linux-kernel - [PATCH 3/3] media: wave5: Fix device cleanup order to prevent kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251203040935.2685490-4-xulin.sun@windriver.com>
Date: Wed,  3 Dec 2025 12:09:35 +0800
From: Xulin Sun <xulin.sun@...driver.com>
To: nas.chung@...psnmedia.com, jackson.lee@...psnmedia.com, mchehab@...nel.org
Cc: linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        xulin.sun@...driver.com
Subject: [PATCH 3/3] media: wave5: Fix device cleanup order to prevent kernel panic

Symptom:
  Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP
  Modules linked in: wave5 rpmsg_ctrl rpmsg_char ...
  CPU: 0 UID: 0 PID: 1520 Comm: vpu_irq_thread Tainted: G   M    W
  pc : wave5_vdi_read_register+0x10/0x38 [wave5]
  lr : wave5_vpu_irq_work_fn+0x28/0x60 [wave5]

  Call trace:
   wave5_vdi_read_register+0x10/0x38 [wave5]
   kthread_worker_fn+0xd8/0x238
   kthread+0x104/0x120
   ret_from_fork+0x10/0x20
  Code: aa1e03e9 d503201f f9416800 8b214000 (b9400000)
  ---[ end trace 0000000000000000 ]---
  Kernel panic - not syncing: synchronous external abort: Fatal exception

Root cause:
  In polling mode, the hrtimer periodically triggers wave5_vpu_timer_callback()
  which queues work to the kthread worker. The worker executes
  wave5_vpu_irq_work_fn() which reads hardware registers via
  wave5_vdi_read_register().

  The original cleanup order was:
  1) Disable PM runtime and power down hardware
  2) Unregister video devices

  When autosuspend triggers and powers off the hardware, the video
  devices are still registered and the worker thread can still be
  triggered by the hrtimer, causing it to attempt reading registers
  from powered-off hardware. This results in a bus error (synchronous
  external abort) and kernel panic.

Fix:
  Move video device unregistration (wave5_vpu_enc_unregister_device,
  wave5_vpu_dec_unregister_device, v4l2_device_unregister) to the beginning
  of wave5_vpu_remove(), before worker cleanup and PM runtime disable.

  This ensures video operations stop before any hardware access mechanisms
  are cleaned up, following the pattern used by other V4L2 drivers (pisp_be, rga).

Signed-off-by: Xulin Sun <xulin.sun@...driver.com>
---
 drivers/media/platform/chips-media/wave5/wave5-vpu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 0bcd48df49d0..77d6c934d0b9 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -351,6 +351,10 @@ static void wave5_vpu_remove(struct platform_device *pdev)
 {
 	struct vpu_device *dev = dev_get_drvdata(&pdev->dev);

+	wave5_vpu_enc_unregister_device(dev);
+	wave5_vpu_dec_unregister_device(dev);
+	v4l2_device_unregister(&dev->v4l2_dev);
+
 	if (dev->irq < 0) {
 		hrtimer_cancel(&dev->hrtimer);
 		kthread_cancel_work_sync(&dev->work);
@@ -364,9 +368,6 @@ static void wave5_vpu_remove(struct platform_device *pdev)
 	mutex_destroy(&dev->hw_lock);
 	reset_control_assert(dev->resets);
 	clk_bulk_disable_unprepare(dev->num_clks, dev->clks);
-	wave5_vpu_enc_unregister_device(dev);
-	wave5_vpu_dec_unregister_device(dev);
-	v4l2_device_unregister(&dev->v4l2_dev);
 	wave5_vdi_release(&pdev->dev);
 	ida_destroy(&dev->inst_ida);
 }
-- 
2.49.1