From 96ea6bc6835f1b18b75303d536a7f9a3829c9bc1 Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Fri, 25 Sep 2026 15:17:06 -0400 Subject: [PATCH] media: amphion: prevent unbind while video instances are open An open video instance holds a plain pointer to its devm-allocated core. Unbinding the core or its parent through sysfs can release that memory while the instance remains open. A later ioctl or close then uses the stale pointer. The video file operations pin the module, but sysfs unbind bypasses that protection. Suppress manual bind and unbind for both platform drivers, and warn if core removal ever encounters a live instance. Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Reviewed-by: Ming Qian Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil --- drivers/media/platform/amphion/vpu_core.c | 3 +++ drivers/media/platform/amphion/vpu_drv.c | 1 + 2 files changed, 4 insertions(+) diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c index a0c58ec97a42..2e8e08e05de7 100644 --- a/drivers/media/platform/amphion/vpu_core.c +++ b/drivers/media/platform/amphion/vpu_core.c @@ -696,6 +696,8 @@ static void vpu_core_remove(struct platform_device *pdev) struct vpu_core *core = platform_get_drvdata(pdev); int ret; + WARN_ON(!list_empty(&core->instances)); + vpu_core_remove_dbgfs_file(core); ret = pm_runtime_resume_and_get(dev); WARN_ON(ret < 0); @@ -846,6 +848,7 @@ static struct platform_driver amphion_vpu_core_driver = { .remove = vpu_core_remove, .driver = { .name = "amphion-vpu-core", + .suppress_bind_attrs = true, .of_match_table = vpu_core_dt_match, .pm = &vpu_core_pm_ops, }, diff --git a/drivers/media/platform/amphion/vpu_drv.c b/drivers/media/platform/amphion/vpu_drv.c index 2cca61f41bea..9c6f32c5eae9 100644 --- a/drivers/media/platform/amphion/vpu_drv.c +++ b/drivers/media/platform/amphion/vpu_drv.c @@ -205,6 +205,7 @@ static struct platform_driver amphion_vpu_driver = { .remove = vpu_remove, .driver = { .name = "amphion-vpu", + .suppress_bind_attrs = true, .of_match_table = vpu_dt_match, }, };