On Tue Sep 15 22:05:11 2026 +0800, Guangshuo Li wrote:
> rkvdec_probe() obtains a provider-owned SRAM pool with
> of_gen_pool_get(), but its error path incorrectly destroys the borrowed
> pool with gen_pool_destroy().
>
> of_gen_pool_get() returns a pool managed by the SRAM provider. The pool
> is not created or owned by the rkvdec driver and is destroyed by the
> provider when its own managed resources are released.
>
> Destroying it when rkvdec_v4l2_init() fails can invalidate the pool
> while the provider and other consumers still reference it, and can also
> result in the provider attempting to destroy it again later.
>
> Remove the incorrect gen_pool_destroy() call from the probe failure
> path.
>
> This issue was found by manual code inspection.
>
> Fixes: e5640dbb991c ("media: rkvdec: Add RCB and SRAM support")
> Cc: [email protected]
> Signed-off-by: Guangshuo Li <[email protected]>
> Reviewed-by: Detlev Casanova <[email protected]>
> Signed-off-by: Nicolas Dufresne <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/rockchip/rkvdec/rkvdec.c | 3 ---
1 file changed, 3 deletions(-)
---
diff --git a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
index 13d13c041509..f43754ae857d 100644
--- a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
+++ b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
@@ -1855,9 +1855,6 @@ err_disable_runtime_pm:
pm_runtime_dont_use_autosuspend(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- if (rkvdec->sram_pool)
- gen_pool_destroy(rkvdec->sram_pool);
-
return ret;
}
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
