From nobody Mon Jun 8 22:00:49 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 735223DA7EE for ; Tue, 26 May 2026 12:22:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779798140; cv=none; b=mj34fcXCoSia9QII/hbWhKK7yZpcGd8fArETIJaotDEb6i6v+2qBaeRXwMe7hJp5uVK9j+fKsx6GzTYik5KgvnI+9UfaMNod6ugzYl+3SuAx5b9iqmmbj0yGE7A/k78K5ECTr2TnucE5J2zKukVy0usvU0cXSAVlnNpUOrxtDeM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779798140; c=relaxed/simple; bh=AXtwezzLoCGxwF0CydKIJ/MZv+sX+BtL3/6cQf3SnXE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qukSUVLfr/3UNwUPU7pvNMShobzFpQI6NiU+ZL520fmFP1tU4zs2dBq/wHYiMaXtbdAO/AlZGNoLWBClWHMcaNcTrTzp+qY7HKoVeOnYHlQ+JWSjlmLVNFVJTstd0JI9iuedXMVzC8l5gCHmXHIUXbdnshRU/FyqIOp1gghDYug= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=mju.ac.kr; spf=pass smtp.mailfrom=mju.ac.kr; dkim=pass (2048-bit key) header.d=mju-ac-kr.20251104.gappssmtp.com header.i=@mju-ac-kr.20251104.gappssmtp.com header.b=pc85n44F; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=mju.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mju.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=mju-ac-kr.20251104.gappssmtp.com header.i=@mju-ac-kr.20251104.gappssmtp.com header.b="pc85n44F" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-36a35e4eefeso3638337a91.1 for ; Tue, 26 May 2026 05:22:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mju-ac-kr.20251104.gappssmtp.com; s=20251104; t=1779798137; x=1780402937; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=D5pp2GVwoUtQ80LYt6zY3fggW5ulozvNln+1jo2wsGI=; b=pc85n44F52vGdFc722ar6sIIgpoJbpfycBaf8TCfqSlkVbjjp3WXa2RsVC096HlHvn znqFhPnf3UqQljcZX3r2iHtHi9jzSLvSI3Xu4B1B1oAs4xC1CrwW4jFNthorw6xiwvSr c7/Lvv/EmtKAraUn6xD5ZdQ8/gp7K8QbRkx6jQdmS26orOghVu0pwYwZaojBLI9X6Rvq QMNmFTnDvspxnLBOxi/9w15txJ5QaeAmcORIMu5JwnVpDEPvwkpffe7MBZ7Vy46U4T7P M6Mv6Qg88DnQKy8JBwJKggQ004mEBwg8gmrIVUwiU1z3fllP4g/bTXqcRuyAisrq7IVR eZQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779798137; x=1780402937; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=D5pp2GVwoUtQ80LYt6zY3fggW5ulozvNln+1jo2wsGI=; b=SR+J+DIsTcq1eDdldgiHBG5kF5wdRE70qvlKT0SzEEEyHy+HPjKGqS9pBJfoEmUUif A3HeWOmTIhNiWENf4B70QAxPizcZgMoXHiMozL5iypN5Mz7eu22T9wZpY1bdkejJJ7jq 4RgzABJTJCxSjoSb04fuVZowpfTg1qrCq6rsJBiOW7/TLQyF5wOwrJx7toVWc9ycrwSW +RiO8tZSdPv6OLeO06++pxFDgPAun1ShSFOnXSONh2rqrwXll3GmWMHHKYCn4NuhIJIJ CK9cDckcSgyG2zRVS+nHXMCks1C3BC32ZQuzrYLOzZfNbFO7ArQYi/H+ljG7AJgfPvHj EtUQ== X-Forwarded-Encrypted: i=1; AFNElJ8CzZK6t7r5xWQdOMcR5QSFAT6D1IaDlSXn78WsrydUl9czGkzen+syzuasoM6XdgT9WJsLH+WL5csrfnE=@vger.kernel.org X-Gm-Message-State: AOJu0YwexwtRco/xkMS6EN51SKcy1HbvHYX7I+eWgZX+5KO9Mq0j6k1G caeH/11BxXb283p0Q0ccXwGN4OseZxb7EDSqEfNLP7EG4wa4cKKFfQ3rqM0u15ds48k= X-Gm-Gg: Acq92OEpFs78tXW7fpj8P3GNTya1FwgTIX/4+wilIprDR2gDYfY88Lv0nuCMGmoz5P8 hs40ec5Q8P746dqDx7LJ+MJYBhfP75BrETfcDKdNYWPZzSWheyOe5p91hEffN3b7L93AioKOGvf Tb996ah+yDIhfU1p/8K1ttOC9UjugZzKtkcyPRqLfex8nsatL+KvPvOjMLVTriBfp35NRKajkFG 34Au+W+zrT/6PpBD6AXo20n0lhbrk4WcJDyVV9ey98pXatpea3hqEq091YsBLFthDf3HbuZ1R9f kQfCmkDsa8DSL8C7V+dr4u26EVIFXCP5SagGMGucNCxXO3lpAorX/lTNw5JbN9xV3+YDlNLdU9V 1XXhzGwfM0BYNzjeG/nRVbVOKDDRNb7qEsZb5t1v/xxe9yc1I87Wfvcp78xXwIn3TiMi9QIQE78 ekH0g8if5lwfYuEP4iAd4CfHVr5xFoIqLvQCLhUKoEcJE= X-Received: by 2002:a17:90b:2f84:b0:35f:b714:e516 with SMTP id 98e67ed59e1d1-36a674f4399mr18640295a91.16.1779798137481; Tue, 26 May 2026 05:22:17 -0700 (PDT) Received: from younhochoi-MS-7C82.. ([117.17.158.201]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36a723cee01sm12089470a91.14.2026.05.26.05.22.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 May 2026 05:22:17 -0700 (PDT) From: Younho Choi To: linux-media@vger.kernel.org Cc: mchehab@kernel.org, hverkuil+cisco@kernel.org, laurent.pinchart@ideasonboard.com, sakari.ailus@linux.intel.com, benjamin.gaignard@collabora.com, ysk@kzalloc.com, kees@kernel.org, linux-kernel@vger.kernel.org, Younho Choi , stable@vger.kernel.org Subject: [PATCH] media: vim2m: keep transaction buffer count stable while streaming Date: Tue, 26 May 2026 21:22:05 +0900 Message-ID: <20260526122205.1019913-1-gdool88@mju.ac.kr> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" V4L2_CID_TRANS_NUM_BUFS controls how many buffer pairs a vim2m mem2mem job processes before the job is completed. The driver stores the value in ctx->translen and device_work() uses it later to decide whether the current transaction should continue. Letting userspace change this control while streaming is active can make a queued job observe a different transaction length than the one it started with. That leaves the transaction state inconsistent with the buffers currently queued for the job. Grab the transaction buffer count control while either queue is streaming, and release it only after both queues have stopped streaming. The V4L2 control framework then rejects changes with -EBUSY while the value is in use, while still allowing userspace to configure the value before streaming starts. Keep the control handler alive until after v4l2_m2m_ctx_release(), since releasing the mem2mem context can call stop_streaming(), which now ungrabs the control. Fixes: 96d8eab5d0a1 ("V4L/DVB: [v5,2/2] v4l: Add a mem-to-mem videobuf fram= ework test device") Cc: stable@vger.kernel.org Signed-off-by: Younho Choi --- drivers/media/test-drivers/vim2m.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-driver= s/vim2m.c index bb2dd11eef0e..f4a2c4083829 100644 --- a/drivers/media/test-drivers/vim2m.c +++ b/drivers/media/test-drivers/vim2m.c @@ -205,6 +205,7 @@ struct vim2m_ctx { struct vim2m_dev *dev; =20 struct v4l2_ctrl_handler hdl; + struct v4l2_ctrl *trans_num_bufs_ctrl; =20 /* Processed buffers in this transaction */ u8 num_processed; @@ -1258,9 +1259,27 @@ static int vim2m_start_streaming(struct vb2_queue *q= , unsigned int count) ctx->aborting =3D 0; =20 q_data->sequence =3D 0; + v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, true); + return 0; } =20 +static bool vim2m_other_queue_is_streaming(struct vim2m_ctx *ctx, + struct vb2_queue *q) +{ + struct vb2_queue *other_vq; + + if (!ctx->fh.m2m_ctx) + return false; + + if (V4L2_TYPE_IS_OUTPUT(q->type)) + other_vq =3D v4l2_m2m_get_dst_vq(ctx->fh.m2m_ctx); + else + other_vq =3D v4l2_m2m_get_src_vq(ctx->fh.m2m_ctx); + + return vb2_is_streaming(other_vq); +} + static void vim2m_stop_streaming(struct vb2_queue *q) { struct vim2m_ctx *ctx =3D vb2_get_drv_priv(q); @@ -1274,11 +1293,14 @@ static void vim2m_stop_streaming(struct vb2_queue *= q) else vbuf =3D v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); if (!vbuf) - return; + break; v4l2_ctrl_request_complete(vbuf->vb2_buf.req_obj.req, &ctx->hdl); v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR); } + + if (!vim2m_other_queue_is_streaming(ctx, q)) + v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, false); } =20 static void vim2m_buf_request_complete(struct vb2_buffer *vb) @@ -1380,7 +1402,8 @@ static int vim2m_open(struct file *file) =20 vim2m_ctrl_trans_time_msec.def =3D default_transtime; v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_time_msec, NULL); - v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL); + ctx->trans_num_bufs_ctrl =3D + v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL); if (hdl->error) { rc =3D hdl->error; v4l2_ctrl_handler_free(hdl); @@ -1435,10 +1458,10 @@ static int vim2m_release(struct file *file) =20 v4l2_fh_del(&ctx->fh, file); v4l2_fh_exit(&ctx->fh); - v4l2_ctrl_handler_free(&ctx->hdl); mutex_lock(&dev->dev_mutex); v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); mutex_unlock(&dev->dev_mutex); + v4l2_ctrl_handler_free(&ctx->hdl); kfree(ctx); =20 atomic_dec(&dev->num_inst); base-commit: 5d6919055dec134de3c40167a490f33c74c12581 --=20 2.43.0