Skip to content

Correctly unbind CFE - #7624

Open
naushir wants to merge 3 commits into
raspberrypi:rpi-6.18.yfrom
naushir:cfe_unbind
Open

naushir wants to merge 3 commits into
raspberrypi:rpi-6.18.yfrom
naushir:cfe_unbind

Conversation

@naushir

@naushir naushir commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

No description provided.

cfe_register_node() initialises the node vb2 queue but cfe_unregister_nodes()
never released it, causing a memory leak.

Release the queue after unregistering the video device so that the driver
can be removed, and nodes can later be re-registered without leaking
memory.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
After a node is unregistered its embedded video_device still carries the
released struct device and kobject state. Re-registering it triggered a
"tried to init an initialized object" and use-after-free situation.

Reset the video_device before registering it so that the node can be
re-registered after the source subdev is rebound.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Rebinding or reloading the source sensor driver caused the notifier
.complete() callback to run a second time and register duplicate video
device entities and links on the media device. This would hit a BUG in
media_gobj_create().

Add an .unbind() callback that unregisters the video nodes, removes the
CSI2 and FE links and clears the source pointer, so that the graph is
rebuilt from scratch on the next .complete().

Tested on Pi 5 with an IMX219 using:

  echo 11-0010 | sudo tee /sys/bus/i2c/drivers/imx219/unbind
  echo 11-0010 | sudo tee /sys/bus/i2c/drivers/imx219/bind

  echo 11-0010 | sudo tee /sys/bus/i2c/drivers/imx219/unbind
  sudo rmmod imx219
  sudo modprobe imx219

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
@naushir
naushir requested a review from 6by9 September 14, 2026 14:36
@6by9

6by9 commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

It looks like this applies to the downstream Unicam driver too. (I've never really played with unbinding drivers like that)

@naushir

naushir commented Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

It looks like this applies to the downstream Unicam driver too. (I've never really played with unbinding drivers like that)

s/downstream/upstream?

The unbinding/rebinding is something we might possibly use during production test.

@6by9 6by9 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not tested, but looks sane.

It seems odd that so few media platform drivers use the unbind hook as it does appear to be necessary in order to cleanup.
Unloading CFE first and then the sensor driver should generally be clean, and that's what I tend to be doing.

The mainline CFE driver also doesn't have an unbind hook.

@6by9

6by9 commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

It looks like this applies to the downstream Unicam driver too. (I've never really played with unbinding drivers like that)

s/downstream/upstream?

I'd looked at downstream, but both downstream and upstream driver for both CFE and Unicam seem to have this omission.
I have a Pi4 booted, so can see what I get if I try unbinding.

@naushir

naushir commented Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

Yeah, it's not really something users would normally do day-to-day.

@naushir

naushir commented Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

I will post this for the upstream driver as well.

@6by9

6by9 commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

(Confirmed that the downstream Unicam driver also blows up if you try unbind and rebind, but that is independent of this PR)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants