivers/vivid/vivid-core.c | 1 +
1 file changed, 1 insertion(+)
---
diff --git a/drivers/media/test-drivers/vivid/vivid-core.c
b/drivers/media/test-drivers/vivid/vivid-core.c
index 62cfb5feb2cf..c042d92db175 100644
--- a/drivers/media/test-drivers/vivid/vivid-core.c
+++ b/drivers/media/test-drivers/vivid/vivid-core.c
@@ -854,6 +854,7 @@ static void vivid_dev_release(struct v4l2_device *v4l2_dev)
struct vivid_dev *dev = container_of(v4l2_dev, struct vivid_dev,
v4l2_dev);
cancel_work_sync(&dev->update_hdmi_ctrl_work);
+ cancel_work_sync(&dev->update_svid_ctrl_work);
vivid_free_controls(dev);
v4l2_device_unregister(&dev->v4l2_dev);
#ifdef CONFIG_MEDIA_CONTROLLER
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
