On Fri, Oct 28, 2022 at 10:19:26AM +0200, luca.ceresoli@xxxxxxxxxxx wrote:
> From: Luca Ceresoli <luca.ceresoli@xxxxxxxxxxx>
>
> At probe time this code path is followed:
>
> * tegra_csi_init
> * tegra_csi_channels_alloc
> * for_each_child_of_node(node, channel) -- iterates over channels
> * automatically gets 'channel'
> * tegra_csi_channel_alloc()
> * saves into chan->of_node a pointer to the channel OF node
> * automatically gets and puts 'channel'
> * now the node saved in chan->of_node has refcount 0, can disappear
> * tegra_csi_channels_init
> * iterates over channels
> * tegra_csi_channel_init -- uses chan->of_node
>
> After that, chan->of_node keeps storing the node until the device is
> removed.
>
> of_node_get() the node and of_node_put() it during teardown to avoid any
> risk.
>
> Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
> Cc: stable@xxxxxxxxxxxxxxx
> Cc: Sowjanya Komatineni <skomatineni@xxxxxxxxxx>
> Signed-off-by: Luca Ceresoli <luca.ceresoli@xxxxxxxxxxx>
> ---
> drivers/staging/media/tegra-video/csi.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
> index b26e44adb2be..1b05f620b476 100644
> --- a/drivers/staging/media/tegra-video/csi.c
> +++ b/drivers/staging/media/tegra-video/csi.c
> @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
> for (i = 0; i < chan->numgangports; i++)
> chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
>
> - chan->of_node = node;
> + chan->of_node = of_node_get(node);
> chan->numpads = num_pads;
> if (num_pads & 0x2) {
> chan->pads[0].flags = MEDIA_PAD_FL_SINK;
> @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi)
> media_entity_cleanup(&subdev->entity);
> }
>
> + of_node_put(chan->of_node);
> list_del(&chan->list);
> kfree(chan);
Not related to your patch, but this kind of "one function cleans up
everything" style is always buggy. For example, here it should be:
- if (chan->mipi)
+ if (!IS_ERR_OR_NULL(chan->mipi))
tegra_mipi_free(chan->mipi);
regards,
dan carpenter
