[PATCH] media: rkvdec: do not destroy borrowed SRAM pool

[Detlev Casanova]

Hi Guangshuo,

On Tuesday, 15 September 2026 10:05:11 EDT Guangshuo Li wrote:
> rkvdec_probe() obtains a provider-owned SRAM pool with
> of_gen_pool_get(), but its error path incorrectly destroys the borrowed
> pool with gen_pool_destroy().
> 
> of_gen_pool_get() returns a pool managed by the SRAM provider. The pool
> is not created or owned by the rkvdec driver and is destroyed by the
> provider when its own managed resources are released.
> 
> Destroying it when rkvdec_v4l2_init() fails can invalidate the pool
> while the provider and other consumers still reference it, and can also
> result in the provider attempting to destroy it again later.
> 
> Remove the incorrect gen_pool_destroy() call from the probe failure
> path.

This is indeed invalid, as the gen_pool is already created when this driver is 
being probe()'d.
The sram module can only be built-in, not a module, so we know that the 
gen_pool will never be destroyed while rkvdec uses it. That allows rkvdec to 
just get the pool pointer and not have to call a matching put() function as 
there is no need for ref counting.

Reviewed-by: Detlev Casanova <detlev.casanova at collabora.com>

> This issue was found by manual code inspection.
> 
> Fixes: e5640dbb991c ("media: rkvdec: Add RCB and SRAM support")
> Cc: stable at vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244 at gmail.com>
> ---
>  drivers/media/platform/rockchip/rkvdec/rkvdec.c | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> b/drivers/media/platform/rockchip/rkvdec/rkvdec.c index
> 061281f903f3..4541ef9ee3b9 100644
> --- a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> +++ b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> @@ -1857,9 +1857,6 @@ static int rkvdec_probe(struct platform_device *pdev)
>  	pm_runtime_dont_use_autosuspend(&pdev->dev);
>  	pm_runtime_disable(&pdev->dev);
> 
> -	if (rkvdec->sram_pool)
> -		gen_pool_destroy(rkvdec->sram_pool);
> -
>  	return ret;
>  }

Regards,
Detlev.