From nobody Mon Jun 8 09:48:03 2026 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 593AA3955DC for ; Sat, 30 May 2026 09:44:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134253; cv=none; b=cHuby1xAB3+H5pP/WeGL5n7X8FbCyRu4CRhZ0aYBvlxBif8qMcw0ozbPx0+Plg7J3sJPEYu5zCZmdpvN1zzYjOU6Vf1ousCQ1wbKNYZ4T9TcIWk6lHK8NT2a9teqk5eeRHKLEnJdGZuKImPExAOBjy8VFv0CsknSdASlxcO1E/0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134253; c=relaxed/simple; bh=HYi1dtSNwzPp1FXVv49GKGwG1ZIMD4+G6LyXrGDm/rw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iJqTebfYaJ6ETLkaN9jJaorvByHwemkaKRRnFJPk3OVFo5tytGfy+3eNU3MHeSoU2ZLNkFkpyxE3aqJJPJYyCvmS36JBtxSc2q2ei7tjbttbVEbP7FivQcBMSINbATotOq5quG0e918YNKe1XlcbLX5w9b1ZXHuvLs9WIkuRkl4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=byffR4+2; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="byffR4+2" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-36b900f350fso2135398a91.0 for ; Sat, 30 May 2026 02:44:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780134250; x=1780739050; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=MOGv5iwSngrj41XE+piVh0d8DY2B1AD5Rx86ecpnAxY=; b=byffR4+2rGbHlikIOuweFyEuI0iJ0feUTL/vvPSwgaSyAGgr4L+tLcpYdaVGZ2unfc 4P4sC3yORjnDO2DeMSjeM0cvOsOGU8pTJ8RmY2MGZzJk+rnFjl0oUFcjyvFSUTNKbiIk /AzqPwtR7xIEkGjgJjm+CGTCBL3GjbxSJvfzLMAmyY5Z6kj9BH/nQQHLvgvBuJ/wozXv kFaaXBE2GjWe7LpUG8BbmOdztmq6JiYbhWsJMl6vY58OKI4Bt1ZWBkD2NWxcz5chUA9W 40kzUZtzvPUD/U3Mdknf/A/+baq9ECYwlFzdpRYKTNRAbBttMB+ob1jSDI5fowooFUWa DOVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780134250; x=1780739050; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=MOGv5iwSngrj41XE+piVh0d8DY2B1AD5Rx86ecpnAxY=; b=YTLl7VT2Qa5Qei2fheJT7n1KTeMePR+vlSR3KiKZBCfGGDDqTVNvWcvmWnaqH9G14K boFEWmdRC2QDiRla+AvhpmRqMKeBLVVR1DGIMdyhBJgZsZm2ZbPCu6H2AwMSLguIAOBU MgCuUoHj2yC2tsw4gsj8uwtaTI5culr8JQS5OJOVCUhapARE61vXEBd1gyCgy6u4gWkO DxFpSlXzUxz5RqyqjaGzuCgb7J2fJT1SN28T0V+ctJKbjPB/iEmmJmbbcthg/w6+1Ieq ilNqUW5kQKij9CEo9S6LcxKhmuDUR55qCdWmC8XclHqZag4OL3cDzcJJlc/1kvzaA3pL 9Rkg== X-Forwarded-Encrypted: i=1; AFNElJ8D7RldR4rh6E3xVtUOeRbPND54QeGLIDKpb1lI34a3ow1xhxJsECPAVWYSNkg1UQTAyX41MKYUGpjRflw=@vger.kernel.org X-Gm-Message-State: AOJu0Yx5PAxQPzzMKBVNIZ/tbv22nCnJCFFh7ODv3aCtAUE4X9EBhDMt 69tQR+uJoivh+5KMcAuTwkcMQNhWFhasbMV0VS9YHnsPoPjBQ1NDdNm1 X-Gm-Gg: Acq92OE4iI4mA75oWzMeR0LGBjhZ3RiyorlAokKfK7quI5xPfetKWfDram4WxcOqxFx mkJQYKgbmwpKcCf7yyhw43TIqhMkvtNPX1FqkD6dy37TUaPyUKYRR74W0M7BPFyDKGFnn/8fg7P 6b28LtM46h2mS09kvZEf9R3CjAeH1XwivNoL2YAIGkiqHWD8umtchD1rn/wlZDFpaKyNPaOFrcR atPd5RqgZXPAiWrthwEW2ZU5Dcz3dZ/Gfp5Spb6Po8OkqinsS1yUvyXOWNeltsDlgUrrrmDc2Ix 5EI6xR0lG0ZVdLm7YqYbQJc6BPcnXOFvosuSUkHBWf3QxOT8svr7zbEpb/lxTIU2cS7sIs8RT5q pALnNid1EfQbOfhWWiMUhjmWw+PUTtdXNuAW7VIOQ22U/KKV+B22BrWYUFAaD9HHp+9/fpWYQjb JRvlGRBAY01pRxnO7rJ++++sVY4whxX0k= X-Received: by 2002:a17:903:a8f:b0:2b0:7531:b61e with SMTP id d9443c01a7336-2bf36889991mr42155535ad.41.1780134250482; Sat, 30 May 2026 02:44:10 -0700 (PDT) Received: from rockpi-5b ([45.112.0.191]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bf239e700csm61529945ad.10.2026.05.30.02.44.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 May 2026 02:44:09 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , Maxime Jourdan , Hans Verkuil , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Nicolas Dufresne , Sashiko Subject: [PATCH v6 1/8] media: meson: vdec: Fix memory leaks and lifetime of m2m device Date: Sat, 30 May 2026 15:12:47 +0530 Message-ID: <20260530094326.11892-2-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com> References: <20260530094326.11892-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The driver was initializing the v4l2 m2m device instance per-session within vdec_open() and releasing it inside vdec_close(). This approach is faulty because the m2m device represents the hardware context and should persist across multiple open sessions. Fix this design flaw by shifting v4l2_m2m_init() to vdec_probe() and v4l2_m2m_release() to vdec_remove(). Correspondingly, move the m2m_dev pointer from struct amvdec_session to struct amvdec_core. Additionally, this patch addresses two critical resource leaks: 1. Adds a missing v4l2_ctrl_handler_free() in vdec_close() to clean up allocated control handlers upon session closure. 2. Introduces proper unwinding logic via a new 'err_fh_del' label in vdec_open() to ensure that file handles (v4l2_fh) are fully deregistered if subsequent session resource allocations fail. This was identified via kmemleak: unreferenced object 0xffff0000205d6878 (size 8): comm "v4l_id", pid 5289, jiffies 4294938580 hex dump (first 8 bytes): 40 d2 49 18 00 00 ff ff @.I..... backtrace (crc d3204599): kmemleak_alloc+0xc8/0xf0 __kvmalloc_node_noprof+0x60c/0x850 v4l2_ctrl_handler_init_class+0x1b4/0x2e8 [videodev] vdec_open+0x1f4/0x788 [meson_vdec] v4l2_open+0x144/0x460 [videodev] chrdev_open+0x1ac/0x500 do_dentry_open+0x3f0/0xfe8 vfs_open+0x68/0x320 do_open+0x2d8/0x9a8 path_openat+0x1d0/0x4f0 do_filp_open+0x190/0x380 do_sys_openat2+0xf8/0x1b0 __arm64_sys_openat+0x13c/0x1e8 invoke_syscall+0xdc/0x268 el0_svc_common.constprop.0+0x178/0x258 do_el0_svc+0x4c/0x70 Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260520045905.6ACBA1F000E9@smtp.kernel= .org/#t Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 33 ++++++++++++++----------- drivers/staging/media/meson/vdec/vdec.h | 4 +-- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 4b77ec1af5a7..4ffebba2341d 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -153,7 +153,7 @@ static void vdec_m2m_job_abort(void *priv) { struct amvdec_session *sess =3D priv; =20 - v4l2_m2m_job_finish(sess->m2m_dev, sess->m2m_ctx); + v4l2_m2m_job_finish(sess->core->m2m_dev, sess->m2m_ctx); } =20 static const struct v4l2_m2m_ops vdec_m2m_ops =3D { @@ -873,23 +873,16 @@ static int vdec_open(struct file *file) =20 sess->core =3D core; =20 - sess->m2m_dev =3D v4l2_m2m_init(&vdec_m2m_ops); - if (IS_ERR(sess->m2m_dev)) { - dev_err(dev, "Fail to v4l2_m2m_init\n"); - ret =3D PTR_ERR(sess->m2m_dev); - goto err_free_sess; - } - - sess->m2m_ctx =3D v4l2_m2m_ctx_init(sess->m2m_dev, sess, m2m_queue_init); + sess->m2m_ctx =3D v4l2_m2m_ctx_init(core->m2m_dev, sess, m2m_queue_init); if (IS_ERR(sess->m2m_ctx)) { dev_err(dev, "Fail to v4l2_m2m_ctx_init\n"); ret =3D PTR_ERR(sess->m2m_ctx); - goto err_m2m_release; + goto err_fh_del; } =20 ret =3D vdec_init_ctrls(sess); if (ret) - goto err_m2m_release; + goto err_free_sess; =20 sess->pixfmt_cap =3D formats[0].pixfmts_cap[0]; sess->fmt_out =3D &formats[0]; @@ -913,8 +906,8 @@ static int vdec_open(struct file *file) =20 return 0; =20 -err_m2m_release: - v4l2_m2m_release(sess->m2m_dev); +err_fh_del: + v4l2_fh_exit(&sess->fh); err_free_sess: kfree(sess); return ret; @@ -925,9 +918,9 @@ static int vdec_close(struct file *file) struct amvdec_session *sess =3D file_to_amvdec_session(file); =20 v4l2_m2m_ctx_release(sess->m2m_ctx); - v4l2_m2m_release(sess->m2m_dev); v4l2_fh_del(&sess->fh, file); v4l2_fh_exit(&sess->fh); + v4l2_ctrl_handler_free(&sess->ctrl_handler); =20 mutex_destroy(&sess->lock); mutex_destroy(&sess->bufs_recycle_lock); @@ -1057,10 +1050,17 @@ static int vdec_probe(struct platform_device *pdev) if (ret) return ret; =20 + core->m2m_dev =3D v4l2_m2m_init(&vdec_m2m_ops); + if (IS_ERR(core->m2m_dev)) { + dev_err(dev, "Failed to initialize v4l2 m2m device\n"); + return PTR_ERR(core->m2m_dev); + } + ret =3D v4l2_device_register(dev, &core->v4l2_dev); if (ret) { dev_err(dev, "Couldn't register v4l2 device\n"); - return -ENOMEM; + ret =3D -ENOMEM; + goto err_m2m_release; } =20 vdev =3D video_device_alloc(); @@ -1095,6 +1095,8 @@ static int vdec_probe(struct platform_device *pdev) err_vdev_release: video_device_release(vdev); v4l2_device_unregister(&core->v4l2_dev); +err_m2m_release: + v4l2_m2m_release(core->m2m_dev); return ret; } =20 @@ -1104,6 +1106,7 @@ static void vdec_remove(struct platform_device *pdev) =20 video_unregister_device(core->vdev_dec); v4l2_device_unregister(&core->v4l2_dev); + v4l2_m2m_release(core->m2m_dev); } =20 static struct platform_driver meson_vdec_driver =3D { diff --git a/drivers/staging/media/meson/vdec/vdec.h b/drivers/staging/medi= a/meson/vdec/vdec.h index 7a5d8e871d70..cc0cfafb8a95 100644 --- a/drivers/staging/media/meson/vdec/vdec.h +++ b/drivers/staging/media/meson/vdec/vdec.h @@ -63,6 +63,7 @@ struct amvdec_session; * @vdec_hevcf_clk: VDEC_HEVCF clock * @esparser_reset: RESET for the PARSER * @vdev_dec: video device for the decoder + * @m2m_dev: v4l2 m2m device * @v4l2_dev: v4l2 device * @cur_sess: current decoding session * @lock: video device lock @@ -87,6 +88,7 @@ struct amvdec_core { struct reset_control *esparser_reset; =20 struct video_device *vdev_dec; + struct v4l2_m2m_dev *m2m_dev; struct v4l2_device v4l2_dev; =20 struct amvdec_session *cur_sess; @@ -183,7 +185,6 @@ enum amvdec_status { * * @core: reference to the vdec core struct * @fh: v4l2 file handle - * @m2m_dev: v4l2 m2m device * @m2m_ctx: v4l2 m2m context * @ctrl_handler: V4L2 control handler * @ctrl_min_buf_capture: V4L2 control V4L2_CID_MIN_BUFFERS_FOR_CAPTURE @@ -230,7 +231,6 @@ struct amvdec_session { struct amvdec_core *core; =20 struct v4l2_fh fh; - struct v4l2_m2m_dev *m2m_dev; struct v4l2_m2m_ctx *m2m_ctx; struct v4l2_ctrl_handler ctrl_handler; struct v4l2_ctrl *ctrl_min_buf_capture; --=20 2.50.1 From nobody Mon Jun 8 09:48:03 2026 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C18137B014 for ; Sat, 30 May 2026 09:44:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134264; cv=none; b=ofAsHAOnEfEvXUyMW1BcjX24Z5H0W46y76lnQxYKhp91c+nBxHrvK8rHBlqVE/0BrGeZa6B0hzTo0RC4PngfYmJt+0DvLIylAZd3cbf7337V5Kc2OCbwIfRfAhGdJ9mThDog0kTQwNRqa3Eo/LkNQNPDAL8BhRe3GwDqhyNTBQY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134264; c=relaxed/simple; bh=G9B1EJrVgntwzA18R6iCzm5tNIqmGP+wgdzFWEsJR3E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=MzbnogA5YNkEtHpXScprosrwH/hjIyr937vy3Xp/D2sxbHcR2P5V7uNKDXP/KRfR8qLpp1LpOTfVeOHlraNaeUgEtSwxlja0ZGFEb58FMI4nHuMG99G6X/YWKt4UBkF9q0Nu8l1U6p+ucI2YTCHfs3J0ZBvd3W2fsaDVAKmsq54= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=pCoaPL8u; arc=none smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="pCoaPL8u" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2bcd3ac3307so84887415ad.0 for ; Sat, 30 May 2026 02:44:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780134263; x=1780739063; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=YD6axKKp8wDht90VyqGQ3zjwLyfLDF+g7zoFDStjFGA=; b=pCoaPL8uKiAkDTSJSc2S24T52GL7LcLrNPxgC42CW16leS0zN7FbLdJdJqOMeZ82Lq OT9aiGcCpTj4quxYnxUeGtTTr4y9SMZsTv87DXdO9HD+Xzi9TNh7ipyak7wgRmon7Zcf PxbsExX7eS6yJwYuo4dAoWJi9Ew4N4O9R71pPBMTIMgQPl+VBYOviugSL7vHzyidFSCX xgmUnKKDSo1uu4kR3hN317D0o2yRuIobO6/m91LKBcK2lHBHYou0rcNrVWz29G24zEhd 8H/ka2+kGqSQ1EGuCTCaBswd5AgbYJ3YzYZ5HddszydB9hn1gzBJTOdStoGttzqPUlSt /gtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780134263; x=1780739063; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=YD6axKKp8wDht90VyqGQ3zjwLyfLDF+g7zoFDStjFGA=; b=dYjCA3xF57dy/CPyrio1PhThfZSwa0mkqaKJdJEkY4LEABDB9ba8DmGsHk0geobeej oDnt20lZtHWwl24LEIyW2uiLAeo0hy5Mkvo1ciOreh/3vp6sRkW5bCMHAf8QLUSqvYR/ gj+f5+2KAszxwGnsz3TKWKP/pWRo1w1MTxxrXU3KhH8KBsNQm6/HR/cBeXg8AIWaF+xs vKD1AUpEoLm4Y3voXW8pkdRyDX+Ws68CjvJwIjyzh0ULKZKmExcfhALdjGUn7bdZoOyY wHs0cT5hCXOspJ4yYhJPOnAbU1B0LhMaTzfoflc0DoBwQ5kuNoX+NGKYbjsqgcCz0GfI rFqA== X-Forwarded-Encrypted: i=1; AFNElJ+3xyzOPZHuDaIINsmYTUmfG5rt9kCX3LVMU5BohhPMv4uzXIc6yFTGk3IJXaRdcKNJovmh96iQi33M0rA=@vger.kernel.org X-Gm-Message-State: AOJu0YzLYJ1xyO/A5iq8rbhxNe/Ao6jgZK3xFV3wXmONpFAHP3jRsKXP Mjdh0XwAWSIk4oIcePE1hhUriej2v6jP47G/udTZGBJWLgnBzXyX/C/v X-Gm-Gg: Acq92OE6i6Go+OoxXaTFWyCNtcsMULjIn1ZTHXSWjWb0INjLVDLWmeKjrnWlxclwtxs Dp+e1fMawrsYuXcaCBLx6++H0wWppZp+yp3FudUJrxRF2X6ME0YP9Uooaknjl4R22Aeg6N7Rmx2 46bt302cMEEnyJKxpR82WBM0L+YW+FhUj7AXKaFabqQHs8+w3mw82qK8rvn+drS5DuPJlu3Ee6W +emShB2T+gzwV1vqMqoEjxWseKk9EPGmBE8fsQMqUvfXFx0Dbyq71N5HmvSaatijFOg42o8710y gKdCLU6CP7b9OPYVAbAf0ojR2H6PZ7HhXg7di55zPnstSaY2njWBuZvIhmwiWkEod3NVcIbnivr /4XOyZfjXVeA5o/NlYxCBZm0UXD9nm/bbsPBdGX5wI+5xEsNaf65CcDmbEb6duDpaXdVqiF0chn DRiEMnD0Yw0Mcp5hImdr1Lyq60RmPCSsk= X-Received: by 2002:a17:903:2305:b0:2ba:7881:948d with SMTP id d9443c01a7336-2bf367b214fmr38817185ad.1.1780134262731; Sat, 30 May 2026 02:44:22 -0700 (PDT) Received: from rockpi-5b ([45.112.0.191]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bf239e700csm61529945ad.10.2026.05.30.02.44.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 May 2026 02:44:22 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , Hans Verkuil , Maxime Jourdan , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Nicolas Dufresne , Sashiko Subject: [PATCH v6 2/8] media: meson: vdec: Fix concurrent STREAMON / STREAMOFF race conditions Date: Sat, 30 May 2026 15:12:48 +0530 Message-ID: <20260530094326.11892-3-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com> References: <20260530094326.11892-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The Meson VDEC driver=E2=80=99s start/stop streaming paths previously updated core->cur_sess and sess->status without synchronization, leaving a race window between concurrent STREAMON/STREAMOFF calls. Following change introduces proper locking discipline: - Hold core->lock when checking or updating core->cur_sess and sess->status in vdec_start_streaming(). - Snapshot sess->status under the lock in vdec_stop_streaming() to safely evaluate hardware state after releasing the mutex. - Ensure error unwind paths clear core->cur_sess and reset sess->status inside the lock. This prevents TOCTOU races, avoids data corruption when multiple sessions contend for the hardware, and ensures consistent session lifecycle management. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260525104345.C8D501F00A3C@smtp.kernel= .org/ Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 62 ++++++++++++++++++------- 1 file changed, 46 insertions(+), 16 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 4ffebba2341d..7233000e2232 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -286,11 +286,6 @@ static int vdec_start_streaming(struct vb2_queue *q, u= nsigned int count) struct vb2_v4l2_buffer *buf; int ret; =20 - if (core->cur_sess && core->cur_sess !=3D sess) { - ret =3D -EBUSY; - goto bufs_done; - } - if (q->type =3D=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) sess->streamon_out =3D 1; else @@ -308,9 +303,29 @@ static int vdec_start_streaming(struct vb2_queue *q, u= nsigned int count) } =20 if (sess->status =3D=3D STATUS_RUNNING || - sess->status =3D=3D STATUS_NEEDS_RESUME || - sess->status =3D=3D STATUS_INIT) + sess->status =3D=3D STATUS_NEEDS_RESUME) + return 0; + + /* + * Secure the core hardware lock before checking availability + * and updating session states to prevent STREAMON race conditions. + */ + mutex_lock(&core->lock); + if (core->cur_sess && core->cur_sess !=3D sess) { + mutex_unlock(&core->lock); + ret =3D -EBUSY; + goto bufs_done; + } + + /* If already half-initialized, do not re-initialize */ + if (sess->status =3D=3D STATUS_INIT) { + mutex_unlock(&core->lock); return 0; + } + + sess->status =3D STATUS_INIT; + core->cur_sess =3D sess; + mutex_unlock(&core->lock); =20 sess->vififo_size =3D SIZE_VIFIFO; sess->vififo_vaddr =3D @@ -341,8 +356,6 @@ static int vdec_start_streaming(struct vb2_queue *q, un= signed int count) sess->recycle_thread =3D kthread_run(vdec_recycle_thread, sess, "vdec_recycle"); =20 - sess->status =3D STATUS_INIT; - core->cur_sess =3D sess; schedule_work(&sess->esparser_queue_work); return 0; =20 @@ -350,6 +363,12 @@ static int vdec_start_streaming(struct vb2_queue *q, u= nsigned int count) dma_free_coherent(sess->core->dev, sess->vififo_size, sess->vififo_vaddr, sess->vififo_paddr); bufs_done: + mutex_lock(&core->lock); + if (core->cur_sess =3D=3D sess) + core->cur_sess =3D NULL; + sess->status =3D STATUS_STOPPED; + mutex_unlock(&core->lock); + while ((buf =3D v4l2_m2m_src_buf_remove(sess->m2m_ctx))) v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED); while ((buf =3D v4l2_m2m_dst_buf_remove(sess->m2m_ctx))) @@ -399,10 +418,23 @@ static void vdec_stop_streaming(struct vb2_queue *q) struct amvdec_codec_ops *codec_ops =3D sess->fmt_out->codec_ops; struct amvdec_core *core =3D sess->core; struct vb2_v4l2_buffer *buf; + enum amvdec_status old_status; =20 - if (sess->status =3D=3D STATUS_RUNNING || - sess->status =3D=3D STATUS_INIT || - (sess->status =3D=3D STATUS_NEEDS_RESUME && + /* + * Safely snapshot the status and clear the hardware owner inside + * the mutex to prevent data races with concurrent STREAMON requests. + */ + mutex_lock(&core->lock); + old_status =3D sess->status; + if (core->cur_sess =3D=3D sess) + core->cur_sess =3D NULL; + sess->status =3D STATUS_STOPPED; + mutex_unlock(&core->lock); + + /* Evaluate the hardware state using our snapshot */ + if (old_status =3D=3D STATUS_RUNNING || + old_status =3D=3D STATUS_INIT || + (old_status =3D=3D STATUS_NEEDS_RESUME && (!sess->streamon_out || !sess->streamon_cap))) { if (vdec_codec_needs_recycle(sess)) kthread_stop(sess->recycle_thread); @@ -415,8 +447,6 @@ static void vdec_stop_streaming(struct vb2_queue *q) vdec_reset_bufs_recycle(sess); kfree(sess->priv); sess->priv =3D NULL; - core->cur_sess =3D NULL; - sess->status =3D STATUS_STOPPED; } =20 if (q->type =3D=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) { @@ -425,8 +455,8 @@ static void vdec_stop_streaming(struct vb2_queue *q) =20 sess->streamon_out =3D 0; } else { - /* Drain remaining refs if was still running */ - if (sess->status >=3D STATUS_RUNNING && codec_ops->drain) + /* Drain remaining refs if was still running using the snapshot */ + if (old_status >=3D STATUS_RUNNING && codec_ops->drain) codec_ops->drain(sess); =20 while ((buf =3D v4l2_m2m_dst_buf_remove(sess->m2m_ctx))) --=20 2.50.1 From nobody Mon Jun 8 09:48:03 2026 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 680C43955DC for ; Sat, 30 May 2026 09:44:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134274; cv=none; b=d5sCju7kSACwQULhB2WJif+eg3nCjhD/v7+NrYJlDeF/jOv2FlzK5Cv6gSZnAcX6XNpxyygu44VpAKgUXMk/D7ieiSFVEj2n3WFu41WyTxFJJVdxPS40oaelpIJOgvaGYLdmERE6avlaye9Pr5XLl7mpskjhvLXgI6K3gxug9IQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134274; c=relaxed/simple; bh=+strja15rp5bfFyNtAbt1Pazm6s+foPib4qovmXYo1g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=WZOa6qGNI5gRG3p5Btz+79g5iBDXqrH4PIc4Wd8u+6gZrGy62vaigaMUmNo1bAr/msia6RFFYInAMDJaYTHYxNsPn41msBLMvZnVkw9JOm+wNOF91dbS4OZAkY50jHC2g6Gw0TKZi0OG5aLMR6XQBn+L6OB7pNWxVWMdmnyubyM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=F3IfSn+7; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="F3IfSn+7" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2bf237e1433so14846655ad.1 for ; Sat, 30 May 2026 02:44:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780134273; x=1780739073; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=BrXJFZmxeXg5CYXAWJIPwYaWF/wPAlGFj3atI5I4qIQ=; b=F3IfSn+7zeA3Odoo0qJwJVkqrYF/NGXaWVK7pzn8ADyENFKgyH8pNpF5f5I+KD8U2k cC4ftNJYnLA54/E9U6KXVgqNfVmwu3N88XqMWF0CTXjTpIVUAJDVbg5ZvNsmMNrAV5V6 PHdilS4zW2mIqEXcOvg2mL+QyHeLLr9+QCYMpa7IENOxbuElThu+CkVb/TgODxb1gBTC rOTmes5QGSDMVzDcrrq5RJnpT36uEykKZCqOrg1EeFBnNnc1bBqINOYMkiEPdjuquc1z /Tp/Znq+UaIth+mZLwyTUKXQFoHibzxVJzFXq9PV5rspdDBFUNxd68NRA5dDqkMBhrh1 466w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780134273; x=1780739073; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=BrXJFZmxeXg5CYXAWJIPwYaWF/wPAlGFj3atI5I4qIQ=; b=cyvTxkoqxajEpd6gU08rHTHoVA4BeoPi8YinoENoK3Kp/KkoZuO3e0AMhJ+rR9r8F/ zTcoYePfotfBtOkxpNBQ5CScHI6R1Bgt/ZSQJNrGYrBMwge7qlKMUlDyYQPSCkNu3dbK iuV78zPklm65vf0nkPP0F4P90fgsGK0MswclFDFArQhF57E8X6X+gDc3CydD5COCSVJ9 CH6rBHHRt9yCAnGeJY8HnyDax3v+EBqQ7pZKvUwmRp7oZNNJA/DT8H51JhyORwk11g4b dDGr4NmWGZsrCC9Ha4s/zbDUCD8fnUB9Opps2E4inyR/nHNx+HOEHhwduCjInoROz67A Nr2g== X-Forwarded-Encrypted: i=1; AFNElJ8A02xV74b27pL++Uu/t17Hc6vQCsBUtzikN7krLpHl10cxSnXJpF+T0yTPQ5mVGb2jxPji408z8vW+IYI=@vger.kernel.org X-Gm-Message-State: AOJu0YxVLHLH6bRQUngPH1LFuhRCy7DiMfSIeYTVuZ4NO3h8m4ZvVIqc TIfLO9E3n58KULlvg//OR5L9oIqhnhqpMt37Uda6YusJ2750+fPPN7D8 X-Gm-Gg: Acq92OET4uaGOyVzcxemXZ29ACMOWMweJptkyhU+W+AcqGBB3+LjcXKjQqrSsvD/vYg 788MVkAgbKqjB2c+tQL7BKRTHhmUVE2HpGvaD/IQolcXpnwF/RFhZiGOHORqDtHRm93ghVr6KX0 YddFYQWEjfq/iiX+5FY7H8tqWatILiHIxGGUHq/EneDdh9ilriKFI5YZ7/KPQdTVfzM89Ye2UCp NYylokbWMfsEcK+9oyk9cqN+rEx3g+qAUTq8r0UM5iFqHrNB7z4xnRDu+j2ulUqDlAZZnoBnSLc V9iteLpCdisdy9/SUwnTdaUeBJOQvAdXzXNARGcZIzSKIfiAsK3jj9oQGfaKcF669A/puwn/2Bw jyNwOKIv5FjQJPMhh9+Eli/ESv0URVjwzvqOfRuAdXhrYJgWesopx2+/ZR5ZxxsI5ebUguRyMF9 h5oeGXh5H0eun8l63mFbjnwveDBlyQPJk= X-Received: by 2002:a17:902:da8e:b0:2bf:356f:4e0c with SMTP id d9443c01a7336-2bf36793916mr38435335ad.1.1780134272635; Sat, 30 May 2026 02:44:32 -0700 (PDT) Received: from rockpi-5b ([45.112.0.191]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bf239e700csm61529945ad.10.2026.05.30.02.44.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 May 2026 02:44:31 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , Maxime Jourdan , Hans Verkuil , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Nicolas Dufresne , Sashiko Subject: [PATCH v6 3/8] media: meson: vdec: Handle kthread failure and free codec state Date: Sat, 30 May 2026 15:12:49 +0530 Message-ID: <20260530094326.11892-4-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com> References: <20260530094326.11892-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable vdec_start_streaming() launches a recycle thread when required by the codec. If kthread_run() fails, the previous error path only powered off the hardware, leaving sess->priv and codec state allocated. This caused a permanent leak of the codec context and associated DMA buffers. Fix this by introducing a dedicated err_cleanup path: - Call codec_ops->stop() to release the codec context and clear sess->priv. - Power off the hardware before freeing buffers to avoid DMA faults. - Free canvas IDs explicitly and set sess->vififo_vaddr =3D NULL after dma_free_coherent() to guard against double=E2=80=91free in fallback stop= paths. - Reset core->cur_sess and sess->status to prevent stale references. Following change closes the memory leak on kthread_run() failure and ensures robust cleanup of codec resources in both error and stop paths. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 26 ++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 7233000e2232..8a5bf1a96830 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -32,6 +32,8 @@ struct dummy_buf { /* 16 MiB for parsed bitstream swap exchange */ #define SIZE_VIFIFO SZ_16M =20 +static void vdec_free_canvas(struct amvdec_session *sess); + static u32 get_output_size(u32 width, u32 height) { return ALIGN(width * height, SZ_64K); @@ -352,16 +354,31 @@ static int vdec_start_streaming(struct vb2_queue *q, = unsigned int count) =20 sess->sequence_cap =3D 0; sess->sequence_out =3D 0; - if (vdec_codec_needs_recycle(sess)) + if (vdec_codec_needs_recycle(sess)) { sess->recycle_thread =3D kthread_run(vdec_recycle_thread, sess, "vdec_recycle"); + if (IS_ERR(sess->recycle_thread)) { + ret =3D PTR_ERR(sess->recycle_thread); + sess->recycle_thread =3D NULL; + goto err_cleanup; + } + } =20 schedule_work(&sess->esparser_queue_work); return 0; =20 +err_cleanup: + vdec_free_canvas(sess); + vdec_poweroff(sess); + if (codec_ops && codec_ops->stop && sess->priv) { + codec_ops->stop(sess); + kfree(sess->priv); + sess->priv =3D NULL; + } vififo_free: dma_free_coherent(sess->core->dev, sess->vififo_size, sess->vififo_vaddr, sess->vififo_paddr); + sess->vififo_vaddr =3D NULL; bufs_done: mutex_lock(&core->lock); if (core->cur_sess =3D=3D sess) @@ -441,8 +458,11 @@ static void vdec_stop_streaming(struct vb2_queue *q) =20 vdec_poweroff(sess); vdec_free_canvas(sess); - dma_free_coherent(sess->core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); + if (sess->vififo_vaddr) { + dma_free_coherent(sess->core->dev, sess->vififo_size, + sess->vififo_vaddr, + sess->vififo_paddr); + } vdec_reset_timestamps(sess); vdec_reset_bufs_recycle(sess); kfree(sess->priv); --=20 2.50.1 From nobody Mon Jun 8 09:48:03 2026 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D923D37B014 for ; Sat, 30 May 2026 09:44:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134285; cv=none; b=tbMcnUjG3dmO7fkLTLaACIHXtGUxDLlZgdkbJqysAmhE5lL9B3pUSPbBGtivPfjmZnB+UgxV/rOqIKbu4t/SoKs5DsrZx/nWMuA1MtK1PgTVYeG3WAJxdlh4RqrSlfV6R+LmhDtBar+x+plfK6gjPg9FvlR90XEBO1j2KpzWTOY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134285; c=relaxed/simple; bh=G4dcvjVYZuF9c1fC6zIr8U0LMJapQ16RTisqEjiIVMg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=n9HH4vD+SH4uO9U4uxb5kel7cPcFEBpLtpbhtct22KLSZjuCrKLgrIuHyas0nTt7NVq17/Bj4vzntVQDYzBN+kCG46bkzFZCeg7wxnrKUD6FBH97LxxGSHpoMS/hCAnTERmn+oMBGcjdc6QvCIM9z0jx6XLmGSqjc1DNEuPVmZs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RaMrO2ns; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RaMrO2ns" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2bf02708e8fso19325565ad.2 for ; Sat, 30 May 2026 02:44:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780134283; x=1780739083; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Je0r03zFWDk/tHsmcp50GPWfnKiSAfNBSvNM4tTawBM=; b=RaMrO2nsu+JcwG39o8p1nRoB4dy1j0JbydQGlqwiVo/cbZc0Jj90rPfoWnr4bhKBK7 wHhH0dyxS1Z9ydeFyVUQ9KTa3rZHhR414I5rziFu/TTiWdK5ewhrgV1yS9uMpOAbpGCm T5sJr3RKypIhq7Ym/pih2WbKv0gYQKsnSCs+Z8qFLkxhvi4wMvOtC41EhEPczbxD3mgg JpSNdKxDVLWET8hvZw1B3mB4OS2d3ixgXcgD7WHk+O0g+CaxtkeA11ltuIxoW6Lbxs3X kWotwn2iRaeLEi/1VPMnxjLAykM9IBjZjWBkUom0GlGpEZBkTd542+tior/xu45VvHkH n71Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780134283; x=1780739083; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Je0r03zFWDk/tHsmcp50GPWfnKiSAfNBSvNM4tTawBM=; b=egAgHxjwU6/69HqMflu9QMrwneZJZeHIP7OAcz1VbFJUtj9rkjmTZbxasazGUG6K1S SnqHtuJHK76FM5D0h58MKwLTHgF6VQbhy0SKfFAKW+KmW/m3B/rlNHUQp9VBLRlJfhr3 M8QTNwwpWfgkZiAW3rI7itDhLDe+bafdzd+z0jnS0PmrNxa1T0GH8iyGhvm0BbLgSXUb wg/7RZDeGY1ksLNvw0Ks3uZw7KBIf7xNCHt1ZfZg7+DJwDzIz7TlGKh2ChrNs6Mwlc2f QF2Mff1xE4kq3BmYr38Ob8mCMG21RqE3Woyo9NTzL5xHQx8tLHxF+yrUkLgwNVoTUONy 5fgA== X-Forwarded-Encrypted: i=1; AFNElJ8fvQVnjLQsRTXILpiElJ16229H0QA8YLhPQJedJE7QDEwa3zpn7DZroONoEJrEHrFZoWEN64A18LgEqsQ=@vger.kernel.org X-Gm-Message-State: AOJu0YyYQbir+ao82w4lVUDYKWKmtv+TBUEf216f8V+g1aiwjsmDXuou Qn3ZRoJmNeXwszpmtyaDl3BJcP78bdw77YW7ldTuWMf8xIJstTsIifvdm3H1KQ== X-Gm-Gg: Acq92OHqYgAeUYH1NA6t7kuy7IJgqOwEAQaLd4AAxvT1ezYANUIvzsrZa4eupY8jaJK l9KxxOeQ+glz2acjYkVblrpiHXZl/WjydbsYXF79d8kd29+H1PUfWUSgwuEZKe7bTAAMsGzXRx+ +0LxTCk1agbZm14MOFaIkICjrYIMAoW0+ha0vqe6SwtdWofDlEWxTroIelvVQ9vSHh4ewXFYBmb 3NOX1a3+eUJpdPAscWA7M3/IRasbxiw8GRParceMpwhKIu69FN2l3SrycJvhnmDAQ3j6IUa4sXA aMQADHnvmDzgGwRqUIuH/m/a5R4UxPiy82P2Y7FYZGoZR6eEDsBjbLw4FQ7MLwnV1Bp6sDc4U/x abQXLSS9V+Gx1a6sDMln1LQnR5Sq2uevktyfSt+lnQphX4bFQJGGy+q4Yoxg8X/qh7wh11svjFv kbqMHBJ4j19FM7/EYqHoKW+cRIAuMZoLzJ6bF4I30IIA== X-Received: by 2002:a17:903:2450:b0:2bc:e2ed:fd03 with SMTP id d9443c01a7336-2bf368a3dabmr36524785ad.39.1780134283084; Sat, 30 May 2026 02:44:43 -0700 (PDT) Received: from rockpi-5b ([45.112.0.191]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bf239e700csm61529945ad.10.2026.05.30.02.44.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 May 2026 02:44:42 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , Maxime Jourdan , Hans Verkuil , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Nicolas Dufresne , Sashiko Subject: [PATCH v6 4/8] media: meson: vdec: Condition buffer flushing on queue type in start_streaming Date: Sat, 30 May 2026 15:12:50 +0530 Message-ID: <20260530094326.11892-5-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com> References: <20260530094326.11892-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When vdec_start_streaming() fails, the error path clears buffers from both the source and destination queues unconditionally. If one queue was already streaming successfully from a prior invocation, flushing its buffers behind its back leaves videobuf2 deadlocked waiting for completions. Fix this by only sweeping buffers from the specific queue type container that failed to initialize. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 8a5bf1a96830..698a95566ad2 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -386,15 +386,15 @@ static int vdec_start_streaming(struct vb2_queue *q, = unsigned int count) sess->status =3D STATUS_STOPPED; mutex_unlock(&core->lock); =20 - while ((buf =3D v4l2_m2m_src_buf_remove(sess->m2m_ctx))) - v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED); - while ((buf =3D v4l2_m2m_dst_buf_remove(sess->m2m_ctx))) - v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED); - - if (q->type =3D=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) + if (q->type =3D=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) { sess->streamon_out =3D 0; - else + while ((buf =3D v4l2_m2m_src_buf_remove(sess->m2m_ctx))) + v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED); + } else { sess->streamon_cap =3D 0; + while ((buf =3D v4l2_m2m_dst_buf_remove(sess->m2m_ctx))) + v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED); + } =20 return ret; } --=20 2.50.1 From nobody Mon Jun 8 09:48:03 2026 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D29833557F3 for ; Sat, 30 May 2026 09:44:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134295; cv=none; b=OnSnYG5Un0dryELV8iCJCd9/4kJwsIByg+RuMnUB+wplenmQRjwyMuEYvF0nT8PnoNlCZVXpW7ZCKgSckWnfvrN+mNcQ9l977QROqUwfGSHEkiOdRkPSCTYATR7SOa/rVPuT6JCMFzrcpHzQ2M7WJiUBg8lTpe//hgu6Pa3x1no= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134295; c=relaxed/simple; bh=U+d2jT76hbERqFnnuLcNz9UQ38hwXQfEMVzxXIG/jas=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=fPc1+JZrfHSAmaZhUo6RmJq2wZfqb2a4+WwJJQJdmlk0iiqvD6QS84oIdRiim0mukG19nbLQZAXT7d18ouuYF8cgz1mgD11xow11uCTVaqf7uiSAcXUuxeGKxJeeCIO4L336mo7zRSctwolALzUnznWUxStW2iUIPSbGjvMDl2M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Py+qmQt1; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Py+qmQt1" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2c0aa420401so1621985ad.3 for ; Sat, 30 May 2026 02:44:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780134293; x=1780739093; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Eg9ggvkEkoQKR+hIDJPnP9lc/gF7VRqufBdsoqX52Vc=; b=Py+qmQt1TCI9VuVFPFxZqIK0ucZ5osbRuCLbGsbcwf9yracV8aHsS2IHYGgEYyW7Xv JelEr0HMgLgPbFSKUwOQQt7HQx6x1LcVNwSe7Cia9+TWaZV3VUhBZGrNzsTWdOoSbc4B 3qgzmBLfFfP25MYyc2BubYcsPeMQoZGjr6Tp4vdlJ1GQucsB9uY2vNsaydJsq8aOwEYC QorhlZ9DG/XQ4tAwVBcs+NhjGTrfDF9Pnu2QvYRZhwyIwy/2nYsrkL62t2EXNvRGXE2g o3MdFEsJuazJBT+IANL1Gyj5HczDAFwZElrM/j8aDhGTyxVZn4xuaudaXiFdfKm/88sk frhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780134293; x=1780739093; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Eg9ggvkEkoQKR+hIDJPnP9lc/gF7VRqufBdsoqX52Vc=; b=oHLo7jJ/DZsZWxW6pMy5GbmSW1TstbkHxWWgBOtXEfk7CCLDuNZJLAcU5IbAz0fbmm OrIelPL6xrS77E4Rnth3hvjPMRsNvQ71vMFvRuszsF24JF8AETSdYOFZOwMsIODZj01P hYPEMws7jQ4PW/3ics9rTZqe2l/cSRFi51atHcV6AQMxX/mparxASja9AZmfJhd/YFGj tjLgeYlLZmuX0r9mesevQ0p/LETR5d61lbooAgI/DTu2EoR2iGDcDmoH1gXKLmvOIVLc Uagy31/QyT0a8BsXZH1t+tKQAWrCDhaTG3O+zK1Uy+A+4scmiQgx8eR/+z5xnsXc+mGO KA2g== X-Forwarded-Encrypted: i=1; AFNElJ8FucRcR/607AFydNVQmx4MyX+Fxy8bq1wsMCM+inhEgrHGgm6ynytimXO4pvQ70wilH8EskE+UHagyhH4=@vger.kernel.org X-Gm-Message-State: AOJu0YzInbLIgWfSdQFmdaNfiAiqs5kfp8sjxxXNTRFCQ1YqtVefS//H qLX7xqKk2gMCyf/rLMb3eBt9XDOTTukQL8+y+eOU53xOEMtuKY+X6fYS5NhL5g== X-Gm-Gg: Acq92OEdB3C6eif30uscji/W6pIf0opTkZhIMxKAcfRsCJapQtsE0hItiwwdugY7jD0 jLfIV0trfwtX9s5djcih9L/QgSnGGAmAFpzTR0yIihA0VGQY7N7bnyDpMJ93OQfTpJhfnXb8n2r hQFKKMV9hYAne/Fnm3XwRpXsz9FetDpZZoEFRgnHMm2uRL6DOAiaHYZ8+LM+lOohY5VHz7FnFR/ OL+SqI91mZa78qK1Age6VAgU/0WotJujuTpFhOSp9loMjS2rXqKEB5n9mUPgLTrN7Bwy1Zlr0g8 w6tiBkPKxNIv3srWpEvqF3Ry6QCD9DAEToTeJFvwSDuhef1kaZ5TOACSodBfxiIcT5/uiCahvGk YfkEj1VdxJiJrneF6dUDulgdhu7CDwRpHtpE++0mrHXlVghi/CqVwO6EsnudeDxItWbMvUZjH5l W/7oDmKABQArPGBGsC/whnkDZr6rH6vUg= X-Received: by 2002:a17:902:c94c:b0:2b2:be01:5532 with SMTP id d9443c01a7336-2bf3686d1dcmr41074635ad.35.1780134293228; Sat, 30 May 2026 02:44:53 -0700 (PDT) Received: from rockpi-5b ([45.112.0.191]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bf239e700csm61529945ad.10.2026.05.30.02.44.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 May 2026 02:44:52 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , Hans Verkuil , Maxime Jourdan , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Nicolas Dufresne , Sashiko Subject: [PATCH v6 5/8] media: meson: vdec: Cancel esparser work during teardown Date: Sat, 30 May 2026 15:12:51 +0530 Message-ID: <20260530094326.11892-6-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com> References: <20260530094326.11892-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The esparser workqueue could remain active during error unwind, streaming stop, or device close, leading to use=E2=80=91after=E2=80=91free = when work items accessed freed session memory. Fix this by explicitly cancelling the work in all teardown paths: - Call cancel_work_sync(&sess->esparser_queue_work) in vdec_start_streaming() error unwind, vdec_stop_streaming(), and vdec_close(). - Ensure the workqueue is drained before releasing session state and buffers. - Move codec_ops->drain() evaluation earlier in stop_streaming() using the status snapshot, so draining occurs before buffer cleanup. Following change prevents dangling work execution, eliminates use=E2=80=91after=E2=80=91free hazards, and ensures orderly teardown of dec= oder resources. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 698a95566ad2..4884ee04b352 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -380,6 +380,8 @@ static int vdec_start_streaming(struct vb2_queue *q, un= signed int count) sess->vififo_vaddr, sess->vififo_paddr); sess->vififo_vaddr =3D NULL; bufs_done: + cancel_work_sync(&sess->esparser_queue_work); + mutex_lock(&core->lock); if (core->cur_sess =3D=3D sess) core->cur_sess =3D NULL; @@ -437,6 +439,8 @@ static void vdec_stop_streaming(struct vb2_queue *q) struct vb2_v4l2_buffer *buf; enum amvdec_status old_status; =20 + cancel_work_sync(&sess->esparser_queue_work); + /* * Safely snapshot the status and clear the hardware owner inside * the mutex to prevent data races with concurrent STREAMON requests. @@ -448,7 +452,11 @@ static void vdec_stop_streaming(struct vb2_queue *q) sess->status =3D STATUS_STOPPED; mutex_unlock(&core->lock); =20 - /* Evaluate the hardware state using our snapshot */ + if (q->type !=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) { + if (old_status >=3D STATUS_RUNNING && codec_ops->drain) + codec_ops->drain(sess); + } + if (old_status =3D=3D STATUS_RUNNING || old_status =3D=3D STATUS_INIT || (old_status =3D=3D STATUS_NEEDS_RESUME && @@ -472,16 +480,10 @@ static void vdec_stop_streaming(struct vb2_queue *q) if (q->type =3D=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) { while ((buf =3D v4l2_m2m_src_buf_remove(sess->m2m_ctx))) v4l2_m2m_buf_done(buf, VB2_BUF_STATE_ERROR); - sess->streamon_out =3D 0; } else { - /* Drain remaining refs if was still running using the snapshot */ - if (old_status >=3D STATUS_RUNNING && codec_ops->drain) - codec_ops->drain(sess); - while ((buf =3D v4l2_m2m_dst_buf_remove(sess->m2m_ctx))) v4l2_m2m_buf_done(buf, VB2_BUF_STATE_ERROR); - sess->streamon_cap =3D 0; } } @@ -967,6 +969,8 @@ static int vdec_close(struct file *file) { struct amvdec_session *sess =3D file_to_amvdec_session(file); =20 + cancel_work_sync(&sess->esparser_queue_work); + v4l2_m2m_ctx_release(sess->m2m_ctx); v4l2_fh_del(&sess->fh, file); v4l2_fh_exit(&sess->fh); --=20 2.50.1 From nobody Mon Jun 8 09:48:03 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3C6D39DBF9 for ; Sat, 30 May 2026 09:45:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134307; cv=none; b=tp/7PgYSK0OcIT3BxMVCRH44FDf8aLx636YyOCd6jnLh7AFjlqk74pd+VzX3UpoKEytCD+GDgy1xwSLPho2ctr6iI8e0JXd53MViOZQeyc94K48JtCS31hKRoDQwZBjw9TvgDypyAWhGwFnAAD3Q+9YkJkpFBh+Mnohxp5HUuso= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134307; c=relaxed/simple; bh=g7WNCB9Rt/1OuSYvuRDcXaghERK+Kgq7rXBJpRUKNDo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eFDppGLspnBeQVjVbQC+kQodqN64oDgZ7D3Dfw1v68orUo73jFNGqoQaoIK4CXgI4WrfZadpn5ovbUjgngXDhIrU24v5ByBUPzwrFwzhUKQ4xkJzmUFzI4vFjMZSJmRYi0rktQp5cUtmn+OozkSu1IY71FatQIxY2BxIckqLf4s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VIeazxf/; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VIeazxf/" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3664df32e91so16316842a91.3 for ; Sat, 30 May 2026 02:45:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780134306; x=1780739106; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=UsfY8GRrXZdSk9lyMdgzW2ibIF3DXFt06J5TGlB1HVc=; b=VIeazxf/pOgIOrSnPe35VdjpGxmNQAboJ7opWLOaRxgi6s4qOTroJfCziQi1IJKHus aK8Ya6Eet6D9HWVsbgIUlxADr+HUcdftQX133EFn97XUGWt0+YjIGNq7qUPay2blL+r+ kp3KEkX+gyUhuZOU+pCYwlaJSqrqBMdXy4TQh/PkVcjLztHL/OTIU1sAmo+IPl6smJSc pJQ26uib882FcqVZHCoD5x+BQJ4+llX5TmbubN7rXv0r8ws/O1Yz4JB1tuoBK/VsPoxJ n6jRPqLUqKzlGRr8Aj9aH5ljK60h5sToBnGA5H/AzSl+qtZUT4ItnUOHtuWMEPjlsZj0 xfqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780134306; x=1780739106; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=UsfY8GRrXZdSk9lyMdgzW2ibIF3DXFt06J5TGlB1HVc=; b=AU5HdEg8lyTIIY9DoYxIllOssLva/XfzYk+TQVyII6SCScUZzMZReSYF6BxmWrZCay QlKWjQxeplgr4Ju4GyXU2DxTXHCEKym+4i77NN3KuRgrVkki9V8bsYYaT6lOId0Em48s VFCi2VWvydyI9ijVTueduitSxrwMugwFQPO/rNRrhkXjcs5qcRVOzhLfMRGlZOVY5rLU oTrMXdAD9EhDILhNW7D2VrYLjnxLvXMIrfGJ5HCC6P0OM2t8JQsmYM4ek08+T+vp3Nwa hSp9YhXUhk6PlznWQgt4lEgQ2RnePJnxEsny2YWCIHfVXywpPOV2W2VEfU8WCwy0ZB3h be9w== X-Forwarded-Encrypted: i=1; AFNElJ8ctnaDsjFEbKPcomBMRHmoSFuhctnksCKa+WRazFZGCx3G16LNngk98s4MpNGrSyFBDCWKsx9vD7Gx7tM=@vger.kernel.org X-Gm-Message-State: AOJu0Yzq4/J5ELhSLlcGCLIhUOKK9rzGuk+h5iHBqEB69IDb1qcAWugX YYl+qfiFzb/++Ccunn4Lo11IZ/J7b1nY8QU0QqIn2Rex9SUAQ9xijrqK X-Gm-Gg: Acq92OGsXlHc1Rqek9nChpVeQADoYcMgdTsRUPrRF/b/THegVERgVdfRU+kKTqtOnOD Xk1C+mfDI/ig8UQpl1+DnznrHUyfcxgzQJj+EAvvdA6ZbTQ7AZ/K7HU0MqzgqKKx41MccTFzqMp IdsYCgNiRh5lLbFVtS1UJFs2i8iTFz2VxtGLO/69ncRuK2cK4qGNtuHJXTx04VMGWx4ue83Lll2 dNpsBeOzEiczLNSjYdDsSvnDpc672WZF+oqUSUJhLDP6JISXsbkRenipdM/FH3Zm9VNnGVJxiHX pR6Nf5PmZYJF6TPUqu6Vmysx3BlFERzrtK91qfvIpRvzeLj1M0YDfx1AN4HyemNZCq/YD2IFGAM +g8xO2C6aydzPxxvJpVb3rlf1bodEAXWvLK45iayYAPokHn2cPdI19sV6DTIP4t0Srv7G5HlIep oUYRd7WhM5f1rrkzs4U+wptwFjpyyIsFvJQAcolOneRw== X-Received: by 2002:a17:903:32cc:b0:2bf:23ad:8598 with SMTP id d9443c01a7336-2bf3679336dmr37430715ad.5.1780134306001; Sat, 30 May 2026 02:45:06 -0700 (PDT) Received: from rockpi-5b ([45.112.0.191]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bf239e700csm61529945ad.10.2026.05.30.02.44.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 May 2026 02:45:05 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , Hans Verkuil , Maxime Jourdan , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Nicolas Dufresne , Sashiko Subject: [PATCH v6 6/8] media: meson: vdec: Configure DMA mask and segment size in probe Date: Sat, 30 May 2026 15:12:52 +0530 Message-ID: <20260530094326.11892-7-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com> References: <20260530094326.11892-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The vdec probe routine did not set explicit DMA constraints, leaving the driver dependent on platform defaults. This could cause allocation failures or fragmented buffer handling on systems with stricter DMA limits. Fix this by: - Setting a 64 bit coherent DMA mask with dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)). - Configuring the maximum contiguous segment size to UINT_MAX via vb2_dma_contig_set_max_seg_size(). This aligns the driver with common DMA setup practices and guarantees large buffer allocations work reliably across platforms. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 4884ee04b352..f99335effe17 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -1064,6 +1064,15 @@ static int vdec_probe(struct platform_device *pdev) if (IS_ERR(core->canvas)) return PTR_ERR(core->canvas); =20 + ret =3D dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)); + if (ret) + return dev_err_probe(dev, ret, "Failed to set DMA mask\n"); + + ret =3D vb2_dma_contig_set_max_seg_size(dev, UINT_MAX); + if (ret) + return dev_err_probe(dev, ret, + "Failed to set DMA max segment size\n"); + of_id =3D of_match_node(vdec_dt_match, dev->of_node); core->platform =3D of_id->data; =20 --=20 2.50.1 From nobody Mon Jun 8 09:48:03 2026 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB0B239EB73 for ; Sat, 30 May 2026 09:45:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134317; cv=none; b=Ep7h3rhIF/rq5oLyasYMdKAh4QrjDRqcX4HlsQdLSxvsnY/52ivdge/1WMm9pFeTWGSm81xheoR+xFn066Qdc5i6Wt7VWSZeHaC33Znnxe3gCWG3Vs1yMU/7mg7BwhF/feO8ut875gj9prqlY9dQ43bq4mAzFEpo0+Cid/HqMlk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134317; c=relaxed/simple; bh=r/mFmOM61+eHlTftM3kVYPBjuVOCnP0h2xGjOd4i4LA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=L10obzGRmt2lIchGTrgguAp4MAY7HYJ0zRLciBWylhekqgbQq3y1eJ+3mzanX8PRHRXq4ljwQhk5dDIWzdHWPl1FdGTbrsDWhETNm68T2uuvZmljdedodZz9rq5yXmPdHbRFPDqtkUl1IYvAInZfrCNO4UMZtvVf1cSzZd4ig1o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mRoI6cYh; arc=none smtp.client-ip=209.85.214.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mRoI6cYh" Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2bf008a99d4so29393235ad.2 for ; Sat, 30 May 2026 02:45:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780134316; x=1780739116; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=N5aJiRofz4S8JTYcjNZpyXHhE2VKKeRqZ24DGJJ/QHU=; b=mRoI6cYh1nYepdomEUbkhUKdWtYRW35pzYomgvroHNJRcHm18tkXdikGLAp7IwaDIr QE3EuaQW0T9o9ub6RHcyeGcaOj2YMX6vgVgzJkINfj5vGdjtndSPqPcor4ztzIWJjhGq 4qUHQo01094PlL+LaUClL+MMwcGgOn8jWM8MvIbjOcEkesg7OY3ln/T8WPKpVtGEA9pf catjIA4a0b1HwUSuNHLAM3nDvxt+ENSrJ5d1WBnGQRo1J/cbdGJp3tN6ByOVh0UCOrGx ucuuFOrBFjNcldaPfpOTl8FavWrctXl5yyIwdUagoSKvKiREqApgs5gP8crsz84dXASE lpwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780134316; x=1780739116; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=N5aJiRofz4S8JTYcjNZpyXHhE2VKKeRqZ24DGJJ/QHU=; b=P94HffdzGHK/R5sOYPnql7MXl4XEcCV52ZCtezrzalvet1qwItZn2eAtJIgsG5AgOd 5/31RSgUKwkv6StbtSDaQ+Vsu5oYrmk4IlnyHxfgP6jQFewMLCee4I822+vKSlDjRRci yflXkOuzW1JM7+mG4/Ej6wsdKQEej3jnUEv9eixQQ+yHgDlaW6qgOSlEveAtmkLtTtoe NfAh7AemShXgNJ1gyO7XVga0vFyaA7nsUE9qkcbbi/j2FT7GTdUhd2ws1f7+dOCzK2Bu xCaIukEnhIKk9ODtQQd8nESz57Eto9+mCpArCa7OI0ZNLkIDI6K7VSC63btlIaqMUWwv EfUw== X-Forwarded-Encrypted: i=1; AFNElJ+MkQfUgit4hiV5idJbXy4vSty21iXys+xe/cTG+OrUjykmBtfztrhyfM+KWYXvBrQuG04WeKhgW1peEEs=@vger.kernel.org X-Gm-Message-State: AOJu0YyMGMIh8n/G8F/mGtFP2ow0noluYqOwLfRIMB6/UAK0a9cSDpyc Iewjaox3knDwNqugaCN2UmIFXqm2X0AEGlLyg9iHRxv+4K6KUA8VbQjQ X-Gm-Gg: Acq92OESN+9Qx/i5CUvWSivZbPlsGm3qxiz6AbmOLEZ2xE6zWH6OJtQ+Ezst4jV2nnz 5gqSSbjn1HFwGVC2va7d/V2c4dB7vVVfm2TOBYh4gtlzBNSjiKw/ey+t9U/hbqpOmy9nmUQgej2 vwBNYR1FOwzyptxdhkQt9Wi5Fgq47knBXmf69rj5aC/slJMS1VnCbjDjHZTfXOvL+cluVKYn2te rHIQWPW0NIqU810ejDqMClJ9SgVSIZCOJHZPYrpimEnYM/sxLOsKPX5rMkRDtSnh+opC72clRPt E4Cv74tkYwc7rVMnrMZ/Ps3T1yEvKaUH/It7MCjFBTDckWMNI7tehpSlgom+XHQDh9rvzJNyLrp eiuO2eAZaVQ0bcQ1epJYe13/Fcl6C4x58UQBG6VFXEuoiRbOw706TYoGDazHTk4n8D6H82jeWlD Fcg5Lmz1HSYy1zoHKYWAatW4ZtokLlO1k= X-Received: by 2002:a17:902:e88e:b0:2c0:a3dd:4e6c with SMTP id d9443c01a7336-2c0a3dd4f17mr23090205ad.38.1780134315999; Sat, 30 May 2026 02:45:15 -0700 (PDT) Received: from rockpi-5b ([45.112.0.191]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bf239e700csm61529945ad.10.2026.05.30.02.45.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 May 2026 02:45:15 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , Maxime Jourdan , Hans Verkuil , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Nicolas Dufresne , Sashiko Subject: [PATCH v6 7/8] media: meson: vdec: Fix NULL pointer dereference in ISR handlers Date: Sat, 30 May 2026 15:12:53 +0530 Message-ID: <20260530094326.11892-8-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com> References: <20260530094326.11892-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The hard interrupt handler (vdec_isr) and the threaded interrupt handler (vdec_threaded_isr) directly read core->cur_sess without synchronization or validation. If a streaming teardown concurrently clears core->cur_sess to NULL while an interrupt is being processed, a NULL pointer dereference occurs when accessing the session fields or codec operations. Fix this race condition by using READ_ONCE() to obtain a stable, atomic snapshot of core->cur_sess. Check if the returned session pointer is NULL, and return IRQ_NONE immediately if the session has already been torn down. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index f99335effe17..3897c75b19c8 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -996,17 +996,36 @@ static const struct v4l2_file_operations vdec_fops = =3D { static irqreturn_t vdec_isr(int irq, void *data) { struct amvdec_core *core =3D data; - struct amvdec_session *sess =3D core->cur_sess; + struct amvdec_session *sess; + irqreturn_t ret =3D IRQ_HANDLED; + + /* + * Use READ_ONCE to secure an atomic snapshot of the pointer, + * protecting against concurrent clearing during streaming + * teardowns. + */ + sess =3D READ_ONCE(core->cur_sess); + if (!sess) + return IRQ_NONE; =20 sess->last_irq_jiffies =3D get_jiffies_64(); + ret =3D sess->fmt_out->codec_ops->isr(sess); =20 - return sess->fmt_out->codec_ops->isr(sess); + return ret; } =20 static irqreturn_t vdec_threaded_isr(int irq, void *data) { struct amvdec_core *core =3D data; - struct amvdec_session *sess =3D core->cur_sess; + struct amvdec_session *sess; + + /* + * Prevent late-stage threaded interrupts from dereferencing a NULL + * session. + */ + sess =3D READ_ONCE(core->cur_sess); + if (!sess) + return IRQ_NONE; =20 return sess->fmt_out->codec_ops->threaded_isr(sess); } --=20 2.50.1 From nobody Mon Jun 8 09:48:03 2026 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C2CB39E6F8 for ; Sat, 30 May 2026 09:45:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134328; cv=none; b=hPa2lBcDk2m6oWMxyjSYM7bC8vXWoQbax1ujHFwbZwfwqbwlL9Mm5ftVXQFvHFhKdIh/97/lPyftrjM8JhXCwbDPnLtycR4X0uf4AK6N39+8kAi2x4EUlCEGEk+ZY6kyv1ogvwneLtfH3/RZ66ECChA2oYYRyioP8QRen4b1YsM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780134328; c=relaxed/simple; bh=LyUfGFZW+p2oW5KkXZ5y3kByeO4P0yiGXlBBXARqQcY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=HW+lvojLNo4GQupDLxu8Z7IVFJKCTr4vvIQ11zPylwVPrAln7ysytVVyWjeyRN/tCh/tZ7AFZkZWoZf7gMEKrBCDt1RpUQ9UTodMqhmroiiYTUxbFaJteVrKyXs6v4b+5MPevBGYZpdE2Oghwqp2ozkZHinGFK4h6bgJzCwg/h8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TmaGpsIX; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TmaGpsIX" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2bf1cda2b17so12737715ad.1 for ; Sat, 30 May 2026 02:45:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780134326; x=1780739126; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=aVc/26APRiTPbdxNs/jo+GGLcrXaHHIyPQYjeJMMqc0=; b=TmaGpsIXexhGH1R9Km1Kwtx+/SsypTBXVHmITwz3cC5u8zKS/wUNREyHwq4fXcO/K5 1rKi6JhsMbKRkAnJBWqSFAFtS7dRmr4rrTut/FgSH3SAyWDAu3SxhMLxLoYfcNQZxqgn Xa46dovW4ElCie4QRUNRsfIKCn+NhTMTxIxLwOfavbND/1ho7DiMYMh/VF9SoiUMwVL9 1zqdQqccxKADuOj/jxX0WFnYpbw0gOfRy2Aw1arfA2ryfx2SRu9rQeZLoUKYOudPHcK2 ogJsEEMCxjI+HwBBnQdkVUsg2DOUCepXqZzFcZBxyuOTaZ0AN11cCA43WFjKkmkqr0p6 M3fQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780134326; x=1780739126; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=aVc/26APRiTPbdxNs/jo+GGLcrXaHHIyPQYjeJMMqc0=; b=KDSMd71FVMoSZZQLsRrOVraSsIWaz0OSrCEBJxUJJ+ZCAr+1n8j7MWJ0nNF2MGUip0 fHDmuZpjoEhQjlGYSV91SyOQUQQQ34GK7/72vT92uqjEQqCaL45sLnyhTacxIADgSLcv YJoLmdoLFHs1AvygwIq+h8mOgP14YdpitHagDZwJTYUNZbiiBPpRH7hz3iLURGETmLbD j8fwBnHmoVrLDEdazhQAB64Y1bRwWMAiqSf2OBGDKicP2jXXW/MFujpr7YCPKxi6Ws+2 NiATCavoS1HmtynsXxG8s6/OAZcSrobuy6MMoQPNl7DYLtxdlJQpH025mKzS8vr2oCc0 1jmg== X-Forwarded-Encrypted: i=1; AFNElJ++ChWuL309BmVYCjFJ4R1C37FmumBp8IAZbIBJ9U+xV6mXMcZVyOhWrT4peyR4WLkpXlcvWYCjJ0hxbCk=@vger.kernel.org X-Gm-Message-State: AOJu0Yzh7odoFV9ZLGi9LJojIYCVc5lK5jN/YAe9JeeharuGTxTqFz+w elzX9Fhdb5hLpLPEIAyEkn4OFplJOBxoxJwvDVjWbSoroEM0ZrXzkGZL X-Gm-Gg: Acq92OEZq+e0S4LFGAZYthAV64CiTV+ZZlWyZTr5xZinVuq69oBa/gOzt7425tUn7eJ kYvlbl2NB7l18HQI75v/fl1Gxwr9RsL8wz+ri9JWsma9MA5vIiPmFm1HY1AR535uo0Fv3X1bzD1 jALGdhtJQ83AdSHZSwK+WiAgAq0gi899SJbhf7M3JMPLeJrOF04yhjIJAhjZmx5/qWECJFcwRGB p4vngcBkLDODbowr7oUAqNi/0aYhgjfDLAkDS8sIR+2XHmVUP0OvgBAzvmjc3PGv7qTAXe8Ts5I KnzS+GPjjm1mPRXEnPVTtsSizeW77giY9DxnpoqFzbfcMmq2mqfzOXhka+Uswj66vufTYQrfkEG IFScTRtWnSpzA9N8j7IU2t6SU/KTXjOPNj6qRRMxj8tghMqqfRKRnBn9qxL1jJzzLTKLkgDURNf nipJ3hN7Dcva9s4W5hTLASfBjxw0vGxX8= X-Received: by 2002:a17:902:c402:b0:2b0:6068:4c5f with SMTP id d9443c01a7336-2bf2048b983mr72327425ad.8.1780134326539; Sat, 30 May 2026 02:45:26 -0700 (PDT) Received: from rockpi-5b ([45.112.0.191]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bf239e700csm61529945ad.10.2026.05.30.02.45.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 May 2026 02:45:25 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , Hans Verkuil , Maxime Jourdan , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Nicolas Dufresne Subject: [PATCH v6 8/8] gpu: drm: meson: Fix DMA max segment size for DMABUF imports Date: Sat, 30 May 2026 15:12:54 +0530 Message-ID: <20260530094326.11892-9-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com> References: <20260530094326.11892-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable When using hardware-accelerated video decoding via v4l2m2m-copy with mpv or similar players, the video decoder driver (`meson_vdec`) exports contiguous memory allocations as DMABUFs. When these buffers are subsequently imported by the display controller driver (`meson-drm`) for rendering via the GPU or compositor, the DMA API throws constraint validation warnings. - Call dma_set_max_seg_size(dev, UINT_MAX) to allow large scatter=E2=80=91gather segments. - Ensures the DRM core and canvas allocations can handle full sized buffers without hitting DMA=E2=80=91API warnings. This aligns the driver with common DMA setup practices and avoids failures on platforms with strict segment limits. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/gpu/drm/meson/meson_drv.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meso= n_drv.c index 49ff9f1f16d3..8570add8b831 100644 --- a/drivers/gpu/drm/meson/meson_drv.c +++ b/drivers/gpu/drm/meson/meson_drv.c @@ -247,6 +247,8 @@ static int meson_drv_bind_master(struct device *dev, bo= ol has_components) goto free_drm; } =20 + dma_set_max_seg_size(dev, UINT_MAX); + ret =3D meson_canvas_alloc(priv->canvas, &priv->canvas_id_osd1); if (ret) goto free_drm; --=20 2.50.1