linux-stable.git/drivers/media/platform/nxp, branch linux-rolling-stable

media: nxp: imx8-isi: Fix use-after-free on remove

2026-07-18T14:55:28+00:00

commit b670bf89824ede5d07d20bb9bfbafb754846081d upstream.

KASAN reports a slab-use-after-free in __media_entity_remove_link()
during rmmod of imx8_isi:

  BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650
  Read of size 2 at addr ffff0000d47cb02a by task rmmod/724

  Call trace:
   __media_entity_remove_link+0x608/0x650
   __media_entity_remove_links+0x78/0x144
   __media_device_unregister_entity+0x150/0x280
   media_device_unregister_entity+0x48/0x68
   v4l2_device_unregister_subdev+0x158/0x300
   v4l2_async_unbind_subdev_one+0x22c/0x358
   v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0
   v4l2_async_nf_unregister+0x5c/0x14c
   mxc_isi_remove+0x124/0x2a0 [imx8_isi]

  Allocated by task 249:
   __kmalloc_noprof+0x27c/0x690
   mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi]

  Freed by task 724:
   kfree+0x1e4/0x5b0
   mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi]
   mxc_isi_remove+0x11c/0x2a0 [imx8_isi]

The problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup()
before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media
entity pads, but the subsequent v4l2 cleanup still tries to remove
media links that reference those pads.

Fix this by calling mxc_isi_v4l2_cleanup() before
mxc_isi_crossbar_cleanup() to ensure all media entities are properly
unregistered while the pads are still valid.

Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaolei Wang 
Reviewed-by: Frank Li 
Reviewed-by: Laurent Pinchart 
Link: https://patch.msgid.link/20260507041318.491594-2-xiaolei.wang@windriver.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: imx8mq-mipi-csi2: Add support for i.MX8ULP

2026-03-24T21:14:45+00:00

The CSI-2 receiver in i.MX8ULP is almost same as i.MX8QXP/QM except
clocks and resets, so add compatible string for i.MX8ULP to handle
the difference and reuse platform data of i.MX8QXP/QM.

Reviewed-by: Frank Li 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Guoniu Zhou 
Link: https://patch.msgid.link/20251205-csi2_imx8ulp-v10-4-190cdadb20a3@nxp.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil

media: imx8mq-mipi-csi2: Explicitly release reset

2026-03-24T21:14:44+00:00

Call reset_control_deassert() to explicitly release reset to make sure
reset bits are cleared since platform like i.MX8ULP can't clear reset
bits automatically.

Reviewed-by: Frank Li 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Guoniu Zhou 
Link: https://patch.msgid.link/20251205-csi2_imx8ulp-v10-3-190cdadb20a3@nxp.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil

media: imx8mq-mipi-csi2: Use devm_clk_bulk_get_all() to fetch clocks

2026-03-24T21:14:44+00:00

Use devm_clk_bulk_get_all() helper to simplify clock handle code.

No functional changes intended.

Reviewed-by: Frank Li 
Signed-off-by: Guoniu Zhou 
Reviewed-by: Laurent Pinchart 
Link: https://patch.msgid.link/20251205-csi2_imx8ulp-v10-2-190cdadb20a3@nxp.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil

media: nxp: imx8-isi: Add ISI support for i.MX95

2026-03-24T21:14:44+00:00

The ISI module on i.MX95 supports up to eight channels and four link
sources to obtain the image data for processing in its pipelines. It
can process up to eight image sources at the same time.

Add ISI basic functions support for i.MX95.

Reviewed-by: Frank Li 
Signed-off-by: Guoniu Zhou 
Reviewed-by: Laurent Pinchart 
Link: https://patch.msgid.link/20251105-isi_imx95-v3-3-3987533cca1c@nxp.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil

media: nxp: imx8-isi: Keep the default value for BLANK_PXL field

2026-03-24T21:14:44+00:00

The field BLANK_PXL provides the value of the blank pixel to be inserted
in the image in case an overflow error occurs in the output buffers of
the channel. Its default value is 0xff, so no need to set again.

Besides, the field only exist in i.MX8QM/XP ISI version. Other versions
like i.MX 8M series, remove the field since it won't send data to AXI bus
when overflow error occurs and mark BLANK_PXL as reserved. i.MX9 series
use it for other purposes.

Reviewed-by: Laurent Pinchart 
Reviewed-by: Frank Li 
Signed-off-by: Guoniu Zhou 
Link: https://patch.msgid.link/20251105-isi_imx95-v3-2-3987533cca1c@nxp.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil

media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0

2026-03-24T21:14:44+00:00

Fix a hang issue when capturing a single frame with applications like cam
in libcamera. It would hang waiting for the driver to complete the buffer,
but streaming never starts because min_queued_buffers was set to 2.

The ISI module uses a ping-pong buffer mechanism that requires two buffers
to be programmed at all times. However, when fewer than 2 user buffers are
available, the driver use internal discard buffers to fill the remaining
slot(s). Reduce minimum queued buffers from 2 to 0 allows streaming to
start without any queued buffers.

Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guoniu Zhou 
Reviewed-by: Laurent Pinchart 
Link: https://patch.msgid.link/20260312-isi_min_buffers-v2-1-d5ea1c79ad81@nxp.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil

media: dw100: Merge dw100_device_run and dw100_start

2026-03-24T21:14:44+00:00

The dw100_start() function is only called from dw100_device_run(). As
both functions are not too big, move the code directly into
dw100_device_run() and drop dw100_start() to improve readability.

This patch contains no functional changes.

Signed-off-by: Stefan Klug 
Reviewed-by: Xavier Roumegue 
Reviewed-by: Laurent Pinchart 
Link: https://patch.msgid.link/20260304-sklug-v6-16-topic-dw100-v3-1-dev-v5-4-1a7e1f721b50@ideasonboard.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil

media: dw100: Fix kernel oops with PREEMPT_RT enabled

2026-03-24T21:14:44+00:00

On kernels with PREEMPT_RT enabled, a "BUG: scheduling while atomic"
kernel oops occurs inside dw100_irq_handler -> vb2_buffer_done. This is
because vb2_buffer_done takes a spinlock which is not allowed within
interrupt context on PREEMPT_RT.

The first attempt to fix this was to just drop the IRQF_ONESHOT so that
the interrupt is handled threaded on PREEMPT_RT systems. This introduced
a new issue. The dw100 has an internal timeout counter that is gated by
the DW100_BUS_CTRL_AXI_MASTER_ENABLE bit. Depending on the time it takes
for the threaded handler to run and the geometry of the data being
processed it is possible to reach the timeout resulting in
DW100_INTERRUPT_STATUS_INT_ERR_TIME_OUT being set and "dw100
32e30000.dwe: Interrupt error: 0x1" errors in dmesg.

To properly fix that, split the interrupt into two halves, reset the
DW100_BUS_CTRL_AXI_MASTER_ENABLE bit in the hard interrupt handler and
do the v4l2 buffer handling in the threaded half. The IRQF_ONESHOT can
still be dropped as the interrupt gets disabled in the hard handler and
will only be reenabled on the next dw100_device_run which will not be
called before the current job has finished.

Signed-off-by: Stefan Klug 
Reviewed-by: Xavier Roumegue 
Reviewed-by: Laurent Pinchart 
Link: https://patch.msgid.link/20260304-sklug-v6-16-topic-dw100-v3-1-dev-v5-3-1a7e1f721b50@ideasonboard.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil

media: dw100: Implement dynamic vertex map update

2026-03-24T21:14:44+00:00

Implement dynamic vertex map updates by handling the
V4L2_CID_DW100_DEWARPING_16x16_VERTEX_MAP control during streaming. This
allows to implement features like dynamic zoom, pan, rotate and dewarp.

To stay compatible with the old version, updates of
V4L2_CID_DW100_DEWARPING_16x16_VERTEX_MAP are ignored during streaming
when requests are not used. Print a corresponding warning once.

Signed-off-by: Stefan Klug 
Reviewed-by: Laurent Pinchart 
Link: https://patch.msgid.link/20260304-sklug-v6-16-topic-dw100-v3-1-dev-v5-2-1a7e1f721b50@ideasonboard.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil