Hi Niklas, On Thursday, 16 November 2017 01:34:33 EET Niklas Söderlund wrote: > On 2017-11-16 00:49:07 +0200, Laurent Pinchart wrote: > > The rvin_dev data structure contains driver private data for an instance > > of the VIN. It is allocated dynamically at probe time, and must be freed > > once all users are gone. > > > > The structure is currently allocated with devm_kzalloc(), which results > > in memory being freed when the device is unbound. If a userspace > > application is currently performing an ioctl call, or just keeps the > > device node open and closes it later, this will lead to accessing freed > > memory. > > > > Fix the problem by implementing a V4L2 release handler for the video > > node associated with the VIN instance (called when the last user of the > > video node releases it), and freeing memory explicitly from the release > > handler. > > > > Signed-off-by: Laurent Pinchart > > <laurent.pinchart+renesas@xxxxxxxxxxxxxxxx> > > Acked-by: Niklas Söderlund <niklas.soderlund+renesas@xxxxxxxxxxxx> > > This patch is based on-top of the VIN Gen3 enablement series not yet > upstream. This is OK for me, just wanted to check that this was the > intention as to minimize conflicts between the two. Yes, that's my intention. The patch should be included, or possibly squashed in, your development branch. -- Regards, Laurent Pinchart
