From nobody Mon Feb 9 11:38:57 2026 Received: from mail-ot1-f54.google.com (mail-ot1-f54.google.com [209.85.210.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C5FED34FF45 for ; Sat, 31 Jan 2026 22:03:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769897009; cv=none; b=p9MzKIwIpMRMSLWx5aliR8Ri1EGqB0zIG9ezN9gz6pJqv11KJo/jKPz8PamGp4QJ0UVs4kAvQbgf4m4y5jYWOwJAIF1N1Rmbw5euK1ciTBaRPSHqVTFFLo7vm0eeIW1DoBnNUGjj8TWFDPYjGDK1TBnSTRxU4Jvw8cdRlSM4c5k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769897009; c=relaxed/simple; bh=E42NkKsr43w5UW0DNDJA+dJWmKoqjJY/ccAHt9R9JeQ=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=kuxli+iZFvwI6i9MEnXibYKoZljFoGIWCgKHPK8rwgSE0R4fCiZvtrPVEwsr/XGX0V/8e3ort3ax3TOM2qGeBg4hxk51Zv1P/yhtdwJvF5X8Oqtl/1N+NABLBUYhLDK3h5vb9T0yIZOX46csPDh7lwjKnpIYYM6ANr2Ac9uBV7g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=u.northwestern.edu; spf=pass smtp.mailfrom=u.northwestern.edu; dkim=pass (2048-bit key) header.d=u-northwestern-edu.20230601.gappssmtp.com header.i=@u-northwestern-edu.20230601.gappssmtp.com header.b=2Isq1ed6; arc=none smtp.client-ip=209.85.210.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=u.northwestern.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=u.northwestern.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=u-northwestern-edu.20230601.gappssmtp.com header.i=@u-northwestern-edu.20230601.gappssmtp.com header.b="2Isq1ed6" Received: by mail-ot1-f54.google.com with SMTP id 46e09a7af769-7d1959ba05cso1445943a34.2 for ; Sat, 31 Jan 2026 14:03:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=u-northwestern-edu.20230601.gappssmtp.com; s=20230601; t=1769897007; x=1770501807; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=qOiOO+E/AKv1Oz2TckUZfapY9aw2SozPHvqV8UDpspM=; b=2Isq1ed6EENkpgrQQxHFYXBoP9nWyQMAQ24MnjX4PQMcZtni5S7HUxu2KeCgk3aqla ddaMwzjiU84WJ1YIUZjrij3QJ8v0/caYaczZoJ5niZlMsaA0ceL0DxsIh5Pti2fje/Rn 2G91Fv4MJ3ng3GCKti3odhmTGU073Ap0HQv8iW9fr5uEtzbWod1I/KR0erqzObtsfTno 60TUfmvIynKlauf+M++rz+jCH3IMgbMOo4pI12DkYikVzs0ChXL9z9jBkI+JbzpKEUh9 2OdzjvXdl8p0whnGOMfQ6zyJxcrm4rbIqShWvIyClLhsiu4iiGtY7iOoHZgH7wJ78e6V AOqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769897007; x=1770501807; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=qOiOO+E/AKv1Oz2TckUZfapY9aw2SozPHvqV8UDpspM=; b=m6ce2b0WXkjoqtk8Im50WPtyurNdzQxfbERS3k7McwjqxrLqsrwFHQYQLf/wL+janU usMZyMIjNocVim1aNuUES21MTFVCXelNRJW+FP+uZ1Q2z6+R2kULgCqdUaIUelEKRLWO oXTCt8w/x7GJ/kiwAawjl3CqsXOVeOyCKGig4ewXXuRNxsa4wXDd/W/EoFvViKLyK5fa 6XXcdefDKLJruKpqE0m89iGs2Go6CLimV97ZcBjHI5nQCGDnbqBFw7Z/10bMccZXqdfd SaaK1Zxi6svBa6xmjTQVfEoAw+9V/ydwHgYivvC4qU8C0jyoVXPFZlJc33W0TbXWuj7g oPHA== X-Forwarded-Encrypted: i=1; AJvYcCVi2311mzwgCq//eC/pl0PZ4nhFhhS7+JZRBdgKlgcehgBfIZLWWDNs6+l4ZTVqEKQXEZW11yRxyUR84aE=@vger.kernel.org X-Gm-Message-State: AOJu0YxIq+gbLofhGyJ1swp1FQPEbKLpxVDq9Jot6z+n/1Wz1/xYdkAf NCmfT9PmIqJv0Oc7G/hLOwm2O90aXYxHpHvf1qfxTPkqYo3vdgS15lbxZep+LuFLbDUW9YDEQby okVqC X-Gm-Gg: AZuq6aKYFrwCHZ6LKEAadYkD9HsCdXateNhpd8fFABMZC015jffAlVq93htbT1HBeGb m2UkStWRRkR/K7GhN8Hzb9xDPOiKCP9xrQ9hIZ8LgcKZnMzkfXJqpGn2kxCp4KAXQw9Rl4KrBIw KWwI0PB8h3AlfZ2e6RUSTFYJDSaJgL84mL7RabDXXWD0R2oHmlZx3tqLp7ahWyXr+Z1L5soFRLa ASrQf9KzueX6tEBHa0E79dOyjQuTebychcmA5yMZZ99s4/C6QWk3/l3LO/CucwpZDrDYtFkx6or 8awvdT/i6Ps7RQLtqXtZA25Rke1wxuB02/MrNWh2eyYJWhz4tWkwuzc3cqXnquz3eVRNHUdTVUJ VusCRPJjpPEWMozJRm3gldb1InHs3eK7Il0u9nH1ojb+YkqYWrj1XA9k/ePKtE8l2F+yO0WtZOj C3Xk8wzYFcvSHBjWb0F/nT9BkxzgjzruQu7M1EHIvZos3D/AzuvxUiV6GpLrsLTI2Xs3e6GCiyG kGTCWcM3MSlvPIwl52HQdIPuK3dl1A= X-Received: by 2002:a05:6830:6adb:b0:7ca:c803:f539 with SMTP id 46e09a7af769-7d1a523db64mr4501190a34.5.1769897006620; Sat, 31 Jan 2026 14:03:26 -0800 (PST) Received: from security.cs.northwestern.edu (security.cs.northwestern.edu. [165.124.184.136]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7d18c67065esm7933091a34.6.2026.01.31.14.03.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 31 Jan 2026 14:03:26 -0800 (PST) From: Ziyi Guo To: Nas Chung , Jackson Lee Cc: Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Ziyi Guo Subject: [PATCH] media: chips-media: wave5: add missing spinlock protection for send_eos_event() Date: Sat, 31 Jan 2026 22:03:23 +0000 Message-Id: <20260131220323.3296745-1-n7l8m4@u.northwestern.edu> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" wave5_vpu_dec_buf_queue_dst() and streamoff_output() call send_eos_event() without holding inst->state_spinlock. However, send_eos_event() has lockdep_assert_held(&inst->state_spinlock) indicating that callers must hold this lock. Other callers of send_eos_event() properly acquire the spinlock: - wave5_vpu_dec_finish_decode() acquires lock at line 431 - wave5_vpu_dec_encoder_cmd() acquires lock at line 821 - wave5_vpu_dec_device_run() acquires lock at line 1592 Add spin_lock_irqsave()/spin_unlock_irqrestore() around send_eos_event() calls in the VB2 buffer queue and streamoff callbacks to fix the missing lock protection. Signed-off-by: Ziyi Guo --- .../media/platform/chips-media/wave5/wave5-vpu-dec.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c b/dri= vers/media/platform/chips-media/wave5/wave5-vpu-dec.c index e3038c18ca36..986feff34f22 100644 --- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c +++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c @@ -1264,13 +1264,17 @@ static void wave5_vpu_dec_buf_queue_dst(struct vb2_= buffer *vb) =20 if (vb2_is_streaming(vb->vb2_queue) && v4l2_m2m_dst_buf_is_last(m2m_ctx))= { unsigned int i; + unsigned long flags; =20 for (i =3D 0; i < vb->num_planes; i++) vb2_set_plane_payload(vb, i, 0); =20 vbuf->field =3D V4L2_FIELD_NONE; =20 + spin_lock_irqsave(&inst->state_spinlock, flags); send_eos_event(inst); + spin_unlock_irqrestore(&inst->state_spinlock, flags); + v4l2_m2m_last_buffer_done(m2m_ctx, vbuf); } else { v4l2_m2m_buf_queue(m2m_ctx, vbuf); @@ -1413,8 +1417,13 @@ static int streamoff_output(struct vb2_queue *q) inst->codec_info->dec_info.stream_rd_ptr =3D new_rd_ptr; inst->codec_info->dec_info.stream_wr_ptr =3D new_rd_ptr; =20 - if (v4l2_m2m_has_stopped(m2m_ctx)) + if (v4l2_m2m_has_stopped(m2m_ctx)) { + unsigned long flags; + + spin_lock_irqsave(&inst->state_spinlock, flags); send_eos_event(inst); + spin_unlock_irqrestore(&inst->state_spinlock, flags); + } =20 /* streamoff on output cancels any draining operation */ inst->eos =3D false; --=20 2.34.1