Hi Ezequiel,
On Mon, 2020-12-28 at 09:21 -0300, Ezequiel Garcia wrote:
> The csc/scaler device pointer (imxmd->m2m_vdev) is assigned
> after the imx media device v4l2-async probe completes,
> therefore we need to check if the device is non-NULL
> before trying to unregister it.
>
> This can be the case if the non-completed imx media device
> is unbinded (or the driver is removed), leading to a kernel oops.
>
> Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
> Signed-off-by: Ezequiel Garcia <ezequiel@xxxxxxxxxxxxx>
> ---
> drivers/staging/media/imx/imx-media-dev.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/media/imx/imx-media-dev.c b/drivers/staging/media/imx/imx-media-dev.c
> index 6d2205461e56..b6d5f844ad79 100644
> --- a/drivers/staging/media/imx/imx-media-dev.c
> +++ b/drivers/staging/media/imx/imx-media-dev.c
> @@ -107,10 +107,14 @@ static int imx_media_remove(struct platform_device *pdev)
>
> v4l2_info(&imxmd->v4l2_dev, "Removing imx-media\n");
>
> + if (imxmd->m2m_vdev) {
Thank you, it's even worse. If imx_media_csc_scaler_device_init() fails
in imx6_media_probe_complete(), imxmd->m2m_vdev contains an error value.
So either this should check
if (!IS_ERR_OR_NULL(imxmd->m2m_vdev))
or (probably better) probe_complete should be changed as well.
> + imx_media_csc_scaler_device_unregister(imxmd->m2m_vdev);
> + imxmd->m2m_vdev = NULL;
> + }
> +
> v4l2_async_notifier_unregister(&imxmd->notifier);
> imx_media_unregister_ipu_internal_subdevs(imxmd);
> v4l2_async_notifier_cleanup(&imxmd->notifier);
> - imx_media_csc_scaler_device_unregister(imxmd->m2m_vdev);
> media_device_unregister(&imxmd->md);
> v4l2_device_unregister(&imxmd->v4l2_dev);
> media_device_cleanup(&imxmd->md);
regards
Philipp
