An open video instance holds a plain pointer to its devm-allocated core. Unbinding the core or its parent through sysfs can release that memory while the instance remains open. A later ioctl or close then uses the stale pointer. The video file operations pin the module, but sysfs unbind bypasses that protection. Suppress manual bind and unbind for both platform drivers, and warn if core removal ever encounters a live instance. Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- drivers/media/platform/amphion/vpu_core.c | 3 +++ drivers/media/platform/amphion/vpu_drv.c | 1 + 2 files changed, 4 insertions(+) diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c index a0c58ec97a42..2e8e08e05de7 100644 --- a/drivers/media/platform/amphion/vpu_core.c +++ b/drivers/media/platform/amphion/vpu_core.c @@ -696,6 +696,8 @@ static void vpu_core_remove(struct platform_device *pdev) struct vpu_core *core = platform_get_drvdata(pdev); int ret; + WARN_ON(!list_empty(&core->instances)); + vpu_core_remove_dbgfs_file(core); ret = pm_runtime_resume_and_get(dev); WARN_ON(ret < 0); @@ -846,6 +848,7 @@ static struct platform_driver amphion_vpu_core_driver = { .remove = vpu_core_remove, .driver = { .name = "amphion-vpu-core", + .suppress_bind_attrs = true, .of_match_table = vpu_core_dt_match, .pm = &vpu_core_pm_ops, }, diff --git a/drivers/media/platform/amphion/vpu_drv.c b/drivers/media/platform/amphion/vpu_drv.c index 2cca61f41bea..9c6f32c5eae9 100644 --- a/drivers/media/platform/amphion/vpu_drv.c +++ b/drivers/media/platform/amphion/vpu_drv.c @@ -205,6 +205,7 @@ static struct platform_driver amphion_vpu_driver = { .remove = vpu_remove, .driver = { .name = "amphion-vpu", + .suppress_bind_attrs = true, .of_match_table = vpu_dt_match, }, }; -- 2.53.0