From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3FA3C3AB466 for ; Mon, 13 Jul 2026 12:09:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944544; cv=none; b=WLBz1OQ7tTfh13GYGp2HOmu5g5+YV3p24frWac8IbCUUAIp3fgXlRnzHb6izsErV9tiv7PEjZaTJwPAsN4ZA9lsyARPSbrBdo9wS+IXUTwqwOg5rlvmiLURXoCNZ+Ow5fUAMR5zv1Ss8Nn4qE8c4DIokgzIMe8TBPzpMoXsrD5s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944544; c=relaxed/simple; bh=cl53inObwN0kZLnRPY3uNUdKQLoT80ggd4q5F9Ek/xc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=avmX5be5QBWW7ogeLyiJja1hlg/0v5qp2vXidUHeMwI8e5iVgF+40ODzNBOlY6nvjpa3mP6aFfKxqmuAww3hvAO53JIJgoFXbEsaahYZvAfjEv+pnC0hHqVXnLHZDtaFqXI63A/ocN406Pq3cgv67W2yUGNM9bzBknfSVydJdF4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lwh7FtS4; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lwh7FtS4" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-381891a9525so3417505a91.3 for ; Mon, 13 Jul 2026 05:09:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944543; x=1784549343; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ARrER7TwdRrsnOsOCnXp0K3Qc6DycIa1Bph8QCPIN4s=; b=lwh7FtS4MKKS5Ar5VP37XNnQrWU2tumbNNZttckGP63JEYxbpgBOgWoqtt/mjmVkB5 lJ9ELshh/dO12kUCcllOChR7/SJZQIXyi5S2DWvAw9lLmDdd4oCz5n9UOJvY8iR3FFfS Su86cEtZwIAv/D0QLTbc21z/wem7iOIdem8TyByXkWGq70YTdMeJYJNfTDY7FIsStApg z64aaV5cAbHL2pRNsfQnv+3yzc5H97moeeNUi17rqfNn4B1SGKxwpo9p78TkGrErYzz7 pVWU94Ekb20VbPbMwBssHH2YYgqhB6bkQNzAnw49xXSJaGUqycKjmGoYXnrr59jfP9Ue JgrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944543; x=1784549343; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ARrER7TwdRrsnOsOCnXp0K3Qc6DycIa1Bph8QCPIN4s=; b=LGXEFaO43O4eQ0s2IIVmN4rk6NKhSBG+Da8v7yzRurzVivQvX2Zyt+/oMF+7FDmSB2 mmZGbFoOFmezUX16bco5pfMlmKo3POqyjRVJfd8zoPGsx8qIloJm80H5g05v/Agp5sI2 EVuwmVrFtP1Mr02Cil1hJ5QM6xXhnfYJbj1k2/yDzqV9IfAxBFssyDhzMr4MV4dubbBI Ayx84jdnwuWK3bZFCrerX9OS1n+69c5E7gws0ZE4NOI/I4J/g7n5eBmsZhAYWFa+YfpE Aq16BOtfn/teFzJ/2cEb+xjtLJfqSsqAIPv/MOsquiAZeVN/yvxRp48p2q0NqMxbbpjo G0yQ== X-Forwarded-Encrypted: i=1; AHgh+RqAXP/hNXYCJNexN3XICD9WVIGB2uVLoYAIzXPuye7amAiWkArj+pDZ9X6/2WwZoMCORU6GFpaNrom8Utg=@vger.kernel.org X-Gm-Message-State: AOJu0Yz678HO7RcJPLu71MNOvtFK34HduDkrTFodgg/Ypz+ipnmNlBeo oNCFkc/ZO6yir43AURFHcejkLsjGHeej74K3BuNH/sXFrBUFULFFH5WQ X-Gm-Gg: AfdE7ckT/rwpN1guvoghdIx6JPoloCCjBaKL5G2qG8wRfAj74SFan0EtJqnqC827kty 5Gi2gaus1VXno7s/BSzbCyRoiOrkTGSiSyrR1OLRFB6m5ZP16367Ad+aNFymtcotXf//T9DLsBA O9YMjlmM5G7D2Y0wKGBFaq+tMvozIdS+7vARFhlac/fGj0czWftuqUP01tO5ihz/5XIwioC6Bi3 bRkP+pZhA3CalFHKBds3IuUarjVOXZjaEqfarmQM++roGJcDbnwRLlUZ3hZCpmXCQpogJQiwt7c aA+J2C7IzLFvyFxaGlKsePZj4OzvGAcDGpnZUuAZG5LnZxnnJ9ZGSM+L5QqEwa+EhNkxzL12dhk +CzbHpFJbmz1F0kvMply965Ixje6TqV8+d7yH384iGvkdVt8SWSY2TyWHqmIJaGn9q6yjoBObza 2MK+ccC8BfAg== X-Received: by 2002:a17:90b:2750:b0:37c:18e0:90dc with SMTP id 98e67ed59e1d1-38dc75ebea3mr8633908a91.16.1783944542617; Mon, 13 Jul 2026 05:09:02 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.08.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:09:01 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Sashiko Subject: [PATCH v7 01/19] media: meson: vdec: Fix m2m device lifetime and cleanup path Date: Mon, 13 Jul 2026 17:36:56 +0530 Message-ID: <20260713120840.17427-2-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The vdec driver was incorrectly initializing a new v4l2_m2m device instance per session inside vdec_open() and releasing it in vdec_close(). This design is faulty because the m2m device models the core hardware engine and must persist across multiple sessions. Fix the lifetime by moving v4l2_m2m_init() into vdec_probe() and releasing it in vdec_remove() which resolves passing the global core->m2m_dev down to session contexts so all sessions share the same hardware instance. This change aligns the driver with proper v4l2_m2m usage, ensuring the hardware device lifetime is tied to the platform driver core, not individual sessions, and making teardown safe and predictable. Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260520045905.6ACBA1F000E9@smtp.kernel= .org/#t Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 36 +++++++++++++------------ drivers/staging/media/meson/vdec/vdec.h | 4 +-- 2 files changed, 21 insertions(+), 19 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index a039d925c0fe5..6ae3471155a87 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -153,7 +153,7 @@ static void vdec_m2m_job_abort(void *priv) { struct amvdec_session *sess =3D priv; =20 - v4l2_m2m_job_finish(sess->m2m_dev, sess->m2m_ctx); + v4l2_m2m_job_finish(sess->core->m2m_dev, sess->m2m_ctx); } =20 static const struct v4l2_m2m_ops vdec_m2m_ops =3D { @@ -873,23 +873,16 @@ static int vdec_open(struct file *file) =20 sess->core =3D core; =20 - sess->m2m_dev =3D v4l2_m2m_init(&vdec_m2m_ops); - if (IS_ERR(sess->m2m_dev)) { - dev_err(dev, "Fail to v4l2_m2m_init\n"); - ret =3D PTR_ERR(sess->m2m_dev); - goto err_free_sess; - } - - sess->m2m_ctx =3D v4l2_m2m_ctx_init(sess->m2m_dev, sess, m2m_queue_init); + sess->m2m_ctx =3D v4l2_m2m_ctx_init(core->m2m_dev, sess, m2m_queue_init); if (IS_ERR(sess->m2m_ctx)) { dev_err(dev, "Fail to v4l2_m2m_ctx_init\n"); ret =3D PTR_ERR(sess->m2m_ctx); - goto err_m2m_release; + goto err_free_sess; } =20 ret =3D vdec_init_ctrls(sess); if (ret) - goto err_m2m_ctx_release; + goto err_release_ctx; =20 sess->pixfmt_cap =3D formats[0].pixfmts_cap[0]; sess->fmt_out =3D &formats[0]; @@ -913,10 +906,8 @@ static int vdec_open(struct file *file) =20 return 0; =20 -err_m2m_ctx_release: +err_release_ctx: v4l2_m2m_ctx_release(sess->m2m_ctx); -err_m2m_release: - v4l2_m2m_release(sess->m2m_dev); err_free_sess: kfree(sess); return ret; @@ -927,9 +918,9 @@ static int vdec_close(struct file *file) struct amvdec_session *sess =3D file_to_amvdec_session(file); =20 v4l2_m2m_ctx_release(sess->m2m_ctx); - v4l2_m2m_release(sess->m2m_dev); v4l2_fh_del(&sess->fh, file); v4l2_fh_exit(&sess->fh); + v4l2_ctrl_handler_free(&sess->ctrl_handler); =20 mutex_destroy(&sess->lock); mutex_destroy(&sess->bufs_recycle_lock); @@ -1059,16 +1050,23 @@ static int vdec_probe(struct platform_device *pdev) if (ret) return ret; =20 + core->m2m_dev =3D v4l2_m2m_init(&vdec_m2m_ops); + if (IS_ERR(core->m2m_dev)) { + dev_err(dev, "Failed to initialize v4l2 m2m device\n"); + return PTR_ERR(core->m2m_dev); + } + ret =3D v4l2_device_register(dev, &core->v4l2_dev); if (ret) { dev_err(dev, "Couldn't register v4l2 device\n"); - return -ENOMEM; + ret =3D -ENOMEM; + goto err_m2m_release; } =20 vdev =3D video_device_alloc(); if (!vdev) { ret =3D -ENOMEM; - goto err_vdev_release; + goto err_v4l2_unregister; } =20 core->vdev_dec =3D vdev; @@ -1096,7 +1094,10 @@ static int vdec_probe(struct platform_device *pdev) =20 err_vdev_release: video_device_release(vdev); +err_v4l2_unregister: v4l2_device_unregister(&core->v4l2_dev); +err_m2m_release: + v4l2_m2m_release(core->m2m_dev); return ret; } =20 @@ -1105,6 +1106,7 @@ static void vdec_remove(struct platform_device *pdev) struct amvdec_core *core =3D platform_get_drvdata(pdev); =20 video_unregister_device(core->vdev_dec); + v4l2_m2m_release(core->m2m_dev); v4l2_device_unregister(&core->v4l2_dev); } =20 diff --git a/drivers/staging/media/meson/vdec/vdec.h b/drivers/staging/medi= a/meson/vdec/vdec.h index 7a5d8e871d708..cc0cfafb8a951 100644 --- a/drivers/staging/media/meson/vdec/vdec.h +++ b/drivers/staging/media/meson/vdec/vdec.h @@ -63,6 +63,7 @@ struct amvdec_session; * @vdec_hevcf_clk: VDEC_HEVCF clock * @esparser_reset: RESET for the PARSER * @vdev_dec: video device for the decoder + * @m2m_dev: v4l2 m2m device * @v4l2_dev: v4l2 device * @cur_sess: current decoding session * @lock: video device lock @@ -87,6 +88,7 @@ struct amvdec_core { struct reset_control *esparser_reset; =20 struct video_device *vdev_dec; + struct v4l2_m2m_dev *m2m_dev; struct v4l2_device v4l2_dev; =20 struct amvdec_session *cur_sess; @@ -183,7 +185,6 @@ enum amvdec_status { * * @core: reference to the vdec core struct * @fh: v4l2 file handle - * @m2m_dev: v4l2 m2m device * @m2m_ctx: v4l2 m2m context * @ctrl_handler: V4L2 control handler * @ctrl_min_buf_capture: V4L2 control V4L2_CID_MIN_BUFFERS_FOR_CAPTURE @@ -230,7 +231,6 @@ struct amvdec_session { struct amvdec_core *core; =20 struct v4l2_fh fh; - struct v4l2_m2m_dev *m2m_dev; struct v4l2_m2m_ctx *m2m_ctx; struct v4l2_ctrl_handler ctrl_handler; struct v4l2_ctrl *ctrl_min_buf_capture; --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0082F406805 for ; Mon, 13 Jul 2026 12:09:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944556; cv=none; b=iNwIsxaydnJVcsrJZrBCR1h6Ef0ia8WJ/Ci5xWy8mzHUpQZVVPQt7w/BzK72g1h/WtWB7aRr5wCStagzYf6XKoox7CPoOADeR74mLddJP2ZBttxQDEkO94pAGkVwINMz0Ww205JL2mmyjwq9bvZVOAliQeky7GJE1aGzn1ryAuY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944556; c=relaxed/simple; bh=N3uewV9p1wEkq7IBGmE047BkMIsp0re4khks6TNRAIE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Q2yWIVYLpeybW19vkmP4mvlwOleKg6Gxx9ASABuNyeJierOv3ZeeIjw5gNIq/xH3rDXrAx9zonksHFbQv2kYfuz9dY19Qfi75x3mGmQmJRcjIigkh/RarSdwxZUJAemB4VvjQyDQRLhOwuERw3e+dAuMIJBd2ggIH7caonza9Q0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=N/mOfQ3D; arc=none smtp.client-ip=209.85.214.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="N/mOfQ3D" Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2cacd69a9c0so31667905ad.1 for ; Mon, 13 Jul 2026 05:09:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944554; x=1784549354; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=O9YYyee56RYzJH/7lhC6WY6QS3lP6Hx70/PxBzEZ1WM=; b=N/mOfQ3D2FKU41gWawBnyoSlMWiQK75gyErFJfHUsnMpFajxXnSQf+w+Ada+WkSTBg yMSPJ6BRBA/f7sGh40e42zutsruTGOg7/C82yCLM2ZAshtBzg0C5+2GD6xvyJxyS/5H3 iuclQvnHwZYAUwM3DIgbGo2JKaal7kf2iMYnuFH7Y9tvr28CDrmcAMkqOimpEg5b1OwB OZWr8fHESAXBq/fdTxJBZwVbMPJbNJUBwKynnkKv1GfaesS2seThg9/sALsTI7UNA1qA NGuJe3rLky8ssUUmYFXMVQTDcwxnJb1IlmkFi7l0eXVpymfL8h5GHGD4WpaLU616wgie RAVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944554; x=1784549354; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=O9YYyee56RYzJH/7lhC6WY6QS3lP6Hx70/PxBzEZ1WM=; b=eODWUs4tTBBHQpV1ffOUXC3W+p190MkQlJjl+Ga0Iqh6ZiNiiUzGIgnnC5JzWrlYpm KeX5aVwDOb9HjVcFrj9UI/hx7wQAQhqsPWP76em5+bA54sdj1OTBQRh+sCs/Me7wbrLc FPw0oTWjR7oUdlGsc8QG5bfEoBsucP56Gm8ypchNDLvSGYYadcElVAs9Jlum+/1R3R03 NHuhsnVxo2DzWKpqxDrYG6BhDJIdfS5dSG/OzL9RJ9wh8KqcmWig2R7c4PpmvSHn2sq1 7y2twZ8k8ufwpJ84VZex3VZ1fh2nO0Lq/0/f+A6oSzIpMYYFhj5+nkSCPnCuK/t2jDPP Nqyg== X-Forwarded-Encrypted: i=1; AHgh+RpTqMSS+wvmTOyFI9/nNj0gBWSoGTfzP8pMMX4Zd4IiwpMwQClgObvZZBcsrc1ejrKvrYJVG09k4uto/os=@vger.kernel.org X-Gm-Message-State: AOJu0YxxWFklulCDpOY0P+szwDaPnOZzNbQL+oHk3cNChodlSBls1MSW qb2NjnOGEvxwMwEbWy9fv/D1qIGXucBhWUWwrTM+a5zgcXbESvnAAldI X-Gm-Gg: AfdE7cnzfmRbGLXIPZOZrlDd8zKPaDjru9um8wN2DcN1nR/nMQAQKvNHC37aYV5qvCx Yo4/MMEx3DQBDy0QHyzfQUn5ez+HwnAATRK5OdxxdeqEEF6ijm3ipi1fhALIYoTL2OQd0wLxE72 XGJQS3XlBUOsngwi10qJpB9bnAEcOe74TQtrTTxK/9iyFfcR/nvu4iUdy6elku1C4aNq3oM6NM+ LBPEVoUADToPiICOAsw1LKpNqLNFB0Ren9z8A+yuyL1FFlahiJUy/uSSI/OcaHj8sY3OZWp1Xo7 soo3Jp1iLjpH0XCN5GqVsAWZzqrO5dO4ZozcYkREYUitCiAjoTTkXxo3szaCBBuWRzzk4Ah0yWa 4G59SEbrUEsPbRi1pTHhzKlCXsGpXLI/HX/hCmOtvE7++xuuCDyHWgOSimgojbDRdIJr3RB6CCg U65g1pkb0V1kDV7zww2YZ5 X-Received: by 2002:a17:90b:58f0:b0:387:e0db:bc23 with SMTP id 98e67ed59e1d1-38dc77b82bemr9015022a91.35.1783944553867; Mon, 13 Jul 2026 05:09:13 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.09.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:09:13 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne , Sashiko Subject: [PATCH v7 02/19] media: meson: vdec: Fix STREAMON / STREAMOFF race conditions and session teardown Date: Mon, 13 Jul 2026 17:36:57 +0530 Message-ID: <20260713120840.17427-3-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The vdec driver suffered from unsafe state transitions and race conditions when handling concurrent STREAMON / STREAMOFF calls and dynamic resolution change (DRC) events. Global context pointers (e.g. core->cur_sess) and session status flags were updated outside proper lock boundaries, allowing parallel threads to corrupt hardware state under load. Address these architectural stability flaws with the following changes: 1. In vdec_start_streaming(), safely encapsulate hardware occupancy evaluations and target session context claims within a secure mutex lock (core->lock). This blocks overlapping multi-threaded STREAMON calls from creating concurrent assignment conflicts. 2. Restructure initialization error path handlers to avoid global memory maps cross-contamination. Segregate buffer flushes cleanly based strictly on the active vb2 queue type (OUTPUT vs CAPTURE) to avoid incorrectly reclaiming undecoded ready blocks. 3. In vdec_stop_streaming(), introduce state-aware tracking to accurately identify DRC conditions. If a resolution modification forces a capture queue reset while the output stream is still live, preserve the driver's inner runtime states and bypass premature hardware power-off sweeps. 4. Enforce strict null-pointer safety limits inside DMA unmapping sequences. Explicitly clear tracking metadata entries (sess->vififo_vaddr =3D NULL) inside the VIFIFO freeing routines to neutralize accidental double-free risks. Together these changes harden the driver against concurrency bugs, eliminate memory leaks, and ensure predictable session lifecycle management under multi threaded workloads. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260530100841.9CEBA1F00893@smtp.kernel= .org/ Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 136 +++++++++++++++++------- 1 file changed, 95 insertions(+), 41 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 6ae3471155a87..d1f35fc893de1 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -286,11 +286,6 @@ static int vdec_start_streaming(struct vb2_queue *q, u= nsigned int count) struct vb2_v4l2_buffer *buf; int ret; =20 - if (core->cur_sess && core->cur_sess !=3D sess) { - ret =3D -EBUSY; - goto bufs_done; - } - if (q->type =3D=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) sess->streamon_out =3D 1; else @@ -308,9 +303,29 @@ static int vdec_start_streaming(struct vb2_queue *q, u= nsigned int count) } =20 if (sess->status =3D=3D STATUS_RUNNING || - sess->status =3D=3D STATUS_NEEDS_RESUME || - sess->status =3D=3D STATUS_INIT) + sess->status =3D=3D STATUS_NEEDS_RESUME) + return 0; + + /* + * Secure the core hardware lock before checking availability + * and updating session states to prevent STREAMON race conditions. + */ + mutex_lock(&core->lock); + if (core->cur_sess && core->cur_sess !=3D sess) { + ret =3D -EBUSY; + mutex_unlock(&core->lock); + goto err_unlock_no_hw; + } + + /* If already half-initialized, do not re-initialize */ + if (sess->status =3D=3D STATUS_INIT) { + mutex_unlock(&core->lock); return 0; + } + + sess->status =3D STATUS_INIT; + core->cur_sess =3D sess; + mutex_unlock(&core->lock); =20 sess->vififo_size =3D SIZE_VIFIFO; sess->vififo_vaddr =3D @@ -319,7 +334,7 @@ static int vdec_start_streaming(struct vb2_queue *q, un= signed int count) if (!sess->vififo_vaddr) { dev_err(sess->core->dev, "Failed to request VIFIFO buffer\n"); ret =3D -ENOMEM; - goto bufs_done; + goto err_cleanup_session; } =20 sess->should_stop =3D 0; @@ -333,33 +348,43 @@ static int vdec_start_streaming(struct vb2_queue *q, = unsigned int count) =20 ret =3D vdec_poweron(sess); if (ret) - goto vififo_free; + goto err_free_vififo; =20 sess->sequence_cap =3D 0; sess->sequence_out =3D 0; + if (vdec_codec_needs_recycle(sess)) sess->recycle_thread =3D kthread_run(vdec_recycle_thread, sess, "vdec_recycle"); =20 - sess->status =3D STATUS_INIT; - core->cur_sess =3D sess; schedule_work(&sess->esparser_queue_work); return 0; =20 -vififo_free: - dma_free_coherent(sess->core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); -bufs_done: - while ((buf =3D v4l2_m2m_src_buf_remove(sess->m2m_ctx))) - v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED); - while ((buf =3D v4l2_m2m_dst_buf_remove(sess->m2m_ctx))) - v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED); - +err_free_vififo: + if (sess->vififo_vaddr) { + dma_free_coherent(sess->core->dev, sess->vififo_size, + sess->vififo_vaddr, sess->vififo_paddr); + sess->vififo_vaddr =3D NULL; + sess->vififo_paddr =3D 0; + } +err_cleanup_session: if (q->type =3D=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) sess->streamon_out =3D 0; else sess->streamon_cap =3D 0; =20 + mutex_lock(&core->lock); + if (core->cur_sess =3D=3D sess) + core->cur_sess =3D NULL; + if (sess->status !=3D STATUS_NEEDS_RESUME) + sess->status =3D STATUS_STOPPED; + mutex_unlock(&core->lock); +err_unlock_no_hw: + while ((buf =3D v4l2_m2m_src_buf_remove(sess->m2m_ctx))) + v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED); + while ((buf =3D v4l2_m2m_dst_buf_remove(sess->m2m_ctx))) + v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED); + return ret; } =20 @@ -399,30 +424,13 @@ static void vdec_stop_streaming(struct vb2_queue *q) struct amvdec_codec_ops *codec_ops =3D sess->fmt_out->codec_ops; struct amvdec_core *core =3D sess->core; struct vb2_v4l2_buffer *buf; + enum amvdec_status old_status; + bool full_cleanup =3D false; =20 - if (sess->status =3D=3D STATUS_RUNNING || - sess->status =3D=3D STATUS_INIT || - (sess->status =3D=3D STATUS_NEEDS_RESUME && - (!sess->streamon_out || !sess->streamon_cap))) { - if (vdec_codec_needs_recycle(sess)) - kthread_stop(sess->recycle_thread); - - vdec_poweroff(sess); - vdec_free_canvas(sess); - dma_free_coherent(sess->core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); - vdec_reset_timestamps(sess); - vdec_reset_bufs_recycle(sess); - kfree(sess->priv); - sess->priv =3D NULL; - core->cur_sess =3D NULL; - sess->status =3D STATUS_STOPPED; - } - + /* flush buffers to kill background workqueue thread */ if (q->type =3D=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) { while ((buf =3D v4l2_m2m_src_buf_remove(sess->m2m_ctx))) v4l2_m2m_buf_done(buf, VB2_BUF_STATE_ERROR); - sess->streamon_out =3D 0; } else { /* Drain remaining refs if was still running */ @@ -431,9 +439,55 @@ static void vdec_stop_streaming(struct vb2_queue *q) =20 while ((buf =3D v4l2_m2m_dst_buf_remove(sess->m2m_ctx))) v4l2_m2m_buf_done(buf, VB2_BUF_STATE_ERROR); - sess->streamon_cap =3D 0; } + + /* Hold core lock continuously for the state and resource processing */ + mutex_lock(&core->lock); + old_status =3D sess->status; + + if (old_status =3D=3D STATUS_RUNNING || old_status =3D=3D STATUS_INIT || + (old_status =3D=3D STATUS_NEEDS_RESUME && (!sess->streamon_out || + !sess->streamon_cap))) { + /* + * If it's a DRC event (Capture queue streamoff only), preserve + * the status + */ + if (old_status =3D=3D STATUS_NEEDS_RESUME && sess->streamon_out) { + full_cleanup =3D false; + } else { + full_cleanup =3D true; + sess->status =3D STATUS_STOPPED; + } + } + + if (full_cleanup) { + if ((q->type !=3D V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE || + !sess->streamon_out) && vdec_codec_needs_recycle(sess)) { + kthread_stop(sess->recycle_thread); + } + + vdec_poweroff(sess); + vdec_free_canvas(sess); + + if (sess->vififo_vaddr) { + dma_free_coherent(sess->core->dev, sess->vififo_size, + sess->vififo_vaddr, sess->vififo_paddr); + sess->vififo_vaddr =3D NULL; + sess->vififo_paddr =3D 0; + } + + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); + core->cur_sess =3D NULL; + + kfree(sess->priv); + sess->priv =3D NULL; + } else { + if (sess->status =3D=3D STATUS_NEEDS_RESUME) + sess->changed_format =3D 0; + } + mutex_unlock(&core->lock); } =20 static int vdec_vb2_buf_prepare(struct vb2_buffer *vb) --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 988823FC5AB for ; Mon, 13 Jul 2026 12:09:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944566; cv=none; b=OakErnFdDx3RYFvnLHaOufgGmK3MGVT9SZY6XxTsBemUcKmHcQvdMOOIallRXD+SRgNy4iVJm4jv4d16Xaz3DzIbIE6WPv1PAOgR9bnBWnpV5Mw1sLXHIRHOjWnhPeSu1BH1cZVDxe0YCyBA/Fj3ey1Z6lAcCC5tJui5nvVrv0Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944566; c=relaxed/simple; bh=TtOqSQ0jC946LW7XV7taMYwKwsUHhdUDq21osqmB4CA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SObnAY3nfeoK56DItOsMKi+vFBbQ1xQChqMID1tnY0Q8vG7XU51JsmFHYPPeVjyKlzoFlUxdwXRYpt2X8RVk1u2o56ZsNEh6M8ahU1aiFju5AtTSMGxofcKwmPz/8+dO6gyp6O0OwtLbS9NX3FJzJd3rg+EAREUKWZBGznJRHx4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WCCGJmj+; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WCCGJmj+" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-384c94c9414so2757317a91.3 for ; Mon, 13 Jul 2026 05:09:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944565; x=1784549365; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=1Pn+IHk1Sk762XTDH7lvSm6CZZGNFHunM58OnD0jYLk=; b=WCCGJmj+AH1UNy71cbLmHQ1p35uz6fnVqyVBX2CBKC46whZ2P3mAyFq0zsCNDQ49g7 hTMTZvAYd+cMPIDhqOwywH4Rtcw83a9Oeek/N+G2b3T/7H3M4IuWQ+rf9RnkI+gYuUs2 BA3SrixtcALM70dtNFSLJzPsfM9YGkqbTgNjeQdQSuq1WGbyVPzskYho7wfCICABYRnk zRO4G0EZz3625QZRY2xbnTFmqDo5PKAqbnlcHDpqKQJ1nUP4aSF74ox7jSu99PJl362t lKjNKJ/e97D6ajML4J02YWn+I/lDn3NVfGsUVe31MyLDhWar5F0uRX8Wx5wiaoOQ02mb RFzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944565; x=1784549365; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=1Pn+IHk1Sk762XTDH7lvSm6CZZGNFHunM58OnD0jYLk=; b=hTg8+L/ajlhO4FHVsCkaVx1vZ9li9Lf4UUKfaag9qSflSDlQilGowi+Ciy6hy5HZ1M 9N6u9sbQeohL4l0mNMTqzmjv92WrsEIkoPeU02y8seu1FypkRc55ZMaHBT8xqRL6zw1T HcZefS+e5x9Jd8BR2x1Y8XqmNZpz1bMJw2EJZ03wEcEzXT/kGCAw3crtD+zJ/FbyaTaW u6iJNxgQACBzfFvDgx/b5LB5CSJDnSVoMZlJbu8j+MjqnThLiABhVZutVZNSYzqs61Iy jlC8c1h7PgdPAxmJf4/NP9Yxn6juZloJlV8Rg2yxrDJVrr7Bn46MRU80FlCrQ9hFZAx5 +sSQ== X-Forwarded-Encrypted: i=1; AHgh+RoTMJwgvDypQgWi6QFfe0zBK4Vh02dD1FnBPsCMp3lSHrcsPjxpFKr/MCVMeKAUrQrY0orSbS1BKhnbbG8=@vger.kernel.org X-Gm-Message-State: AOJu0YypiiSNBEpxXXSaLMOvpLHThmHINhk/0e7cIWzghS5x+83Te/gT 6nn4XX3jNygq7209Q8wOKc8n1rF0g27xs6df65pngRUVgBQW8maRNFI1 X-Gm-Gg: AfdE7ckbeBU5loBE+R15PjHbR115QSTuijJ6GrPzu4zrQXr7hcQwVzOjqYmYxeSFcIm GqG/NFYqDHwjo0XGGHo5vBN8SGkKpun3wRHWZLT+epZvvQcR+YBfpeFeb+/eSNzlbxmFAsTCq1a 0ILpWHaBhuDsMzUflOSY2Bjl3/cdiSkjaTtaZdaAOQkcPKtqXlkbPXCiTdtaNLZRW0fwkx84UAV 9LLSHMSx5qCLSvGjUgp5qxZIIqraXzpF5FJ7f8V8oCu1zWI5RHcgfQajptbNCvgeQYl6ur8/6k+ xsbsUI/uHY1791JiWKYQ4vPy6wIJaRBcBaEqYdzY3ugOB7NK1pySzZ5zs44PPZTfItihCUCclXN AybQroxnmIzAnFrvYFJYWfc639chHkR2X77MKyqW+y9MCociDY/CPWJfV5hNZb61KbImx25vUjk kN1+x4qSTf076yucxjUTIg X-Received: by 2002:a17:90b:2884:b0:387:e0db:bc22 with SMTP id 98e67ed59e1d1-38dc77b3846mr9100073a91.34.1783944564932; Mon, 13 Jul 2026 05:09:24 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.09.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:09:24 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne , Sashiko Subject: [PATCH v7 03/19] media: meson: vdec: Fix lifecycle leaks and race conditions in recycle_thread Date: Mon, 13 Jul 2026 17:36:58 +0530 Message-ID: <20260713120840.17427-4-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Validate the return status of kthread_run() during decoder recycling thread initialization to prevent memory leaks, and enforce robust state checking before invoking kthread_stop() to prevent kernel panics. If the system operates under severe memory constraints, the previous implementation silently accepted error pointers returned by a failed kthread_run() operation. Attempting to pass these invalid error pointers downstream to kthread_stop() during streaming stop or application teardown routines triggered instant kernel panics. Furthermore, when thread initialization failed, the lack of an explicit unwinding path leaked the session's private context (sess->priv) and its associated firmware memory block allocations. Because sess->status was never transitioned to STATUS_INIT, any subsequent call to stop streaming or close the driver file node failed its state validation checks, permanently orphaning active platform DMA assets and codec parameters. Fix these thread lifetime and memory leak bugs via the following: 1. In vdec_start_streaming(), add an explicit IS_ERR() verification barrier immediately following the recycling kthread launch. If thread creation fails, capture the error code via PTR_ERR(), clear the dangling pointer tracking entry to NULL, and jump to a newly added 'err_poweroff' label to unwind hardware settings and clear out allocated structural components cleanly. 2. In vdec_stop_streaming(), protect the teardown execution track by wrapping the kthread_stop() invocation inside a safe !IS_ERR_OR_NULL() conditional block to ensure the target thread structure actually exists in system memory before stopping it. 3. In vdec_close(), cleanly wind down and terminate any lingering recycling threads at the absolute entry boundary of the routine before flushing data framework contexts and releasing the file descriptor matrices to user space. Together, these changes ensure predictable driver behavior, prevent kernel panics during low-memory conditions, and guarantee that memory and DMA assets are fully reclaimed during teardown. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 48 +++++++++++++++++++++++-- 1 file changed, 45 insertions(+), 3 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index d1f35fc893de1..7fc73d5cdebbf 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -32,6 +32,10 @@ struct dummy_buf { /* 16 MiB for parsed bitstream swap exchange */ #define SIZE_VIFIFO SZ_16M =20 +static void vdec_free_canvas(struct amvdec_session *sess); +static void vdec_reset_timestamps(struct amvdec_session *sess); +static void vdec_reset_bufs_recycle(struct amvdec_session *sess); + static u32 get_output_size(u32 width, u32 height) { return ALIGN(width * height, SZ_64K); @@ -353,13 +357,23 @@ static int vdec_start_streaming(struct vb2_queue *q, = unsigned int count) sess->sequence_cap =3D 0; sess->sequence_out =3D 0; =20 - if (vdec_codec_needs_recycle(sess)) + if (vdec_codec_needs_recycle(sess) && !sess->recycle_thread) { sess->recycle_thread =3D kthread_run(vdec_recycle_thread, sess, "vdec_recycle"); - + if (IS_ERR(sess->recycle_thread)) { + ret =3D PTR_ERR(sess->recycle_thread); + sess->recycle_thread =3D NULL; + goto err_poweroff; + } + } schedule_work(&sess->esparser_queue_work); return 0; =20 +err_poweroff: + vdec_poweroff(sess); + vdec_free_canvas(sess); + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); err_free_vififo: if (sess->vififo_vaddr) { dma_free_coherent(sess->core->dev, sess->vififo_size, @@ -464,7 +478,10 @@ static void vdec_stop_streaming(struct vb2_queue *q) if (full_cleanup) { if ((q->type !=3D V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE || !sess->streamon_out) && vdec_codec_needs_recycle(sess)) { - kthread_stop(sess->recycle_thread); + if (!IS_ERR_OR_NULL(sess->recycle_thread)) { + kthread_stop(sess->recycle_thread); + sess->recycle_thread =3D NULL; + } } =20 vdec_poweroff(sess); @@ -970,6 +987,31 @@ static int vdec_open(struct file *file) static int vdec_close(struct file *file) { struct amvdec_session *sess =3D file_to_amvdec_session(file); + struct amvdec_core *core =3D sess->core; + + if (!IS_ERR_OR_NULL(sess->recycle_thread)) { + kthread_stop(sess->recycle_thread); + sess->recycle_thread =3D NULL; + } + + mutex_lock(&core->lock); + + vdec_poweroff(sess); + vdec_free_canvas(sess); + core->cur_sess =3D NULL; + + if (sess->vififo_vaddr) { + dma_free_coherent(core->dev, sess->vififo_size, + sess->vififo_vaddr, sess->vififo_paddr); + sess->vififo_vaddr =3D NULL; + sess->vififo_paddr =3D 0; + } + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); + kfree(sess->priv); + sess->priv =3D NULL; + + mutex_unlock(&core->lock); =20 v4l2_m2m_ctx_release(sess->m2m_ctx); v4l2_fh_del(&sess->fh, file); --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A14333FC5AB for ; Mon, 13 Jul 2026 12:09:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944577; cv=none; b=ZjxDG05tzRXVGyDHSaI9DPlBAOuaIvH8Ys7IA6522+TcJSHe2uuY2oT9G4i+a4n9d8Ajt00DeJMvkB3mcNU+Sc0w6hbFyqwJY8XSy5R2D35zrMCyLgyle6eDcwps+PFwFL8Qwlwc2OlWUaNgraCoxVr3beIM1CjnOei1M/nm9Ns= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944577; c=relaxed/simple; bh=w1FVvyBSHnItHZLCaA4u0+0Ud64qWBuiALT5aaHxYAw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qow3wfp2zVp6+nGhrT7LSYdcIhZs84c2UmJ+a867/WURaczOhVY/tLiOdw9CKEx1prD+JvrwBNr7ujwymauc0fJMzdNo8K0o3aWE0o7HRIdt344n/mmvIcXwJN/NdMMNBq4WkYf7kQGgPHtbnRt+M+pYiYlb9eOPD+KXVH4UvIs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=G5rMzgOs; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="G5rMzgOs" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-381b831d535so3503113a91.0 for ; Mon, 13 Jul 2026 05:09:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944576; x=1784549376; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=K3WTyPeomnpShciKNumkAzLHLjjvlL0zze6H3PBXARM=; b=G5rMzgOsTZIMBe8X91OXIqp31fowVMYh5+W+8NhYy1XVDf8MXAX3kWUPM0moLCDMcI 7rrbKW+GSnQfJJUihaMphg4Xf9iYcI0vUx77cYVEe8MltMX0HNLr4uIHDjDF8DQGV6Vz vm1go7g8AfsZzt3aFhZkerO8DzVgj5On9MD7fGj6G95mwyDaCXZIqDLEJ4lqqaraerfz 7CP3RPyB+GIaTORt+rwiGS2VzFF7bmEq66OCSPyEQO94AVmjmGfTvhgtm9i11XVJLF2+ IPjsZy9Hdfd5WrIzBdjg9+HLSfL3hAQ6ncZeOqWIcDNDXGOLZrtTL6KoALfWt8YHCRA+ H1ZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944576; x=1784549376; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=K3WTyPeomnpShciKNumkAzLHLjjvlL0zze6H3PBXARM=; b=Fe/hB4v479hxQSQHgoFncMUTPWW+kAQDgr1DOFMc6vnNnwkSZwnOF93eZCK06Do6G4 +I9vj41AfGFwfA2+4LkgVtmoO7k+glcr1db1kjXQpmOu00zu0RINU01TmkwN/1VFdGuz 1NqqvMopCbPsZCIAslKsTuqrmbeKknuITUJ91Zdx30Lyu4VndJzakPjZTrhEGZx7/txI TV/z6604U6ih9985fk+HcW19tuOcfjSa1wDPuWe8SHxswCdAfaJyFtNAOW1lWDiU7V4S GmcO7xqoa1sK2WA20q6BrXTSMz+9XX0935pGTI1hzyglJda3WRWTTWMNg+3z3Df2YtVi OqAQ== X-Forwarded-Encrypted: i=1; AHgh+Rqiplcn0Dhc5I20BBAQpTdDpv9z5GlHzTaC94fWXRT9OQ5BBRHbHdYs68XKtNCFDDURZeqeHjmiNxjUJpM=@vger.kernel.org X-Gm-Message-State: AOJu0YzN6gAYTuhypzeVbgeMnf0GEfoCeBVY7FwwKJD7B0llva+/Swtz 2VkkipYhV73DVRw2iXMRfMesogzKKh/CQP5sFW2yt9OIqXS6w3a4VD6/ X-Gm-Gg: AfdE7ckwv+uTxCkdSdzymcRY1fJjLGnJK2PNB4qRnmnVy6+Y+RMdCn3mtD/tQLPmYQl s64cG6buKRi7/D6qcmobidQn90KO0XDGZpw2OiVBmLE9683MCcpWGH28N3lcTHhHKqA18hRMi8Q EGGJTYQiKbiHkD3ERDerdsX2dshpku0KlbVIf2lhQSW6FOdT0IwnhowtRgIit8Lb89v08qx9Xtm IabyCkBC9cvIH3seJP1UM/UjwcX8Vml8AuERYr6AjD6HRcg4YiANYOgd/bIQnnkIR0mTXK5f9DN q/Thwg1E9JLPNKed4Ll6u4D4azl68ihdqIrvifUU30RL6UQ8VseIXOXTP116dt00mAdNeLCs3KS BkrFUPb9/HfnBsp+5Jfa1I/7gaF3najQB8YUwW4baPV3NcOAV9n68Sn4VOertA8cAizQX/JiBAJ 7ApZcxwS5ykQ== X-Received: by 2002:a17:90b:2248:b0:387:e0db:3fae with SMTP id 98e67ed59e1d1-38dc7779d32mr8371305a91.39.1783944575701; Mon, 13 Jul 2026 05:09:35 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.09.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:09:34 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne , Sashiko Subject: [PATCH v7 04/19] media: meson: vdec: Fix use-after-free race between teardown and ISR routines Date: Mon, 13 Jul 2026 17:36:59 +0530 Message-ID: <20260713120840.17427-5-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Prevent critical race conditions and null pointer dereferences inside the Amlogic video decoder driver by synchronizing the interrupt service routines during session teardown and file descriptor release phases. The hardware interrupt handler (vdec_isr) and threaded handler (vdec_threaded_isr) read 'core->cur_sess' without proper synchronization. During a streaming teardown sequence via vdec_stop_streaming() or session release inside vdec_close(), the underlying session structures can be modified or freed concurrently. This creates a transient window where a late-stage hardware interrupt can wake up, read 'core->cur_sess', and dereference an invalid or NULL session pointer, causing a kernel panic. Update both the hard and threaded interrupt service routines to capture the current session reference using an smp_load_acquire() barrier snapshot. If the snapshot resolves to NULL, terminate immediately with IRQ_HANDLED to guarantee execution contexts do not process stale structures. Cc: Nicolas Dufresne Suggested-by: Druk Tan Ozturk Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 22 ++++++++++++++++++++-- drivers/staging/media/meson/vdec/vdec.h | 2 ++ 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 7fc73d5cdebbf..7ae3d5a9dd6ab 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -484,6 +484,9 @@ static void vdec_stop_streaming(struct vb2_queue *q) } } =20 + /* Synchronize and flush pending hardware interrupt service routines */ + synchronize_irq(core->vdec_irq); + vdec_poweroff(sess); vdec_free_canvas(sess); =20 @@ -989,6 +992,9 @@ static int vdec_close(struct file *file) struct amvdec_session *sess =3D file_to_amvdec_session(file); struct amvdec_core *core =3D sess->core; =20 + /* Synchronize and flush pending hardware interrupt service routines */ + synchronize_irq(core->vdec_irq); + if (!IS_ERR_OR_NULL(sess->recycle_thread)) { kthread_stop(sess->recycle_thread); sess->recycle_thread =3D NULL; @@ -1038,7 +1044,12 @@ static const struct v4l2_file_operations vdec_fops = =3D { static irqreturn_t vdec_isr(int irq, void *data) { struct amvdec_core *core =3D data; - struct amvdec_session *sess =3D core->cur_sess; + struct amvdec_session *sess; + + /* Secure an atomic acquire snapshot to protect against concurrent teardo= wn */ + sess =3D smp_load_acquire(&core->cur_sess); + if (!sess) + return IRQ_HANDLED; =20 sess->last_irq_jiffies =3D get_jiffies_64(); =20 @@ -1048,7 +1059,12 @@ static irqreturn_t vdec_isr(int irq, void *data) static irqreturn_t vdec_threaded_isr(int irq, void *data) { struct amvdec_core *core =3D data; - struct amvdec_session *sess =3D core->cur_sess; + struct amvdec_session *sess; + + /* Prevent late-stage threaded interrupts from dereferencing a NULL sessi= on */ + sess =3D smp_load_acquire(&core->cur_sess); + if (!sess) + return IRQ_HANDLED; =20 return sess->fmt_out->codec_ops->threaded_isr(sess); } @@ -1136,6 +1152,8 @@ static int vdec_probe(struct platform_device *pdev) if (irq < 0) return irq; =20 + core->vdec_irq =3D irq; + ret =3D devm_request_threaded_irq(core->dev, irq, vdec_isr, vdec_threaded_isr, IRQF_ONESHOT, "vdec", core); diff --git a/drivers/staging/media/meson/vdec/vdec.h b/drivers/staging/medi= a/meson/vdec/vdec.h index cc0cfafb8a951..d165c343fd022 100644 --- a/drivers/staging/media/meson/vdec/vdec.h +++ b/drivers/staging/media/meson/vdec/vdec.h @@ -67,6 +67,7 @@ struct amvdec_session; * @v4l2_dev: v4l2 device * @cur_sess: current decoding session * @lock: video device lock + * @vdec_irq: irq for video decoding */ struct amvdec_core { void __iomem *dos_base; @@ -93,6 +94,7 @@ struct amvdec_core { =20 struct amvdec_session *cur_sess; struct mutex lock; + int vdec_irq; }; =20 /** --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D41403FF8BD for ; Mon, 13 Jul 2026 12:09:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944588; cv=none; b=n/1gwqNX8wkP+RNnRFqMiEXzuuFXL9K9OJKBKUWBdSIq8RIPgAQArlf6t7I+wwP47zUXGPNjWBt36XhLX5idy9AgV2do2v7Cyw64a6BWfUoey6GGBANjkH9bC4VsJtDqTjFoZ3yjLX9PeZnAQ721mO8YdVZC5fZQKfK/KBJM2PA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944588; c=relaxed/simple; bh=ny5o3zfT0fuGJoeS4GUfxj8Tt3OekTQ0Vscu+ywukhs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IgkEl5raBOTyLBf1N2KVW+OwXtcNA6cDLstGkG78RtTeNfnQG1FBu5uuu5Qf/VylPfWFeZ1ZyYa/M/Fv6Gn6IuocfsJNbhd0qenhBgu+eEX3JTHtiRlZqyyS3joAd1Hc6enWxDpRlrN989AtMXefGsREBVBsx5aB2u8+YYaWvzw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZOCCPdL/; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZOCCPdL/" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-38deea72eebso930970a91.1 for ; Mon, 13 Jul 2026 05:09:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944586; x=1784549386; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Krigkeb0EY7ngMYX+Y7ADjdq0pOv6Fpp5Q1fhmmedpo=; b=ZOCCPdL/Qlgk9Q4gYRWVv5RhK2kIbh7G6+X6nrEzPYNmcuDW5xeFEp1eZbFIupWDVU sxyt+8LwMlUyzwKTjPysg9b1N81KPZLM9V21/Od86SKre1hC7BjN5UvN3fYlN2Tj8EsZ AldchHiAJQhn5su0HdRMDqCxRl1GQBaRxAq4KyXwqPcI6rd2NdRh9SRsXZo9ielriJn+ oSAnTkCvq+9slXFDjvVpX4VDSFuibXs4uoRNqX79c0/up3Ihtxw6YMsXvVAr4rNdpXrX J7ZTagAVOBLNHWdb5UBLQsL14wRHJouSnIuypwaHkaYQ9eBUqOQcYvajjl3tBG2xwV+N /4zQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944586; x=1784549386; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Krigkeb0EY7ngMYX+Y7ADjdq0pOv6Fpp5Q1fhmmedpo=; b=eLEh4y3uzcF8f0wefHL1HcgBIgpAYYoQOYAhBAws3RYV7WgMdRQ2OPaMvRS2VMTamm /cXCIIlaMiIJayAf3p7uRpfeFdNMLINFTx/StzLllM3N/L0KE1VuZNRXtSZI/hNdte1G b3OH1B0U5NE9/n7ftHdEsUry2l+npS9rf+rmA9TU3ZcWAOeFrQpBn6l5JJk3eWK2/y2C VIPGVWW/tP27+/7I9e9j3uSvIvbLmpXce5HEyqtHD6N6u7a1w9E/ST6bdAO+FdlVybBT 87S/qFqhPTyK/aTpq9BGdZJdZdcTo1gLjqrBPcjdp2WqYBavKApsoBEyiUuQc6o/pp1S /r2w== X-Forwarded-Encrypted: i=1; AHgh+Roih071bKGNhyB978qpau/njQjLB6RCzF/HYGt9eHMgvqITuthYtaxXxh2Zq+CMLiT5FcECyNsLvbF8Ghk=@vger.kernel.org X-Gm-Message-State: AOJu0Yx8ftLRIbXtRCQrW6uH9LCNkvPoZEmRr8X+AH00Gwv/5MtE64vc wNSik9G4Iryx4+GB4s/KABcbsDzsRBv93/s74NyS7IIY+NUAb/cmeAa8 X-Gm-Gg: AfdE7ckyOP9YzK3bFWExuiFD9b9jZE9QBYJ3c49wlfl/eDNI4uyLwCcelA8aflH2yYa luip36IF/arsNbVh3O1HmUyHLmuiKqiCZDoRJRUS6YrrBUpUGiX7d6bQAfLmP43cJPzM1gUEqNB UfhvSo35zgR1qKLuQ0CwC6KSE/gQ0FULq2B9TDtj/W5THZH50wNr0CfKATkZrXfu6ivigN4oLLj BOuSY7IyavFN1bZDpQkDscdb3OaQPLZbrbxlzKBcnbHkNAwHogNmbJDaCl5KlSAAf32OPWH/Elp CXSxKlXJfApNEHaQSnqHthqa+4t86/wcNaEPJVhgPuY/xO/XWDOe2xcweQ7ELqFnKSoVxZutHnW HgkBI6MKAdi+vd32pfyv7IA4snZYXtVUIPkpLsxxRPxZ+62xzOylT4CUHyhbDxSQh0ge8W5cZJV T8P/KmJxXYUsie9qbIUSo7 X-Received: by 2002:a17:90b:4ac1:b0:38d:e0c4:c955 with SMTP id 98e67ed59e1d1-38de0c4ca49mr5634290a91.15.1783944586225; Mon, 13 Jul 2026 05:09:46 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.09.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:09:45 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Sashiko Subject: [PATCH v7 05/19] media: meson: vdec: Fix race condition and synchronize esparser IRQ Date: Mon, 13 Jul 2026 17:37:00 +0530 Message-ID: <20260713120840.17427-6-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" During session teardown sequences in vdec_stop_streaming() and vdec_close(), the 'esparser' hardware interrupt handler can still be actively triggered or executing on another CPU core. This creates a transient race condition where the ISR attempts to handle stream data and allocate internal tracking state structures after session contexts have been modified or freed. Update esparser_isr() to read the current session context utilizing an smp_load_acquire() barrier snapshot. If the pointer resolves to NULL, terminate processing early with IRQ_HANDLED to protect against concurrent dismantling. Suggested-by: Doruk Tan Ozturk Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 8 ++++++++ drivers/staging/media/meson/vdec/vdec.c | 4 ++++ drivers/staging/media/meson/vdec/vdec.h | 2 ++ 3 files changed, 14 insertions(+) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/= media/meson/vdec/esparser.c index 4632346f04a9e..37749ede308c6 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -60,6 +60,12 @@ static irqreturn_t esparser_isr(int irq, void *dev) { int int_status; struct amvdec_core *core =3D dev; + struct amvdec_session *sess; + + /* Secure an atomic snapshot to protect against concurrent teardown */ + sess =3D smp_load_acquire(&core->cur_sess); + if (!sess) + return IRQ_HANDLED; =20 int_status =3D amvdec_read_parser(core, PARSER_INT_STATUS); amvdec_write_parser(core, PARSER_INT_STATUS, int_status); @@ -439,6 +445,8 @@ int esparser_init(struct platform_device *pdev, struct = amvdec_core *core) if (irq < 0) return irq; =20 + core->esparser_irq =3D irq; + ret =3D devm_request_irq(dev, irq, esparser_isr, IRQF_SHARED, "esparserirq", core); if (ret) { diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 7ae3d5a9dd6ab..7689ffdb2e500 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -486,6 +486,8 @@ static void vdec_stop_streaming(struct vb2_queue *q) =20 /* Synchronize and flush pending hardware interrupt service routines */ synchronize_irq(core->vdec_irq); + /* Ensure esparser ISR finishes executing */ + synchronize_irq(core->esparser_irq); =20 vdec_poweroff(sess); vdec_free_canvas(sess); @@ -994,6 +996,8 @@ static int vdec_close(struct file *file) =20 /* Synchronize and flush pending hardware interrupt service routines */ synchronize_irq(core->vdec_irq); + /* Ensure esparser ISR finishes executing */ + synchronize_irq(core->esparser_irq); =20 if (!IS_ERR_OR_NULL(sess->recycle_thread)) { kthread_stop(sess->recycle_thread); diff --git a/drivers/staging/media/meson/vdec/vdec.h b/drivers/staging/medi= a/meson/vdec/vdec.h index d165c343fd022..c4639cf33e73e 100644 --- a/drivers/staging/media/meson/vdec/vdec.h +++ b/drivers/staging/media/meson/vdec/vdec.h @@ -68,6 +68,7 @@ struct amvdec_session; * @cur_sess: current decoding session * @lock: video device lock * @vdec_irq: irq for video decoding + * @esparser_irq: irq for elementary stream parsing */ struct amvdec_core { void __iomem *dos_base; @@ -95,6 +96,7 @@ struct amvdec_core { struct amvdec_session *cur_sess; struct mutex lock; int vdec_irq; + int esparser_irq; }; =20 /** --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82B5B4071C5 for ; Mon, 13 Jul 2026 12:09:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944600; cv=none; b=QVL/IeLblgtWp1fxzbqdAunY1T5CxsFW5YKO26dBU9fMnIUhZw5q+qZajahZR3HT9RFwho7MguX9y2TxFSnFQLQlDW+5a1nfrrKafpuqCmwGKMC/6szRTlq7AM5K9s9fEwlHgmnP8O3E+vpMGP6EPyzXFzZT4Eiw9wKXIrfqy74= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944600; c=relaxed/simple; bh=kWjWrkYR+dFbDvQ8L5AHa4OLzTj4rBUUdqyRkjtvM1s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UlAFf/IeLAcr+f7/bmhJVAwjaZRFVdd82aZ+F187FIc5KUL8DwGMWZPQIwdtG84YvWO3PpDr/dcgMlSlvy1Az+BQcudsS7FqNY7py/0ZyUy9mYpIOsV4pCZ6+aPiiL1wsysnFXDkr+D1BxapavCD9N8DykMv3E4QvHFq2lEY/HI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BWKbG7TL; arc=none smtp.client-ip=209.85.216.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BWKbG7TL" Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-381216921aaso3397249a91.1 for ; Mon, 13 Jul 2026 05:09:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944597; x=1784549397; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=R5VN0Op/PYgxXXGiNzBVb7Bc2A/YDsd2gosba72MniQ=; b=BWKbG7TLfQhde5neCAajbjpbN9iHaGDot8+s5eak4xHWDOQTmc9xPMCOSDd4YWiPe0 TXn7+f6OOX1R/jqy5RVEwHq9+Q+kJhFbnFa/T3+XIPjjzpHD5Er60EY8iisKgS+R+v8f VZwU+p89UfvL/CPm19hS/BF7aJ90uiebr8EtxpcSMnEHWKk15rWTE4E8Sb0Ge79fHCxC /rGxbaNTormuaOgNE93sS3KoBUNe7ZMtNPQtyZzWLyHysq29RXblQGl44mDDe0VOJCjS sZNrkYG5oLRlTwmgmqU/InQPpoRYbA9+ACKuTqr8sjz4KknOGR+9ZteSA+ZLhRjjVI6X 63ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944597; x=1784549397; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=R5VN0Op/PYgxXXGiNzBVb7Bc2A/YDsd2gosba72MniQ=; b=EtGXN0+312sq6za73FCvMn3v89tDYqGBdsczXLyBEcEhdx1/JjWruSpMar4kSAaY1i fmZb6RIqdggjPWDb9pWSlu1wt41chAU1zQ9jbBhXgOOjgPN7dbCdqerKJ1XHAt/6Iu7g zFp18TsHauP9j09xYOT4bjmJBHoT8ycnf1bNZq2Yl0i0wbRcf1CTVi1Paz8CYpU8Q9lU 9uXhrCS2bT9EDtwyEtZorLy1h5bhJu9oYelhACLRZQOB7cMvFQ11CgBzHRF9o78CsvN5 RnINTyiie4/dn8d0ub1yeg740uqvW1ndy0BrsVD6uoZsH+OgD/MdSJky3wUiVCdzw92v l/ZA== X-Forwarded-Encrypted: i=1; AHgh+RqPrPEwwg6ZZ2kj5JADITLUhLoTZUU7+dXbS2vXuYSb/XTZLQACGWZHbx+aHYg/C5HrgrLzn2DiFqewdAQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yxa/1bhBpyHCvKeBZN870jMtAWVq9rAbG6w6LP3fLkOvh+NJlmV vyqpqAHfY7bIVM/giN7Rf4fsJB5dyA3zB4xuxAX6ljHymuuOIGwMP6wB X-Gm-Gg: AfdE7cleikj+6sXxjhP/rW2KF74RtyP6+i4kFqSbk/PPbrMBN7QzwT3HIJZEgH6LwuE 8Dv1JoNwAF+64OUvN6Mm2kOXjHIPKT5ccHZn2251dot8NdQDHX4JdC9Gq4OB6WEWl6D4IuXMWy/ iRVhLI9Uz1Ng3HAFs4sbjYb0qs+I/Bym7XjZLNAMJxhNkWarwxIenozxGWri1dsOgqxJcTfpLuq EmqASzW0bLb/rRePzLGrNB4lJ+kBAczSpY7sP7kfedo9zV56JRFybL6MiaZ+uXEZA5btpbKRCEf DPSOYtyJucRPEXI1gXSxpTM/hjFWHSt82RJb/5l69hNxkQbWs5yPsBCugW87HAKfpgnqHG0GzIR MLMaDr756NVcaSq94rjVomWAFb6J8oeX3NMdjyfEkalM7OIBjRrijDNLdYArNsWR/VQY0xZ1alt JB7cYNEWweKQ== X-Received: by 2002:a17:90b:3c43:b0:37f:9ce3:ca97 with SMTP id 98e67ed59e1d1-38dc777b8a2mr8263084a91.32.1783944596948; Mon, 13 Jul 2026 05:09:56 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.09.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:09:56 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne , Sashiko Subject: [PATCH v7 06/19] media: meson: vdec: Fix race condition by canceling work sync Date: Mon, 13 Jul 2026 17:37:01 +0530 Message-ID: <20260713120840.17427-7-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Synchronize work-queue states cleanly during streaming teardown and close operations to eliminate asynchronous pipeline race conditions. The esparser ISR can schedule work onto 'esparser_queue_work'. While synchronize_irq() ensures the ISR itself finishes executing, it does not prevent any already scheduled work items from running concurrently during driver teardown. This causes a race condition during stream stopping or file closing. Remove the scheduling of esparser queue work during destination buffer completion, as freeing the vififo is handled elsewhere. Add synchronous cancellation of any pending work in vdec_stop_streaming and vdec_close before synchronizing interrupts to prevent use-after-free and race conditions. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 7689ffdb2e500..6fe9722577179 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -484,11 +484,15 @@ static void vdec_stop_streaming(struct vb2_queue *q) } } =20 + mutex_unlock(&core->lock); /* Synchronize and flush pending hardware interrupt service routines */ synchronize_irq(core->vdec_irq); /* Ensure esparser ISR finishes executing */ synchronize_irq(core->esparser_irq); =20 + cancel_work_sync(&sess->esparser_queue_work); + mutex_lock(&core->lock); + vdec_poweroff(sess); vdec_free_canvas(sess); =20 @@ -999,6 +1003,8 @@ static int vdec_close(struct file *file) /* Ensure esparser ISR finishes executing */ synchronize_irq(core->esparser_irq); =20 + cancel_work_sync(&sess->esparser_queue_work); + if (!IS_ERR_OR_NULL(sess->recycle_thread)) { kthread_stop(sess->recycle_thread); sess->recycle_thread =3D NULL; --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA9A040682D for ; Mon, 13 Jul 2026 12:10:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944610; cv=none; b=nZz78toBh6xrmUPmgdukc77n+IUWYbRX284maB+6AvE9bFFB/pr8d8J7N4GQCa7JBS6FujhbN9qIUCC3iqyh39Bm5CDpfiqT9525X++GLuPqC3rUxvjcQ+0ov/1FbCVPBRj+SS8wzg1SEzpSw4MAiIv4NmJUfh0SdFwLCzsUNI0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944610; c=relaxed/simple; bh=jmgoQL+MH+cHI2abCHhSjB4sQPbvNKTxgke0bczlm7Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=foESogK7WatHY7v6t8ESkpwPkczAVJbhM4tuHytRXLoiLMVGExXaXLzORiLR29pyKZ6Mk5pP3V5wQny06nh6jcHJS9rKem29/1Nb+y3IZ1iIaOOW6aDw0bdt66/wxmDXxXAPatJQ7DvDP6Ed8ClS7ETJ17Dnd3OLnhb7ZNBeDIs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Nq2R3WEk; arc=none smtp.client-ip=209.85.214.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Nq2R3WEk" Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2ceae1ed204so15014655ad.0 for ; Mon, 13 Jul 2026 05:10:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944608; x=1784549408; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=cz2FSgCZR0hsmFPhKS7OSCHd3SyOY5Jhxrt1826LFDI=; b=Nq2R3WEkPiz8hNUV5yOa5w+XAeChi13GOGHCW94/1P9IuCfm940PzbejHMn9pQzC+T Z6LY5UKdtKMvzVkmV54x4wSMFg6A3X7uH6r+0eZ9jcsakp58gKSjYdUu50CGRNq0WioN peGp7X2cfdHl/qXDKFJO3KwqvxjQUrx/MTShuEzBTC5qKYDMSITVn4lLw0AeMnZ6JkB0 1BMq/HFFQjDPjbWQXBt2uLV7r6fj3Pbwd4YqmoIa1Z/vbaJiY9AQuTqp0mkL5Ocv1ZiZ QWrwrtVMeejJMEviBxPf8iE8F57E2yKPnvXD3hLT9g7b5bg7moUBFBMpKW+MC5cWfOms nKcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944608; x=1784549408; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=cz2FSgCZR0hsmFPhKS7OSCHd3SyOY5Jhxrt1826LFDI=; b=rpLvOU9Z16JQx0qG3A/mh/KU5sp4BjP8tuJzrMvJQfEd4QVdxFfWKUeQMD79lvZc4a 8xLQXDTri469byinBHq/4AjAvVJt4vYLP1rYl8IQ0P0zjonl6gH7j97bj/+rur8Y5ZWg LnDMTOoNGgWPwVtVMZ7FX9ZNtEeI1vS3dMfJK6Naoe9612iftf2ePHSyCOE/4wVwh3dv GDZAJfBqQiDGNTssH7PQr1sdGp2NnAoNbwPMq3pVVT5+xjvn1jNEVEgEKTZfkl+gTvyK qpy3pzO6CN8Ys0AIFjtRyJixq3xYeRZkhqSEAyhr2VpvRu3XU5sMOeSkBu082j4UK6yI ny/Q== X-Forwarded-Encrypted: i=1; AHgh+RqL9HsKlTc5wR4HCa0WN3P1obtjvLlFWzK9dCyDjgPuUvRnsxYqtjZTmKTo3mjVUUyZdZQ9fyL1R/2hvUw=@vger.kernel.org X-Gm-Message-State: AOJu0YytQc2VS+aLRAV1bKTN66GEI4CQb4ch+AqVfXoRL7dDlaaoKhHE 6+nk9WnqHbYmn32sBy2RPEe+wOJJvPDrfoVBqDFg63RVgV5+3pM8xitt X-Gm-Gg: AfdE7cmwJEYKcFxbz0r4zQQCBQ3DkXSKM8btiLgNMeNGz6gLcpMsT67tw9bEHGHTIcS qMKvTQQokXGor0/iCDQK7yAtWPgQVfdoe0AZoSz2it5NIVQSQfcoNejRYJm52eMvfn44ptIejNo EhmRsT1lisZLX6MYeVVVdWUWH4ik8fHSzjhI1+CxGpxKeEmCIZd9j2RbdgUd6GDgBbC6mvNTdD7 Aog8Eq8CCSpRyIZ1vKbi+WLgtUsckKH3okKHB0Ow7uL1n8l4rIsADPJPVvRFg7+8y96BdDRNzHv mb1JiKB2Tp4Mkvln+47PvM1nmKyz+sm673qXS0p2/PRSTBCwIkEW2qSooAZqRKstYzVF75PRu3l u2/LYOq5MTouiyRyBKCwRAkr1ofLAR0Zj6WJ/WVMswkx6TaDO9vaNG72IGoZuv59CbdRhuvpFGF zINOAtw8pePw== X-Received: by 2002:a05:6a21:140a:b0:3c0:9c19:b27d with SMTP id adf61e73a8af0-3c110cfefa5mr9580843637.75.1783944607855; Mon, 13 Jul 2026 05:10:07 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:07 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 07/19] media: meson: vdec: Refactor esparser work queue and fix teardown race Date: Mon, 13 Jul 2026 17:37:02 +0530 Message-ID: <20260713120840.17427-8-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Rework the esparser work queue logic to prevent concurrent queue mutations and fix a race condition during streaming teardown. The previous implementation relied on v4l2_m2m_for_each_src_buf_safe(), which held the session mutex across the entire queue traversal. This blocked concurrent operations, caused inaccurate buffer mapping, and triggered 100+ second watchdog freezes due to an unyielding polling loop. Additionally, the low-level parser handled buffer ownership adjustments and completion callbacks directly, leading to inconsistent error paths and races between streamon and streamoff. Fix this by utilizing the modern scoped_guard(mutex) mechanism inside the main worker loop. This allows the session lock to be automatically dropped on any conditional breakout path, preventing voluntary scheduling bugs while invoking cond_resched(). De-couple buffer lifecycles from the hardware parser routine by leveraging safe, linear fetches via v4l2_m2m_next_src_buf() and v4l2_m2m_src_buf_remove(), ensuring orderly frame transactions. Refactor esparser_queue() to return explicit error codes (such as -EBADMSG, -EIO, and -EAGAIN) to safely handle buffer states. Clean up teardown paths: Execute cancel_work_sync() inside vdec_stop_streaming() and vdec_close() immediately after synchronize_irq(). This ensures any pending scheduled queue work is fully flushed and canceled before the driver destroys hardware instances. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 69 +++++++++++++++------ 1 file changed, 49 insertions(+), 20 deletions(-) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/= media/meson/vdec/esparser.c index 37749ede308c6..e5d3d817b9b2b 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -328,15 +328,11 @@ esparser_queue(struct amvdec_session *sess, struct vb= 2_v4l2_buffer *vbuf) return -EAGAIN; } =20 - v4l2_m2m_src_buf_remove_by_buf(sess->m2m_ctx, vbuf); - offset =3D esparser_get_offset(sess); =20 ret =3D amvdec_add_ts(sess, vb->timestamp, vbuf->timecode, offset, vbuf->= flags); - if (ret) { - v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR); + if (ret) return ret; - } =20 dev_dbg(core->dev, "esparser: ts =3D %llu pld_size =3D %u offset =3D %08X= flags =3D %08X\n", vb->timestamp, payload_size, offset, vbuf->flags); @@ -348,12 +344,10 @@ esparser_queue(struct amvdec_session *sess, struct vb= 2_v4l2_buffer *vbuf) if (sess->fmt_out->pixfmt =3D=3D V4L2_PIX_FMT_VP9) { payload_size =3D vp9_update_header(core, vb); =20 - /* If unable to alter buffer to add headers */ if (payload_size =3D=3D 0) { + dev_err(core->dev, "esparser: VP9 header update failed\n"); amvdec_remove_ts(sess, vb->timestamp); - v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR); - - return 0; + return -EBADMSG; } } =20 @@ -363,33 +357,68 @@ esparser_queue(struct amvdec_session *sess, struct vb= 2_v4l2_buffer *vbuf) if (ret <=3D 0) { dev_warn(core->dev, "esparser: input parsing error\n"); amvdec_remove_ts(sess, vb->timestamp); - v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR); amvdec_write_parser(core, PARSER_FETCH_CMD, 0); - - return 0; + return -EIO; } =20 atomic_inc(&sess->esparser_queued_bufs); - v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_DONE); =20 return 0; } =20 void esparser_queue_all_src(struct work_struct *work) { - struct v4l2_m2m_buffer *buf, *n; struct amvdec_session *sess =3D container_of(work, struct amvdec_session, esparser_queue_work); + struct device *dev =3D sess->core->dev_dec; + int ret; =20 - mutex_lock(&sess->lock); - v4l2_m2m_for_each_src_buf_safe(sess->m2m_ctx, buf, n) { - if (sess->should_stop) - break; + while (1) { + struct vb2_v4l2_buffer *vbuf =3D NULL; + bool processed_frame =3D false; + + scoped_guard(mutex, &sess->lock) { + /* Safe atomic tracking check: exit loop if session is shutting down */ + if (sess->should_stop) + return; + + /* Queue completely empty: exit work loop cleanly */ + vbuf =3D v4l2_m2m_next_src_buf(sess->m2m_ctx); + if (!vbuf) + break; + + /* Stop processing if we hit the end-of-stream drain buffer */ + if (vbuf->flags & V4L2_BUF_FLAG_LAST) + break; + + /* Check hardware FIFO limits safely inside the locks */ + ret =3D esparser_queue(sess, vbuf); + if (ret =3D=3D -EAGAIN) + break; + + /* Pop the buffer from the source queue since it is now processed */ + vbuf =3D v4l2_m2m_src_buf_remove(sess->m2m_ctx); + if (!vbuf) { + dev_dbg(dev, "Buffer missing during queue removal\n"); + break; + } + + /* Complete the buffer transaction based on parser results */ + if (ret < 0) + v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR); + else + v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_DONE); =20 - if (esparser_queue(sess, &buf->vb) < 0) + /* Set tracking flag indicating transaction completion */ + processed_frame =3D true; + } + + if (processed_frame) break; + + /* Give other threads and IRQ routines a window to execute while unlocke= d */ + cond_resched(); } - mutex_unlock(&sess->lock); } =20 int esparser_power_up(struct amvdec_session *sess) --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 72B663F4DC7 for ; Mon, 13 Jul 2026 12:10:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944620; cv=none; b=gRgpwKXl2prUMhOrTdLqXGzYTx4rGl/Epsw0mVjcDrTVjSUqysNKyZZdcmMkN1MUd7bg8fRNrSSGtQn7XHO5va186T/85nXIuLYggXPlOUpLUJaNK0DcFMRCPDf/jvnvmYehi1VW5HjPinxjsoI5q4ruZo12VPGBNP+kISdKMmM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944620; c=relaxed/simple; bh=bhI4E6oc6F1Tv+IuuQmSjw+SHYMiXdNdT/xsno/HW2o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rV3ozCYCaol2TMVAE/2wPkLc/JT1dm8Yf2aYxeJWoD7Ma0N/QfEfV8mTjjUeEnn7ljzj+7ewxf/4/OtyYbhEc7fwB6v9Z3nnScXrzH21iX0aQ936M6zpW9JX80AOwYwUg3d7e/rJ1ujDKMhOFQndOVu0oKA58C4rtC0NAvSNtf8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=US4ZGXHz; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="US4ZGXHz" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-38dc69c74b8so1490313a91.0 for ; Mon, 13 Jul 2026 05:10:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944619; x=1784549419; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=M52KCQrGH2efvkkWtyT/9Kw89ZxEs+AuVcYa54xJZ9k=; b=US4ZGXHzWEKuVcfIlfgLCY+KKGahmAu1MF4e7LChw2ZiQQhtEviiF89+52QlNlSwkL YbhEV4eyrqVICWl7A7elwjJqmb9WqGRJNWFQGh+N3VfXrQWZPHb04dTrL9oKKFluse7F QM1CShn0fHAiqriaxpRX7oGDVTr5k/HZSsYJCGfElx7tKLMeWVN2alNNGVBD++FLQCNC CfCCrXAIjMYJbwfi2JQW+CY5LselYJMShV+9qGrWzN8NXpdSlrPyBC1VgFCOZDiAjVqc WQr40WYNT0zdUxaAnSNbUPFItgiyr8D/EWItM8JWEoj/OM68LIQpjR3c2jhs6DpPIY6C rwUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944619; x=1784549419; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=M52KCQrGH2efvkkWtyT/9Kw89ZxEs+AuVcYa54xJZ9k=; b=L0fEvVWoUIVPwunElEq6JMbsB9O0IWn6COP6CTEf9kALi8fumMVTa8g34eQ/n7W+HC ghak364CRM9ZEbfl0bJW6ctYWsxqwtDyvNAm1AKTrIqWuwIpvIZYqVMx8DtWkw01AZN9 OVYsqr3JA/w+HL/JZ46C3rJH8iW2FpcKUOSsvthzkhB55zjDGEIDt0Z3NvbIRCD0F8P8 13IjjscRfT3i+iectNKkYSHH3AOwRK3OV9XeaNTY14/GOmPElx1yPNJ/G2JTh6QUUXEJ 2bX0FbMLQ9iuQDlb5tfCfpwHA+xUDsNfPnKREQX63HXdRbbs+7qUTWgnquwCS+KGKVqP dPDw== X-Forwarded-Encrypted: i=1; AHgh+Rp9zsYERc0WXRe62NamhvhCn4Oe1ImnF3emWNzS9GRV1kyhr0RG6UAVfo1fXuof/ndvPpFXpYg7j5K+pw8=@vger.kernel.org X-Gm-Message-State: AOJu0YxHyQwJkWoUOaePvpeuxE5pVRQXel5TKCBSyE76w7ZWmTSN8Q6e 1ccwK0/QG8rnodI9ss7hu1ENkejkBIQ4Y5inu7guyJs+QMKozhb/9Quo X-Gm-Gg: AfdE7cmbQa+0qxZ33NIcc3eVXOledMH6jr4drAQFUgXhy1cAypHGlvjU9LrzR+fhBy5 ZPtQ8RDoykfYy3KHRNSLPs7apYZfaRT85Dm+6ZqEPfo31NGeGBIfqxVtJU5CCzeGHv5bh9ty+Hl Js0G4+0rs8d9p4A3dALfj5LhpGtUVYIbJ/klRSRtJDIz5ogu6qvIYvaBdsJ4RZ2zh5Lz5jkTU79 LfStRnQb1GceXmgukExofdnlNWxFMqugimZ+cvVqSdNolYcZSUb5hNX3lEwCkTnhHfowm6NMdFB YvCJxVvEeqUgsYS8lqx0x211rqAQ6pu7G6ULy1k3GWPTDRwDOcPCti2cHtEH4zNyFoHYqkq9e63 jfwBE6vZn+DETsGap7hmf1H2I0ecNgmle+EpDDANgutKLWeEOAQ6xwPHA0b9s5QRP/viN4YahZ/ RTCPwsaamMjA== X-Received: by 2002:a17:90b:58cc:b0:380:540:d499 with SMTP id 98e67ed59e1d1-38dc78224a5mr7942822a91.6.1783944618568; Mon, 13 Jul 2026 05:10:18 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:17 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 08/19] media: meson: vdec: Fix concurrent execution races and unsafe teardown Date: Mon, 13 Jul 2026 17:37:03 +0530 Message-ID: <20260713120840.17427-9-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Address data races involving 'should_stop' and prevent multi-session hardware clobbering by enforcing atomic tracking and strict owner validation during device teardown. The esparser work queue reads 'sess->should_stop' outside of critical regions without serialization primitives, risking data races or visibility delays. Furthermore, vdec_close() and vdec_stop_streaming() blindly shut down hardware components (via poweroff and canvas frees) and nullify 'core->cur_sess' without confirming that the executing session actually owns the active hardware context. In multi-session scenarios, this allows a closing inactive session to inadvertently break a running session. To fix these synchronization and lifecycle issues with the following changes use thread-safe flagging: Wrap reads and writes of 'sess->should_stop' in READ_ONCE() and WRITE_ONCE() to prevent compiler optimizations from caching the condition variables across scheduling boundaries and optimizations across workqueue execution threads. Also safe context releasing: transition 'core->cur_sess' pointer clearings to use smp_store_release(). This ensures all prior internal memory structures are entirely flushed and visible to other execution cores. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 2 +- drivers/staging/media/meson/vdec/vdec.c | 88 ++++++++++++++------- 2 files changed, 59 insertions(+), 31 deletions(-) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/= media/meson/vdec/esparser.c index e5d3d817b9b2b..959673742e699 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -379,7 +379,7 @@ void esparser_queue_all_src(struct work_struct *work) =20 scoped_guard(mutex, &sess->lock) { /* Safe atomic tracking check: exit loop if session is shutting down */ - if (sess->should_stop) + if (READ_ONCE(sess->should_stop)) return; =20 /* Queue completely empty: exit work loop cleanly */ diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 6fe9722577179..83a9b1238972a 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -287,9 +287,13 @@ static int vdec_start_streaming(struct vb2_queue *q, u= nsigned int count) struct amvdec_session *sess =3D vb2_get_drv_priv(q); struct amvdec_codec_ops *codec_ops =3D sess->fmt_out->codec_ops; struct amvdec_core *core =3D sess->core; + struct device *dev =3D core->dev_dec; struct vb2_v4l2_buffer *buf; int ret; =20 + /* Reset workqueue loop shutdown signal to allow streaming */ + WRITE_ONCE(sess->should_stop, 0); + if (q->type =3D=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) sess->streamon_out =3D 1; else @@ -336,7 +340,7 @@ static int vdec_start_streaming(struct vb2_queue *q, un= signed int count) dma_alloc_coherent(sess->core->dev, sess->vififo_size, &sess->vififo_paddr, GFP_KERNEL); if (!sess->vififo_vaddr) { - dev_err(sess->core->dev, "Failed to request VIFIFO buffer\n"); + dev_err(dev, "Failed to request VIFIFO buffer\n"); ret =3D -ENOMEM; goto err_cleanup_session; } @@ -388,10 +392,12 @@ static int vdec_start_streaming(struct vb2_queue *q, = unsigned int count) sess->streamon_cap =3D 0; =20 mutex_lock(&core->lock); - if (core->cur_sess =3D=3D sess) - core->cur_sess =3D NULL; - if (sess->status !=3D STATUS_NEEDS_RESUME) - sess->status =3D STATUS_STOPPED; + if (core->cur_sess =3D=3D sess) { + /* Safely clear hardware ownership since we were confirmed as the owner = */ + smp_store_release(&core->cur_sess, NULL); + if (sess->status !=3D STATUS_NEEDS_RESUME) + sess->status =3D STATUS_STOPPED; + } mutex_unlock(&core->lock); err_unlock_no_hw: while ((buf =3D v4l2_m2m_src_buf_remove(sess->m2m_ctx))) @@ -441,6 +447,9 @@ static void vdec_stop_streaming(struct vb2_queue *q) enum amvdec_status old_status; bool full_cleanup =3D false; =20 + /* Signal workqueue loop to abort instantly */ + WRITE_ONCE(sess->should_stop, 1); + /* flush buffers to kill background workqueue thread */ if (q->type =3D=3D V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) { while ((buf =3D v4l2_m2m_src_buf_remove(sess->m2m_ctx))) @@ -493,26 +502,33 @@ static void vdec_stop_streaming(struct vb2_queue *q) cancel_work_sync(&sess->esparser_queue_work); mutex_lock(&core->lock); =20 - vdec_poweroff(sess); - vdec_free_canvas(sess); + if (core->cur_sess =3D=3D sess) { + vdec_poweroff(sess); + vdec_free_canvas(sess); + + if (sess->vififo_vaddr) { + dma_free_coherent(sess->core->dev, + sess->vififo_size, + sess->vififo_vaddr, + sess->vififo_paddr); + sess->vififo_vaddr =3D NULL; + sess->vififo_paddr =3D 0; + } =20 - if (sess->vififo_vaddr) { - dma_free_coherent(sess->core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); - sess->vififo_vaddr =3D NULL; - sess->vififo_paddr =3D 0; - } + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); =20 - vdec_reset_timestamps(sess); - vdec_reset_bufs_recycle(sess); - core->cur_sess =3D NULL; + kfree(sess->priv); + sess->priv =3D NULL; =20 - kfree(sess->priv); - sess->priv =3D NULL; + /* Safely clear hardware ownership since we were confirmed as the owner= */ + smp_store_release(&core->cur_sess, NULL); + } } else { if (sess->status =3D=3D STATUS_NEEDS_RESUME) sess->changed_format =3D 0; } + mutex_unlock(&core->lock); } =20 @@ -802,7 +818,7 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4= l2_decoder_cmd *cmd) =20 if (cmd->cmd =3D=3D V4L2_DEC_CMD_START) { v4l2_m2m_clear_state(sess->m2m_ctx); - sess->should_stop =3D 0; + WRITE_ONCE(sess->should_stop, 0); return 0; } =20 @@ -812,7 +828,7 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4= l2_decoder_cmd *cmd) =20 dev_dbg(dev, "Received V4L2_DEC_CMD_STOP\n"); =20 - sess->should_stop =3D 1; + WRITE_ONCE(sess->should_stop, 1); =20 v4l2_m2m_mark_stopped(sess->m2m_ctx); =20 @@ -998,6 +1014,9 @@ static int vdec_close(struct file *file) struct amvdec_session *sess =3D file_to_amvdec_session(file); struct amvdec_core *core =3D sess->core; =20 + /* Signal workqueue loop to abort instantly */ + WRITE_ONCE(sess->should_stop, 1); + /* Synchronize and flush pending hardware interrupt service routines */ synchronize_irq(core->vdec_irq); /* Ensure esparser ISR finishes executing */ @@ -1012,21 +1031,30 @@ static int vdec_close(struct file *file) =20 mutex_lock(&core->lock); =20 - vdec_poweroff(sess); - vdec_free_canvas(sess); - core->cur_sess =3D NULL; + if (core->cur_sess =3D=3D sess) { + vdec_poweroff(sess); + vdec_free_canvas(sess); =20 - if (sess->vififo_vaddr) { - dma_free_coherent(core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); - sess->vififo_vaddr =3D NULL; - sess->vififo_paddr =3D 0; + if (sess->vififo_vaddr) { + dma_free_coherent(core->dev, + sess->vififo_size, + sess->vififo_vaddr, + sess->vififo_paddr); + sess->vififo_vaddr =3D NULL; + sess->vififo_paddr =3D 0; + } + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); } - vdec_reset_timestamps(sess); - vdec_reset_bufs_recycle(sess); + kfree(sess->priv); sess->priv =3D NULL; =20 + /* Unconditionally set our local status to stopped */ + sess->status =3D STATUS_STOPPED; + /* Safely clear hardware ownership since we were confirmed as the owner */ + smp_store_release(&core->cur_sess, NULL); + mutex_unlock(&core->lock); =20 v4l2_m2m_ctx_release(sess->m2m_ctx); --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3838405C38 for ; Mon, 13 Jul 2026 12:10:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944631; cv=none; b=uU8e5HbmO2n093H+EoIGHl0/q8TGlqAJHcmJca4yXmnHqlSj5k/Mvh2+nuTGrT6TQ9hck1BNZceY8wfxTVWZQlInhCgKUBdvFh9Uu4Q5Zr00LSba6lzLbwT3DcuMaE1D6AOxfuOM5VydXMVDMDAynSnOqx9K4jLBAphR1Mv3pk8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944631; c=relaxed/simple; bh=0h03bQuoUWZdGVlD74sLbbLEbbwu1nwFtUhUFitPw/I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=J9EO7q1oDabpYIKZ3/YvpZV1xwSyM47vwE7EOJdQtzbrv0lmxbizIZWzkonLmGNURZvzMwDjvFLVVQ/ujql5ig1H7Tcl8Cfn/+ETCkhRwiWoJgwUds+grJFlPQtjYvuMnuFvSduJm5xz6KjKnfGya4PSaMqMjMvy4tX7AE7KoIY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RJ1LasK/; arc=none smtp.client-ip=209.85.210.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RJ1LasK/" Received: by mail-pf1-f179.google.com with SMTP id d2e1a72fcca58-848761b5897so1318673b3a.3 for ; Mon, 13 Jul 2026 05:10:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944629; x=1784549429; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0g+WRe3x8NF1Lsmp6BpHJTM0uwdyJj9zKy0hm9x5WoY=; b=RJ1LasK/DTuF1p/UF3urIJndOGbDEVv5ZPn4dlKLyvw71FHMTl4uB/L+U5DCN+dq1I TKja2d0O/hLpfBLD+3IgmLUDERmyHqADQe2G0kXpOlmAqyXm5VpZDznqNlO1jDDqFJ9a K58VtCmJ8LFQZMa1RBlPOhkAxcPnU8Fy8vv2qBXstO59JVWgH+3yBNqW8/vCnPAzYSIM 4UeJKowln+jZlJTGbONVSVXJ7nR8Mpw/CRGiqAIeNJNiorQZxCiEVeb6I7T+Lq6v5/vL hnTfRqTYgQSnU7du/uPMeH0pbm7NanZY0F7Ioa2LLeZzwpceYWPb/3Qlbm3OUPcNH948 XgHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944629; x=1784549429; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0g+WRe3x8NF1Lsmp6BpHJTM0uwdyJj9zKy0hm9x5WoY=; b=tOx0OFGAxpn7e2bxLaBAgN7DfKiuyvg0EKtoMUbWFFCQAw5/VvGL6dQstgLpgM1d+L quRW1kwP3BH7A3/yVaQX55E/bn2rzinnCUb9kl0l117BI2NRP+/5LJ20whIUoCS+heNX fsn17wkhoclVVaxZTSug8vMVYqbiw5dg32c/M8BiUVI0rERrahf3fF4QMJuRpp3fEAZ0 spuwWyAkSGaujU94ctpXhhhNop2VywHLdV+CobD1FSPR/Bc/Zqr1IqNDhj8Wkr/EoZqF UhBVaWCEl7cYqV3tKq0MXRoVhsocYj9lFJS3ey9xmgkloMonEShiEZboX0giz/ct0VUV jOCQ== X-Forwarded-Encrypted: i=1; AHgh+Rrhf2+ql+f+Uzib6xLAyjcEiiL2zbjPGxWeqnjErTaWVN+K/1/yoW96Vqgk6+1f2kOUyfu8+cxt5g/l4vE=@vger.kernel.org X-Gm-Message-State: AOJu0YzD0/0NiSKRolA0OSyO/l6MgATGn8A0EE8Un8Zh9Lu1LpoTkjeO eKaQUd8OR7BvB4C9JmnNOyYdnIYQGnptxooAuNMIBPw8e7gLI6k6UURH X-Gm-Gg: AfdE7cnS0bHoQu1csB5/y8DKuclRUilMBczuOxuI9nCTc35qUcjVvAopG0gGEvqyAZb IAJWPoJVZt3RLt3BgUusNpwUv2KkW/Uf9ygG1WKgzvPo5rizDqe4pk115I7j5NwoAlKwE4B1SjV zRIFUotjPEfse5M6RDuKBvam7MWSnHItbI6rcSmB5UltsDlm3tCOuZNn+xURvBHi/F0rjfQo6GN 5BsK0edu3K9uUEoxgkMUbD2xL6h4Gc066giQL/kakYfTx9iwNCrzDTSSPBBjVYY5QadHfeW0nH8 4xDNBwqitgfcSRzrmVt/a2KIqIcaOB7Ow9WUWxQUjtxIk2wNtyJ2E1WYYu3FTShO5jPiEkJYS05 Y+gnQOLw/T/5uL0CjQb9Bg1acNFKLnLjniTLyFKeMsCZ3UXLEx+PS7hFx2amMeC5MlwKvCMciBb juWgIQphRafhc4JIHDRLqw X-Received: by 2002:a05:6a21:6088:b0:3bf:9fc0:f6c2 with SMTP id adf61e73a8af0-3c1109ec872mr8713076637.11.1783944629120; Mon, 13 Jul 2026 05:10:29 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:28 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 09/19] media: meson: vdec: Fix vp9 header update failure on invalid payloads Date: Mon, 13 Jul 2026 17:37:04 +0530 Message-ID: <20260713120840.17427-10-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Ensure vp9_update_header() returns an explicit error code on invalid or malformed buffer payloads instead of silently returning zero. When v4l2-compliance injects short, empty, or uninitialized test buffers, the validation logic catches the out-of-bounds size anomalies, but returning 0 tricks the calling esparser infrastructure into treating it as a successful 0-byte header conversion. This causes the hardware decoder engine to stall out, resulting in subsequent stream-on timeouts and failure marks inside v4l2-test-buffers.cpp. Fix this by returning -EINVAL across all validation and bounds check failures to force immediate core framework buffer drops. Additionally, tighten array pointer checks, secure the mag_ptr bounds loop, and convert the superframe parsing indexer into an explicit if/else block for readability. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/= media/meson/vdec/esparser.c index 959673742e699..edbfc829e2da8 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -97,11 +97,15 @@ static int vp9_update_header(struct amvdec_core *core, = struct vb2_buffer *buf) unsigned char *old_header =3D NULL; =20 dp =3D (uint8_t *)vb2_plane_vaddr(buf, 0); + if (!dp) + return -EINVAL; + dsize =3D vb2_get_plane_payload(buf, 0); =20 - if (dsize =3D=3D vb2_plane_size(buf, 0)) { - dev_warn(core->dev, "%s: unable to update header\n", __func__); - return 0; + if (dsize <=3D 0 || dsize > vb2_plane_size(buf, 0)) { + dev_warn(core->dev, "%s: invalid payload size %d\n", + __func__, dsize); + return -EINVAL; } =20 marker =3D dp[dsize - 1]; @@ -109,13 +113,16 @@ static int vp9_update_header(struct amvdec_core *core= , struct vb2_buffer *buf) num_frames =3D (marker & 0x7) + 1; mag =3D ((marker >> 3) & 0x3) + 1; mag_ptr =3D dsize - mag * num_frames - 2; - if (dp[mag_ptr] !=3D marker) - return 0; + if (mag_ptr < 0 || dp[mag_ptr] !=3D marker) + return -EINVAL; =20 mag_ptr++; for (cur_frame =3D 0; cur_frame < num_frames; cur_frame++) { frame_size[cur_frame] =3D 0; for (cur_mag =3D 0; cur_mag < mag; cur_mag++) { + if (mag_ptr >=3D dsize) + return -EINVAL; + frame_size[cur_frame] |=3D (dp[mag_ptr] << (cur_mag * 8)); mag_ptr++; @@ -140,7 +147,7 @@ static int vp9_update_header(struct amvdec_core *core, = struct vb2_buffer *buf) =20 if (new_frame_size >=3D vb2_plane_size(buf, 0)) { dev_warn(core->dev, "%s: unable to update header\n", __func__); - return 0; + return -ENOMEM; } =20 for (cur_frame =3D num_frames - 1; cur_frame >=3D 0; cur_frame--) { --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5FB1E3FC5AB for ; Mon, 13 Jul 2026 12:10:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944641; cv=none; b=NigkBvSMgEUcbUSZGuoZOdye4Td4EDdkYorTNnbxAKqKaNxpV1Y6TVxsyz/JxochXei52TitBwbJTEra2Ma5SYpgp99jZnq4cEua0Kxdy7B94N1EnEoOCscg5r1jlaDJlROZma/cwhATAxJT+ZKusoSNLuasWyGUhrWHZrUjWv8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944641; c=relaxed/simple; bh=vz3zl/3kAgDjGicZo1CQ74cjgKIrvemajTZVBVpOX4U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ycp1I5KM2/nnX3Ut6lUPlkIx/nTZJsjCBTK2AaNM2HSLIgFczPI+K0Ln6vc352Un6n/k+qD/kznkG5ebVZuljVjo3Nx9y3Kdq/o2LuCEUbmFMSU2uirv/qkAFois274kyHU2BBdH6yeK8YsJQMuZX5F+VAwuz7wtDJUtjMzIQlk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=W+ouIDbG; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="W+ouIDbG" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-38e08baf860so459113a91.2 for ; Mon, 13 Jul 2026 05:10:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944640; x=1784549440; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6GCAuneNa/1gKb9DW8CBD7WKj6dTVzcbk/e+PXY8YBw=; b=W+ouIDbG7OiYONbX9KveS9FAM0HVQhzJrOd8eKEBZ/TuZbOu937FEKKHswFpPbmgFu +CQaFgSiEFWQMJoqAYotqB4XMykUyQsYOpUED6oIWtCwTXRd2G+n1Qv7tZzEhfePAseV qOorlMS5O/5ETrsSJbK86HFenW0mKQuy/YP4VKcppK8k7o0LHQAANO7031e78kWzuX/z rmZS7NFTwgtu9StAaPETNwqrmFoncXMFHOKY5iKgrYju4KeuRnZYF7COqK1ixMDlHETw jwQVols77B0KUT6jmiETspfqBRhibZ8D4G2zQasGqYzBF84bTiysbLwE/rQRe9IU3fHH jEcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944640; x=1784549440; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=6GCAuneNa/1gKb9DW8CBD7WKj6dTVzcbk/e+PXY8YBw=; b=b//4hF8yLDStue79l8oYwGFvkbvn3WkfL4H/JSDaJi8urstC+CvAMbmwKK1pmjT/SQ QIw+dymTHkByz0QV2e4YfUFXj4Px2CWDKx0L8gpuFxEncttcUFS8VxM0cPB78WRcNiaY yEwyr7m0fZLffbIhrPbSJZoY7qNoQJnJjs9vzOOp7qO7ll0WW8qQ8SSm8JWXnOYpLS7S AhHed+oe/dk1IOE+6QXgJhLq19l+6nLSdFGxkIw4fXCYTNlgxF6ZY350NdKMNIG8nvD1 BE+mCwi2Rq1x8Gxk+Sa4SRdNq+7SQLvRgYqtlKeTRVhn5RBk7Jp5jpj0aju/SqgpFwO2 UHhQ== X-Forwarded-Encrypted: i=1; AHgh+Rr799yJyhre08DdvNcLfNuXpkyzamvHYGtygCk4KM+dUC3hIAEwdYexRUINU/bU57BUwXnEPhiOfWaDsSo=@vger.kernel.org X-Gm-Message-State: AOJu0YyXYKPn3M8XUiakeKsbpv67Mn2NfbJZXMoaT9Xt4sW+I7Ym2wlf t1VTSEhYZ0XuKdGokqwTwfhls+gb/QqiwVuzNZBVfqf9YbrPvUtUoOSI X-Gm-Gg: AfdE7cm95UYWJhlC6oSMH/KW3X2dTeaV2OIQZmW3/Q7W8+/2BNvwDppGgh9Zd164tHm xAKWgQAxJ4VcipdQmX08LOD3PF77O3Tkl/KGMPoYL2dK89pB8NziAOqfr1jNN/OR2pBjfbSqN6y GqYdkQ1G9+dPCoRnxYBq7+vNieCn1qUa1zxmJVoysjXp6MdNbptakaUOgOr3lb6WUaWZPCkgfsA KEJ/OBi1lbgIHvf4phDCdF8gxnboxQiXombZOU1y/mXjuYDkARknCJnkvW49o/B61WUgvIGe4nk KZpJ3IMYWV8RFWWLTywA9iPKg447xCdUYY2fd8oQSBHhDJJvQTDjwwQisrn2QhJJp/VoJGlJGkD 3Li64WPUkYZNjrKEGXjHy+CaN6DLhGoiJs5+y3MeVl9m3P6Lc1QqfgZ83Jd/redyQtT/Ydea5f+ g4QosxhomOTQ== X-Received: by 2002:a17:90b:4fd2:b0:38d:a76:6470 with SMTP id 98e67ed59e1d1-38dc77c61d6mr7650924a91.39.1783944639617; Mon, 13 Jul 2026 05:10:39 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:38 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 10/19] media: meson: vdec: Fix race conditions and leaks in esparser pipeline Date: Mon, 13 Jul 2026 17:37:05 +0530 Message-ID: <20260713120840.17427-11-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix a circular locking dependency (lockdep warning) and a potential KASAN wild-memory-access race condition within the asynchronous esparser queue by restructuring register write and context evaluation blocks. Previously, evaluating hardware ownership checks outside of core->lock introduced a time-of-check to time-of-use vulnerability, risking register corruption during parallel stream initialization cycles. Additionally, abruptly exiting the payload queue loop without sanitizing timestamp trackers left metadata dynamically stranded in memory, triggering regular kmemleak warnings. Fix these flaws by moving the hardware session ownership validation and atomic stop signal checks directly inside the core->lock mutex region in esparser_queue(). Ensure that presentation timestamp pointers are cleanly removed via amvdec_remove_ts() on all early-exit routes. Finally, refine the VP9 payload evaluation logic to correctly catch negative error passes from vp9_update_header() and pass the session context explicitly to the padding helper to secure memory operations. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 29 ++++++++++++++++++--- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/= media/meson/vdec/esparser.c index edbfc829e2da8..b9f36fef4be12 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -199,12 +199,16 @@ static int vp9_update_header(struct amvdec_core *core= , struct vb2_buffer *buf) * the ESPARSER interrupt. */ static u32 esparser_pad_start_code(struct amvdec_core *core, + struct amvdec_session *sess, struct vb2_buffer *vb, u32 payload_size) { u32 pad_size =3D 0; u8 *vaddr =3D vb2_plane_vaddr(vb, 0); =20 + if (!sess || READ_ONCE(sess->should_stop) || !sess->priv || !vaddr) + return 0; + if (payload_size < ESPARSER_MIN_PACKET_SIZE) { pad_size =3D ESPARSER_MIN_PACKET_SIZE - payload_size; memset(vaddr + payload_size, 0, pad_size); @@ -313,6 +317,9 @@ esparser_queue(struct amvdec_session *sess, struct vb2_= v4l2_buffer *vbuf) u32 offset; u32 pad_size; =20 + if (READ_ONCE(sess->should_stop) || !sess->priv) + return -ESHUTDOWN; + /* * When max ref frame is held by VP9, this should be -=3D 3 to prevent a * shortage of CAPTURE buffers on the decoder side. @@ -349,24 +356,38 @@ esparser_queue(struct amvdec_session *sess, struct vb= 2_v4l2_buffer *vbuf) vbuf->sequence =3D sess->sequence_out++; =20 if (sess->fmt_out->pixfmt =3D=3D V4L2_PIX_FMT_VP9) { - payload_size =3D vp9_update_header(core, vb); + int res =3D vp9_update_header(core, vb); =20 - if (payload_size =3D=3D 0) { - dev_err(core->dev, "esparser: VP9 header update failed\n"); + if (res <=3D 0) { + dev_err(core->dev, + "esparser: VP9 header update failed (%d)\n", + res); amvdec_remove_ts(sess, vb->timestamp); return -EBADMSG; } + payload_size =3D res; + } + + pad_size =3D esparser_pad_start_code(core, sess, vb, payload_size); + + /* Protect hardware register writes under core->lock */ + mutex_lock(&core->lock); + if (core->cur_sess !=3D sess || READ_ONCE(sess->should_stop)) { + mutex_unlock(&core->lock); + amvdec_remove_ts(sess, vb->timestamp); + return -ESHUTDOWN; } =20 - pad_size =3D esparser_pad_start_code(core, vb, payload_size); ret =3D esparser_write_data(core, phy, payload_size + pad_size); =20 if (ret <=3D 0) { dev_warn(core->dev, "esparser: input parsing error\n"); amvdec_remove_ts(sess, vb->timestamp); amvdec_write_parser(core, PARSER_FETCH_CMD, 0); + mutex_unlock(&core->lock); return -EIO; } + mutex_unlock(&core->lock); =20 atomic_inc(&sess->esparser_queued_bufs); =20 --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 993D83FC5AB for ; Mon, 13 Jul 2026 12:10:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944651; cv=none; b=Qfgg2ohaDGNhDfknMB2hvVJWZcYcvu+zFVcQzXpK11Xd5sQwefOBEdPc3uyTXOJx/gs6a51ObtvNe2JdbedLqISUeRffgIK0SALsg+vO7vtXdqfji1jw7gVZ7o7yqM0NzHEYj2yp0RII7nGvUQD9qPST5Su+PKaVc7a3dxjthiE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944651; c=relaxed/simple; bh=86BevP00Vb2nr0l/gWPTl/2RFuTXiK146v6jmeBi3CY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=E12+NNedwVccS8L73EVNWgtKFRc7gUkxuQoW1i1gYPCsxT/TA0Idc5e+c1C+Wfig1jaOXA34JVjC5tC5tsuiYzCMWA8YaBdf1FuajyfehuUJ02TqB9Rcrn+IInSwqZ8fc5rJ1R6I/YprJOQ5SiFEupT787ClQd6wN9Fc3Y0qVYE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XXOCGOpk; arc=none smtp.client-ip=209.85.215.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XXOCGOpk" Received: by mail-pg1-f173.google.com with SMTP id 41be03b00d2f7-c9fe3c9bd5fso2768936a12.0 for ; Mon, 13 Jul 2026 05:10:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944650; x=1784549450; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=OBddtjFYWhyXG/z7saOr360Gpb3JLBOtzUiY/pJ38ko=; b=XXOCGOpkUgaV/3+z0sqPfYO7HxkLlNfIPH9eebx4mUe8KMFF8Z/hWVH+O0kReB5VJc RZuryn2ASjEC3RDkmPVmUSBKkvMxvDiq+13DW8ew7MOKY+MwpeIMz+Mhv0pnOreNtqlY ijbE9J0rHRL8IvDiHnbc6ITGU1J/BjlMyUo7Yu16Z+JMizr1cgEQQ90+wyKkFF1qrnwu XNQV9txsyDjOpTUC5qW28IegxQwdgdge8vdkD0HGnCAohX12Y/1V2B3DTw939vEXYISP 1zr4Cxv//NSwjYINsAepcGTbA9MiM1G0dP+bgcscBAOpM8CMlXjdqqr9RaORlFMlxSyN K3vA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944650; x=1784549450; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=OBddtjFYWhyXG/z7saOr360Gpb3JLBOtzUiY/pJ38ko=; b=R+Rg1l3cjrEfo6CzdmDdFoV8A8V46Srq+ncam5DB+ohWurTRlRCNRvbkXiYmOZe1rr o1L7ZTx5+tiJwqfvlHON2p/aXG/4Wcwf0vWM08/Sp4tY0/rYit3bQmzK/f8NpVLtVmSn eYwqUjB/JY2FeC3/6dqOq78lCbBNIuE9adb0ob5K23jt6YaTEfNQwQd8kbFcQsN+UZYH vEqeDDVIHS+2QJcaujaSKqQPkWCdc8gF74WkZFx13lOXrFyPKSoCOC78Ls1PZJHecRvT CgmJ0owAC3KD7ctH/D9mjM3zjq/2WV++vrZY/xXWGBQsUIK/S89EKT32zDQL+awUrx9r Kk5g== X-Forwarded-Encrypted: i=1; AHgh+RrKLbmbffvL8sZDyr5q0BBjPF38SzEJ6IhbqxHgyDXlwe6tZZXNKXHny4FrU0wz7ms96si9LxlfBG9wgn0=@vger.kernel.org X-Gm-Message-State: AOJu0YwgAjUPfcHUEZoqpbsjKoKhEhi0eBcyK2w44L/AREbZmB9JPn/U U6MG6TxNC7Cq0P6MAvMQQo4WNbNZwzGgam4llEJXiqXQmdvkNG2KNSxa X-Gm-Gg: AfdE7cnKn4X3sQYJkIyftFbYyKIsaTOCwZM/Hpx1BmTGfJ3apQ7C5B0FKu6TwHW0syo TTkVzXF/9lQNn6NlVNarWWxzxGdB8Ff4f6WWyTbRuXPL/PKKo14Rb8kA4v7WF8/rldcENsh2Ehf G8eDjrVAKbBWH6yOtRUURyRB1+QBdejJ1mckzIlQ/U87TSZGTNQIkTsh31o/TKh85nkTME+6CAq kZp7SukXK8lEyXNK961hGZQZ3ju9cng5rXIe8ObINSEu/tMQED9Mnb1MmEDhFx2umpL/jBNqbwV pxx/I0Be0sH5l9heibxx7ua3o/BOuq5aCQpBTgtihuHNmZVIAQZH2kX/pmZuK39Hqv9C8EEP90z 1mRtNAr4h8gz3amk78cd25Os07KJdIe6oUadHKcXEA/drtO5frKd6Ftt0f1auPjPozHcjs+xoZw af286QFAozD0ag0Hz2c9Sm X-Received: by 2002:a17:90b:4cc7:b0:36b:b903:994 with SMTP id 98e67ed59e1d1-38d13768de2mr15327432a91.4.1783944650044; Mon, 13 Jul 2026 05:10:50 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:49 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 11/19] media: meson: vdec: Update core m2m stream state during transitions Date: Mon, 13 Jul 2026 17:37:06 +0530 Message-ID: <20260713120840.17427-12-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Explicitly update the V4L2 core Memory-to-Memory (m2m) framework's internal streaming states when initiating or terminating streaming on the device queues. Without invoking these core framework helpers, the m2m engine's bookkeeping of active source and destination queues drifts out of alignment with the driver's local 'streamon_out' and 'streamon_cap' tracking variables. This misalignment causes state validation stalls and incorrect polling outcomes when the device is subjected to quick runtime cycles or strict testing setups (such as v4l2-compliance). Fix this by integrating v4l2_m2m_update_start_streaming_state() right after a queue is marked active in vdec_start_streaming(), and pairing it cleanly with v4l2_m2m_update_stop_streaming_state() at the end of vdec_stop_streaming() before the session core mutex is released. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 83a9b1238972a..0eb39aa6014ee 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -299,6 +299,8 @@ static int vdec_start_streaming(struct vb2_queue *q, un= signed int count) else sess->streamon_cap =3D 1; =20 + v4l2_m2m_update_start_streaming_state(sess->m2m_ctx, q); + if (!sess->streamon_out) return 0; =20 @@ -529,6 +531,8 @@ static void vdec_stop_streaming(struct vb2_queue *q) sess->changed_format =3D 0; } =20 + v4l2_m2m_update_stop_streaming_state(sess->m2m_ctx, q); + mutex_unlock(&core->lock); } =20 --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 254123F5BC3 for ; Mon, 13 Jul 2026 12:11:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944663; cv=none; b=bIL9FZSVxSDpjANCxuf7g2r1ILF3wjvFQCEYgKhO+uooLLkWcsM7IU3jSdSwSvizn1ugf/Dd2SOi6Y+mRk4LIfzeHTPsDWdeyY4jP46gSswl4ypCL409A7eHAsl6IKLR3xMh/bEUn5dVcF+2U828k4enXZ8f4adaZNL3Bdy/kaA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944663; c=relaxed/simple; bh=jmhAhBUOyXzBgu367txMVdCDQtWx981CcyJsmZjgz3o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=g4LtVLc6dpsa85Dn46FGkivAwSVdtXC5IchYrD1qNQeVW5ScaU8Cgq5ylVv2en7Cj/+qsHglZQtmK8Mzsl2wxG8nECVumIbNN6KKH/ScLjvP7Wu/yDtxVdxV/0JOc5IefuJzjtjT0wSXPOtzELM721Nh7dYmAMcqeJEAC0vfE2g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=pzmcGsfS; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="pzmcGsfS" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2ca64c3ce5fso34083915ad.3 for ; Mon, 13 Jul 2026 05:11:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944660; x=1784549460; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=or8zdD24QFos1ceTDAq+AN9AMfFHPT46CUnsHlWUgzA=; b=pzmcGsfS+Ix2DEKnYhhx7slb8QFyqysIvz8R8Ww+bHYfo60wM497DbW33r1pn9213V RE8paDZVoA1zQHLTCpNY2az0j2p3otW1E8sQLrjdLgQGOeEl5F/FOxFj9H0xDvamlQm/ MGzftxXCXiD2Vxu3QYRpYvON3+tw49w5xGEjCX5eCm9N9zt5802Il6X69iSpAuKVye+Z Buox8BF5vlUuuXhuLgbrzrw2L2sPNE7cC3PWikXKwr9owRQvx9mSsQNk8rHPwgY3IwUu lGq3qBYX9MHpm08QJyvHA+b7vzJScbj3DaeADmuJiQJm5mextmkXjTlRIdZPk7iZL92d BGYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944660; x=1784549460; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=or8zdD24QFos1ceTDAq+AN9AMfFHPT46CUnsHlWUgzA=; b=k1JDYCAC9NndK4jUmpC4nReIVx4lOJ+tx4C4SNDb/LRWOx6TeJ0s8MZwKbsGNZkxN3 WNSvxJEsEGKw5gBJMPYh//g9WAdn/SzMwjG2gKO3IXdysNFhV8/iFimBMppuJ13C7M63 TDFKfKRIBpBwFU+h2oW3A4aBhGDPzgNl5Uiy+AY4tmehHz0lQof7iXI2htg/m5cQ53td qvkYE5/H99b0tSMr48GGCiqqqiopEIzhxoOVix1ed1wXWTcQn0iCb6BBBt/UMFUIgKsv pvQ5tqWnx7HqHnVFv/IF+34UFTiQr2cpZ0vU8Rfs8MhoF1jaWjhVfUj3Jlz4UeFVDIu1 J2jg== X-Forwarded-Encrypted: i=1; AHgh+Roc0v8SuTP6KBfEfSWo8+92k0g9kMV+/TnGAw6EZvNKL+IaZ4lznOnWOL8ekDOQxvfveNYUAMn683doTzM=@vger.kernel.org X-Gm-Message-State: AOJu0YxG6+WJR0Cwei8D+fBgUTj4qU0WRl0WMrsUCYApptYI2g8O+3gv wxdw+9JrLt9hqpXLbFFwBTwE4c24WhsEXjgA4HPtAB0+MoSwcnCqIhtW X-Gm-Gg: AfdE7cnZ/qLOgGjE7OHUXLLVp4kosfedKJCT5BkxdEwSX0pn8zGTvBvhDiEv9T4K4e6 azRMvGT0DWMhDC7rwcdgZI/2eD+Lmzc/bRBNpEGbxnQ2uNFMnZEGXCfJKT0ylLlSmAVfQ8s9x4h 5k8aS8RFS3BK/+UYOsvgWTXr1R39qKFSEIQuI/B2c1kbn1SlmR87sk0XUPPjaMV9c+xjdClPC/l Kx7Tdk99r5EndIF6GLl9/InaZS2BiG06QUHivJvj18g8lIqfVR/p84OvIofW1jwirk4O3QYSPY/ M+OZpdcrbsn6rcAKTlaryq+jDRW+zCBk29zpecQWy4YajUC2ubuDFegJtcfE7uGkQr2mGLaWQYF sOQ94isI7sb+82OltuWoEaitnMuIeEwdT/4oeyNAXV/4Z5ngnve0FhCdIWUnIwsxGFMpHW5l1Lr SmWUi2P+0esXoawaq366BO X-Received: by 2002:a17:90b:3c43:b0:37f:9ce3:ca97 with SMTP id 98e67ed59e1d1-38dc777b8a2mr8266584a91.32.1783944660581; Mon, 13 Jul 2026 05:11:00 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:59 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 12/19] media: meson: vdec: Coordinate m2m task execution inside async loop Date: Mon, 13 Jul 2026 17:37:07 +0530 Message-ID: <20260713120840.17427-13-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Introduce proper V4L2 Memory-to-Memory (m2m) scheduler pipeline tracking by handling job finalisation inside the asynchronous esparser workqueue. Because the meson video decoder offloads raw hardware register processing and bitstream feeding to an internal workqueue engine, calling the helper v4l2_m2m_job_finish() prematurely within the primary device execution trigger context (vdec_m2m_device_run) drops the active task transaction state too early. This timing gap creates a state mismatch in user-space multimedia layers like GStreamer, resulting in a fatal "poll error 1" event abort that breaks streaming setup sequences during pipeline preroll. Resolve this architectural loop collision by deferring the scheduling call to v4l2_m2m_job_finish() to execute exclusively within the worker routine esparser_queue_all_src() at the precise microsecond after an input buffer payload is fully validated, cleared, and returned via v4l2_m2m_buf_done(). Additionally, protect hardware session context mappings with core mutex locks and implement volatile early exit gates within vdec_m2m_device_run() to ensure stable teardowns. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 4 ++++ drivers/staging/media/meson/vdec/vdec.c | 11 +++++++++++ 2 files changed, 15 insertions(+) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/= media/meson/vdec/esparser.c index b9f36fef4be12..939b239c2af47 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -399,6 +399,7 @@ void esparser_queue_all_src(struct work_struct *work) struct amvdec_session *sess =3D container_of(work, struct amvdec_session, esparser_queue_work); struct device *dev =3D sess->core->dev_dec; + struct amvdec_core *core =3D sess->core; int ret; =20 while (1) { @@ -437,6 +438,9 @@ void esparser_queue_all_src(struct work_struct *work) else v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_DONE); =20 + /* Safely notify the V4L2 core sub-framework */ + v4l2_m2m_job_finish(core->m2m_dev, sess->m2m_ctx); + /* Set tracking flag indicating transaction completion */ processed_frame =3D true; } diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index 0eb39aa6014ee..b3e1d99e8889f 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -149,6 +149,17 @@ vdec_queue_recycle(struct amvdec_session *sess, struct= vb2_buffer *vb) static void vdec_m2m_device_run(void *priv) { struct amvdec_session *sess =3D priv; + struct amvdec_core *core =3D sess->core; + + if (READ_ONCE(sess->should_stop)) { + v4l2_m2m_job_finish(core->m2m_dev, sess->m2m_ctx); + return; + } + + mutex_lock(&core->lock); + if (!core->cur_sess) + core->cur_sess =3D sess; + mutex_unlock(&core->lock); =20 schedule_work(&sess->esparser_queue_work); } --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 645D7408604 for ; Mon, 13 Jul 2026 12:11:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944674; cv=none; b=tLQ8iO2BclWftpkGMbr3cmmrAqLjkJaXmgKr+o0jRn/LjtQyCraBvph40KRoyPMxOEXo9E5E2C2gcHevnd1XcI7/RjNUUMTeMLa0OJ6BOD/8cAqQZYzSaROOdx/hVhpSbPYns7cVAnYLkJxGXjxhFbqvmVAnNHtQEN7mTqnMvVY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944674; c=relaxed/simple; bh=zCGdfwgN+TNG39gAmZu2s6yLUo3JyS1qCB3nKCP6UcU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=S8dRaZsC5CxR5caKauOGmV9iel7xwJL7PJoJ/TiQeLV5jQUWtf5vBuN5hKM+VytfMErTnCPfF9NHtBzt+TzK2f3oplF4EyWrORXhXzTNWShUGnrZ4p9NoUpM9NcrQcOEDuJ2M097zCAAtVoADRyzLbEaLVamM+mDQVMrC56Z+nE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mPwzuza2; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mPwzuza2" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2cc7ef7ec27so33191695ad.1 for ; Mon, 13 Jul 2026 05:11:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944671; x=1784549471; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vnt3ypfWeNL23UY1KrHNZewux6mQtgVXM5HeMULrIrY=; b=mPwzuza2XbnFq8pu0Nd38dTNkNHN/vfxSxTeEAupHDoPIM4vclbtDWpNYP5fjRn7jv +BEALwYHoHP7t1TAcIlQpikyNYY92RgPd3GSfB9qNXQ0JM8kK/A3gpSM6+8otmBfT5Hf YrBMsSQ8Ksmglp8oE+jgBI8gmQc+KW+sEo2F7JI2yK5shv0CO0dkw64ZLNMT3AXhy0rs Javxd4z2gwNq7t/Y0lWVtATQwCp4Nub4dZjEsSjfDKKJLuEKGN5BtHpOQOlLcSBwKoHh MUL5eugQktOI6OWR0TQED8nUUitl8adB3ewVTdtriGJ7TwynPO108nFv5zOVjf5iaN7P EAxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944671; x=1784549471; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=vnt3ypfWeNL23UY1KrHNZewux6mQtgVXM5HeMULrIrY=; b=DeSltjJgSrPCeYK80MOxijosSb2sv7sto1eOCy2Cb1y/Rh+iLE0MdRxMVSVEvCn8kX 6OSfug3Uz0HiOmYA/esxknyfEM5mJeXo7AiWi0ST7R/alv3r6tkTWHFOcZC1IcXT6TLu J67ZGriIiO9dr8fvOQQIJsJp6dyasUpaBfHSKHi5piFCdzxOuAJ/ySjYsM5b58qSRcSe TEerhR1YHl+HYsXP57WRcW+XlZUF3DIQNdeh12LU/kAr1nt3IERZPQH3emSMMzv/1rkG w8gKrAHD9yrfxPeU3Ivg0uqzysujcGs24KOk2dAWnfmdZLIfT1JtfAFGdDs1n8MRSgAa MXFg== X-Forwarded-Encrypted: i=1; AHgh+RrSAIBA/r1yasWYozeKQZZE3qPWriJi464jb7wvJ6SC5VIRQhzx83TP257k6gdDw86+XxkTyWp1i1GYXPg=@vger.kernel.org X-Gm-Message-State: AOJu0Ywvm+XxLrd7sT17gYnpGEbg63YBLugeiJixEoaAlswe+GAFNADx wN5S9C3H+RW+WCEAVHE9B2TX+5Y7HWpp4ZuG202ovGpXc/w5HNbyedvr X-Gm-Gg: AfdE7ckwt7lminiJ4r+Plm+trH5kU5g+6jYjzB1fQCnZ1AHAWGscO0oILzYjc3MsdqE Bzm1uoK7nyu8WnVEk6u3BM8j/wiER9VRUJiZ4rcbosoqfG882ipPRazPMpBUAJO3b8zJeuDKnKi +MtM2v6+yTrsS7omH3x/mijgJakSelkNatJ9h37wbWuZ6VCfqbPaxEdmye+62uD7J/6RMqxmxvK ogmfP0m3EHWonef9d/ft7dObHNv1PnNK7Ppj+X6pV6lz46PkGHc+KKiH+GTWYdUjm7LrVHmbjB3 TBhJZHcWMKh5mEMehitXDGSkw7nAyl3gVV+ujFwf8G0HbCazpldy4zamXNpBKVObFHf1mvQ5dD8 +TN34mr/TrR/Ty17YUsH2JGVxq2AuZeP2V4bfDil6EeHRj51agj9nAIkgcYOSjpuDnXv59vpplo op+HDrue2xKfbmNy+aVfDA X-Received: by 2002:a17:90b:4990:b0:36a:a16b:5f6d with SMTP id 98e67ed59e1d1-38dc74c4c2cmr9218450a91.7.1783944671501; Mon, 13 Jul 2026 05:11:11 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.11.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:11:10 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 13/19] media: meson: vdec: Fix race conditions in job abort sequence Date: Mon, 13 Jul 2026 17:37:08 +0530 Message-ID: <20260713120840.17427-14-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement proper cleanup inside vdec_m2m_job_abort to safely stop the hardware job sequence during a streaming abort or teardown. Without this, if a job is aborted right after being triggered, the deferred work item (esparser_queue_work) scheduled by device_run could continue running concurrently. This leads to unexpected behavior and potential use-after-free bugs if session structures are cleared. Fix this by flagging the session to stop via WRITE_ONCE, synchronously canceling any pending parser work, and safely clearing the active core session pointer under the core lock protection. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index b3e1d99e8889f..ac86a9c4febff 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -167,6 +167,17 @@ static void vdec_m2m_device_run(void *priv) static void vdec_m2m_job_abort(void *priv) { struct amvdec_session *sess =3D priv; + struct amvdec_core *core =3D sess->core; + + WRITE_ONCE(sess->should_stop, 1); + + cancel_work_sync(&sess->esparser_queue_work); + + mutex_lock(&core->lock); + if (core->cur_sess =3D=3D sess) + /* Safely clear hardware ownership since we were confirmed as the owner = */ + smp_store_release(&core->cur_sess, NULL); + mutex_unlock(&core->lock); =20 v4l2_m2m_job_finish(sess->core->m2m_dev, sess->m2m_ctx); } --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E5923F6C48 for ; Mon, 13 Jul 2026 12:11:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944684; cv=none; b=TmkoKE4mUaKtH1drgu6+wLUEj3XGqKuqikDpBGTDYn2uxaYgac1EAG1hppEgfa6yGEUhQEZFgUU7cB9zX2/Cc75OMz1yaqJYMDGVKJw9EymoGz+GYzniv/pRstVvZ4UKdKDJE9owrrXyWyW71DvrF38wUTHWzRejG62nlXxG86s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944684; c=relaxed/simple; bh=G2NQafJclYTeJRa5vR4Nkq85FyLNUI0JvtBWv+71DF8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EeTi5PkHo/PgoOD2/v1SiDR5vqg3wyWdWSDrZfEnHXCjHfttD3xfQqBX8QgG92GMXY5mLTx7e9tQnHojy0Vhy+hFDMnpPwFRrytbdfF3qFTsRtipbZpEYspqRM9zG8BkkobI7xfkWp3E7lIL38juHU0UQlhPZaRn76RjyPGUU4I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=fcozDjaz; arc=none smtp.client-ip=209.85.210.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="fcozDjaz" Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-84864086bfeso3028982b3a.1 for ; Mon, 13 Jul 2026 05:11:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944682; x=1784549482; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=7nfm5E5YVw8Xk7Gt9ejcJe2nuIHpfZQPsIGFP/AIC7g=; b=fcozDjazFI/WUVc0BmHdQAQvM4spN0oJ9XlZLfElRLv4JT3GeeD7D5LQi7FGRoWlh+ Iqfl11+DFcJBk+LqcHVZGverbbXqiJJdjBdSSLD7pyULmurii+Do/R5CGKPCmXr70M+/ U9tMzOl+XMBityX623Sky1ZJ0wg7ozcnUohKb9GeEzkoJDWlQ+swCpWV8TB9JMkfAhKg JWSsS+b8El410LL/rkZvJTLt+cHHsl9bxarsiBYlJ1I7gSU/heipccqYdYtQs5Rl/+ZW uF/55/3JSWbS4WdOxoFZnyQlDbRgp6VrCXPq5DiXPlJq9PzbIXIGBOGHbQhEZN9PN5bW IFOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944682; x=1784549482; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=7nfm5E5YVw8Xk7Gt9ejcJe2nuIHpfZQPsIGFP/AIC7g=; b=aSqO+ZD8pfGlAT76zcdTTbsAz/7Cms5f7Hy0JmGWHbyeHHFiJuGyBmxDrRVl7WpV7V fXdyqzP/RBfaoe0ivROUc2PIj96TfBgbqcxuVVPQ9Mo7t2iwCdejdtgssfvLHeKd1Ji8 DxVVXALZcGEEG3HFY/yne7xYk3ci5ojZhMQN2vtaOUnCbUlqfL910reNPfft+TRYwZYm eSrz3IKP4TQIdSAPGNNEwxstKbECcspg9sAw3BXHpir+4scPysyL5hKBppcExIOGTkN8 D40W+f0zkRiyyeu32QjQC76t2vqOxtSmZEJ3Vo3OPrintB6iYlGei2nnxGfVQxZZeTv/ 9zUg== X-Forwarded-Encrypted: i=1; AHgh+RovVsy9q9DvUyX84fum8uqAqYbKwHG+++UlEmFstFBe1FKHo9flpCKoX5o9uNUTLPeASgv0VrcdmG5Qte8=@vger.kernel.org X-Gm-Message-State: AOJu0YyAJjFg4Jx2FHnGTWKSYye//+dZevXDhI3I2lMPPFr2/2jjICU4 g3aFSmT0uElYa3sEw3q9CsMjLqtniDIqz0V1+vdK3SB/Km/oMlP47/hW X-Gm-Gg: AfdE7cmCDbA5igWYAO28dWnP6ZDMuv8d1LAG/zDVeB/MXGlHkV+J9bOVT9TJXWj1GTp EvTwfL6UzMMSSnYO4kk9iyjkJS0AcErijsmnVaDQRHhwIpUB7Fy2Nywb9+m2s5TeFJOZ349GVnA 99cStWOC/P6tyTcFba02Ks5/NXLtEaG+mC/LT8+lEPqLePjX55Ss/KBDYDNkaqTvPeMW/1/qO9v PEZFpXGryPXzxCDNLJ9na7EXljzRdqqw3xY6/q1jlSCEyz4R8qZMl3GKEitQfRv8RumDae6lDEt GQPM1bZ8wt2d+vxQs2HlhXlk4ddJtFQdiPZPuRtdjhrqxJPeRyIS3+BDUoawEe9RjmoRc2f90/h 20Ga3bs0GQh+OM2xpEIZMkpa8hpDfjSbt3IF6Q4rSUg4EU5HPMmP29tgN/wAqNFza7qoTcK/6tN fmDhkkjPhGkQ== X-Received: by 2002:a05:6300:220a:b0:3bf:aab1:cc8b with SMTP id adf61e73a8af0-3c110b436f6mr8836067637.46.1783944681879; Mon, 13 Jul 2026 05:11:21 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.11.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:11:21 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 14/19] media: meson: vdec: Correct atomic counter placement in dst_buf_done Date: Mon, 13 Jul 2026 17:37:09 +0530 Message-ID: <20260713120840.17427-15-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix an end-of-stream (EOS) boundary condition logic flaw in dst_buf_done() by relocating the atomic decrement helper to execute after state evaluation. Previously, decrementing sess->esparser_queued_bufs at the entry point of the function corrupted the conditional checks for the final video frame. This premature decrement tricked the driver into flagging the second-to-last buffer as the final frame (V4L2_BUF_FLAG_LAST) during teardown sequences, which cut off the true final frame and broke compliance validation. Resolve this by moving atomic_dec() to execute immediately after the EOS conditional tracking block finishes evaluating, right before invoking v4l2_m2m_buf_done(). This ensures accurate stream termination signaling. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec_helpers.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/staging/media/meson/vdec/vdec_helpers.c b/drivers/stag= ing/media/meson/vdec/vdec_helpers.c index f02c21d5a9c18..303236f0647c0 100644 --- a/drivers/staging/media/meson/vdec/vdec_helpers.c +++ b/drivers/staging/media/meson/vdec/vdec_helpers.c @@ -314,6 +314,9 @@ static void dst_buf_done(struct amvdec_session *sess, dev_dbg(dev, "Buffer %u done, ts =3D %llu, flags =3D %08X\n", vbuf->vb2_buf.index, timestamp, flags); vbuf->field =3D field; + + atomic_dec(&sess->esparser_queued_bufs); + v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_DONE); =20 /* Buffer done probably means the vififo got freed */ --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E164408022 for ; Mon, 13 Jul 2026 12:11:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944694; cv=none; b=Zv6yaveGRrmqLMzU877l2kD2RNOVPY1gDoDQIoQUqatNh4uNlFKRIDSWdOEAuOKKHYaPO47S7kSmgKvs9jhFzvKxK0mUlFZ9W3JTthWvN41DRvDlObeoOSSzVNIDpRSWtD8SzLJ1wx2L/aNTIpJYeWdMCAWe/D8qqWLh0FFaQb4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944694; c=relaxed/simple; bh=PdPDblUOn/WdFcz0v/ad9NxuPCUExDaGjMo+g3Frs3w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=md31BcXxVmUD1ljbkrf1hIBE9eLG3frpK5p4KgBBYcyOLvBr8Uy54b9Kg/V/ExWMfrrV9uUIg2CWmMm54zJ5JaVlGVA2YNRT3EMgi0TT6HTYd/OHBDjWj3K1kTDN7Ol8KwkC9tABw+5X33CbdSX9U42NAfh20tGtZODX68b9fpQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=o2N95+fS; arc=none smtp.client-ip=209.85.216.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="o2N95+fS" Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-38511175ad3so2410476a91.2 for ; Mon, 13 Jul 2026 05:11:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944692; x=1784549492; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=o2N95+fSvtnQBbxQmd/l5AZzbWf7C8AD/N8gsbj3hbKkEkrTdE4R7lLPDoFEPfS/wt eH3oI751UNyOPGG5ZAzwjLGCzGqEj6otaKKExQ1mYirWn/+Dc7prPr+C0EIKM9NFE3gZ C6NZAaV8zJxVYXQlfe5gemnYcg0vPwJBU5BQAo8+1D3QqhlgTwhToFVBcAP5sNfftnTf +tRMGSrL4Y9oTGGSAtJ18XigSxqizvAxFiTDXL4hLgOQ0oR7Mr2K1wTX/leILfIaOtRm oddhJ1DuLfIgFnYOhVTx6BZIda7/5C4/PXCy+rXYPL609xzRtoE0aMZlyrUptQ42GnTN ZCRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944692; x=1784549492; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=YLQzxG8gI1fxZ4r/JWspRQeGTNAcYvlV/fZGGpCKn7vsB+BmL7IAV9a4sZNaYKaBy5 7xprxqpC8AmUJbS66lGnQtapsCSzsstClzUVDw3/tSSMih6k7vT1gKos4E6itEPXArC/ hOObsaTDgoYH0b4USRIn46eXZyzsnia/dgy94G09Gb5c62sZYD4IhOp1eXYDOI5snNUh wpPLy40nb0pOXhkJefCsNpszkKB0EWq301KdJ9dek1A19mz1j+YJUo0x8O8zlEVEWQSX EQ4KbOiXsHwY/AQj3Y/gn1TMr5ArpUbpqTuNU6IXTf1paZDuMrvzhy/Wx7rk2VbMhC+5 CpcA== X-Forwarded-Encrypted: i=1; AHgh+RonO5FEvc/SrlxPMG8PgSvy/7OEafINJvR6nvcSmuV4v7AdXlpszWmdmZyJv10IAYnnLEN4qRpSNug6oXA=@vger.kernel.org X-Gm-Message-State: AOJu0YyGWTtm+gyYLCK9khB4iJFzhoHWtn0Z4PXc06rezS2Xa1TTTkE1 EH8SsJ9wCuA/BKNQ3NgcujOIue8yM9moJhJpxSDXOKtaDM5pZX0qSjMX X-Gm-Gg: AfdE7clixZgs/zsHaTHb4rnsTagQofoxJApcMlIqTJ5UJTPT8RQoYHNt7b+HXNVXCJe iZpMxh9rIa1rFOL4XrDoBBUd+yDeqFvwdtJvV3ETUmweviM+nw76MeFeMZXZlGNfOUiBrL4u7xr 8Wq37gZrZgGDKiWGVqaqgYNyR61L0WC2jEp1h8bEKaT81/+rJVLNGAfTSqnLtIBQlogK8l0PU5H 8/2pjSF6+9BeVR3lItCpO+kMU2aWfFa+p4Zkgk10s8LonxOnRIJdzdrBAM9BczCE55GWC7lqabU o5Vn02PsaGJlZzoh3K/60EImXUHBmxUYr+59Sog3944yqHtPKWSGmJ9yndw3IRPy/x5qI6o2+rp UqWFqsQrrh1PbE31u6T+vN63Iy5wI4r9A2rhxh1ig8aRguUkS//7dHMnJDwfz93GHdF9AbE1UaA 62LDYvXvv+Vw== X-Received: by 2002:a17:90b:180c:b0:38e:fbe:b67b with SMTP id 98e67ed59e1d1-38e0fbeb818mr766655a91.0.1783944692422; Mon, 13 Jul 2026 05:11:32 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.11.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:11:31 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 15/19] media: meson: vdec: Fix concurrent firmware loading race and hardware timeout Date: Mon, 13 Jul 2026 17:37:10 +0530 Message-ID: <20260713120840.17427-16-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The vdec_1 firmware loader used static variables for DMA buffer addresses (`mc_addr`, `mc_addr_map`). This made allocations global across sessions, corrupting state when multiple decoders loaded firmware concurrently. Under stress this triggered KASAN reports, lost references, and memory leaks. Making mc_addr and mc_addr_map local to each load call, eliminating cross=E2=80=91session races. The firmware DMA completion check also relied on a raw decrement loop of 1000 iterations. On modern CPUs this loop completed far too quickly, often before hardware signaled ready, producing false "DMA hang" errors. Replacing the busy=E2=80=91wait loop with readl_poll_timeout_atomic(), providing a bounded, microsecond scale poll with proper timeout semantics. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec_1.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec_1.c b/drivers/staging/me= dia/meson/vdec/vdec_1.c index a65cb49594465..27363c9a5af3c 100644 --- a/drivers/staging/media/meson/vdec/vdec_1.c +++ b/drivers/staging/media/meson/vdec/vdec_1.c @@ -29,14 +29,14 @@ vdec_1_load_firmware(struct amvdec_session *sess, const= char *fwname) struct amvdec_core *core =3D sess->core; struct device *dev =3D core->dev_dec; struct amvdec_codec_ops *codec_ops =3D sess->fmt_out->codec_ops; - static void *mc_addr; - static dma_addr_t mc_addr_map; + void *mc_addr; + dma_addr_t mc_addr_map; int ret; - u32 i =3D 1000; + u32 val; =20 ret =3D request_firmware(&fw, fwname, dev); if (ret < 0) - return -EINVAL; + return ret; =20 if (fw->size < MC_SIZE) { dev_err(dev, "Firmware size %zu is too small. Expected %u.\n", @@ -63,11 +63,11 @@ vdec_1_load_firmware(struct amvdec_session *sess, const= char *fwname) amvdec_write_dos(core, IMEM_DMA_COUNT, MC_SIZE / 4); amvdec_write_dos(core, IMEM_DMA_CTRL, (0x8000 | (7 << 16))); =20 - while (--i && amvdec_read_dos(core, IMEM_DMA_CTRL) & 0x8000); - - if (i =3D=3D 0) { + ret =3D readl_poll_timeout_atomic(core->dos_base + IMEM_DMA_CTRL, val, + !(val & 0x8000), 10, 10000); + if (ret) { dev_err(dev, "Firmware load fail (DMA hang?)\n"); - ret =3D -EINVAL; + ret =3D -ETIMEDOUT; goto free_mc; } =20 --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pg1-f182.google.com (mail-pg1-f182.google.com [209.85.215.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 868FE409283 for ; Mon, 13 Jul 2026 12:11:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944704; cv=none; b=MiTkFb3YV0E/x7Qswg0WGzbBtzUhopwDi6SEr8sJUoXj+KE4p+Ol6ZKVcoskW+jN5uidnSwYR4vxk0LswZ5tJXcQTc6vCtR3bVyIn5VyXDg3nIxewIfUvSO4X/GAK0TQvtmfKcbbcqqKEILXMLmZYgAYQFmM1zPl8EcuGMhboGE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944704; c=relaxed/simple; bh=Oo1zBhvF60qelrBXEcyAajK7JtUh598aCvxZV7Ifbmw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jDV+mToAXf5CPt45rExMrYIKlKPpbeMPmTImI9Donp6qkgalRUh9ohAFQxnh9ftYg+8Jl7dtg0Bx4PjQmlIklNzPWLvC/ALwVJ2TzVwdFxx6BgzsCqzEg9U+bQFuIFD8GMLOL8DImeHscE2Ti2lP9n8vkeebeip+6VoP8dhebww= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SatcBO37; arc=none smtp.client-ip=209.85.215.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SatcBO37" Received: by mail-pg1-f182.google.com with SMTP id 41be03b00d2f7-c9cf07d2df6so1977044a12.2 for ; Mon, 13 Jul 2026 05:11:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944703; x=1784549503; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xrLz/BgMOWZJw3Q53MMnd8sHfRljAQMBGTN2LAcpT4M=; b=SatcBO37GthLcgCzc+9aPHbXjJT9iHq8sUJ5HRYMQ62TUl2aelWG7/mETN5N0zzDtV vmZVqdLmvrZAbtcTR1o2YBeUdUKUe2Iel35C0xJbx1k8dWfQf+qTIzIIagA/NKIkaObu oib2YOLu/UALvHt3oJOKGzGDKd5Xq2Iz98bntg361NI4o2l4AaAqzbz+5GSGgBnwpoWA i0yoToTuzdeacgs92+OUFyvdqwvnRbRMcZVMa2ccsEth69Hcx1rJGHKcXxu+BKPKCkR8 CSZSmEc0Zll0dWcfVjkSLc0hJaR2aWvJLNJ78Ddp0j+ErhEi0tv5WYtdFI0LDHuN9J8y G3jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944703; x=1784549503; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=xrLz/BgMOWZJw3Q53MMnd8sHfRljAQMBGTN2LAcpT4M=; b=aDz9f9/e6i56wb3ONlTTyj7s7y8f/E4VbQ2X/lU0nVDlD4LP+2IdadDUWe+SLLMnGN mYU70ZJfgqixV3VpFRJ/kGnAqPcYzBoeXz5JN192VxvpWEQn/shC7nDc5vzG2BcTdDB0 NWE93Punr6Gc/iV6l1sjxEiXZ3KLGccobYWzOq/QNB7rbt6Kwb/yBg3G7z6d+w2qaSNO rhW2MDa938OyD6396KVMHAYYRKZZTuFES+cBnSE8jHddEw4Ibp0m+rMc8uOk47i/B+c/ txbQvs4JuC6ORQTtMKtC82081yj9PPXAENHxaQJC4JSXvlYof4774fh8lGd/lmMYIGqN I+AQ== X-Forwarded-Encrypted: i=1; AHgh+RqHNV/8k+p8Hk3/3nsBh9kxZ2adrxcJtLSq2MNQHFTkAuwScYeOULz80DfpgT6myOPaLbfTZQjOMMfmGTM=@vger.kernel.org X-Gm-Message-State: AOJu0YxKQaH1ASldYtj6sOq/eGMR1XXxedjGwcyjyfFyCgFnYuzYoIi7 qbqwiuZLu78bx7ugKkRiP64Gc1yv3Ii4Ppmyfbt08GVn0n/wvN2r6MeJ X-Gm-Gg: AfdE7cmWvOBqBcZxk1+OWhh1GSAPO8qCStKXhq74/xiR7ODLGDAyWoCDWhN9SGRmuNQ sdDBuPbSaC4PUizeTZCeD75UmC9OthcnzA7OrmZqbYo5JOdCXDoLI5MvNDNseVP/VLmA/Mt84Fx Au77btanTXArK9RFVMyj98w0vMbzqNLpoyLJwCPjs6bYPg7RVN62tkEtf5AvpN2wH9UzF4eSjHa oHe9mmrM4HQorbnrFhR3TtxBIahgCMuQqpftS6a7liehtajXgusK3U7m1UoVdj8QJIjhDLStbju 7O8agFeZrveCCozSvwKEI1Otk4eoC+ih6l4RJ0eTI1HADrVt9v2GE+77z7AGbN5z8lwJDQ3ixCU YV7pfUBe19gSKUfVMI9M19q5bixMTc82bch+gANJdMoimqMkzlc4AqQGVLFqhWuPF/ogfFSqkIM v5KImAg06Ffg== X-Received: by 2002:a05:6a20:da1a:b0:3c0:9c18:d5a5 with SMTP id adf61e73a8af0-3c111073a84mr9971121637.66.1783944702870; Mon, 13 Jul 2026 05:11:42 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.11.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:11:42 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 16/19] media: meson: vdec: Configure DMA mask and segment size in probe Date: Mon, 13 Jul 2026 17:37:11 +0530 Message-ID: <20260713120840.17427-17-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The vdec probe routine does not set explicit DMA constraints, leaving the driver completely dependent on platform bus default values. This lack of explicit layout initialization can lead to allocation failures, restricted address space mappings, or broken contiguous buffer handling on architectures with restrictive DMA layers. Address these platform constraints with the following changes during driver initialization: 1. Enforce a 32-bit coherent DMA allocation window by invoking dma_set_mask_and_coherent() with a DMA_BIT_MASK(32) argument. 2. Maximize the contiguous allocation segment boundary constraint to UINT_MAX using the vb2_dma_contig_set_max_seg_size() configuration helper. This guarantees that large, contiguous video frame allocation requests work reliably and explicitly aligns the memory management paths with standard Linux kernel DMA management paradigms. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index ac86a9c4febff..d33cbebc4453b 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -1186,6 +1186,16 @@ static int vdec_probe(struct platform_device *pdev) if (IS_ERR(core->canvas)) return PTR_ERR(core->canvas); =20 + /* Enforce strict 32-bit DMA limit to match hardware capabilities */ + ret =3D dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32)); + if (ret) + return dev_err_probe(dev, ret, "Failed to set 32-bit DMA mask\n"); + + ret =3D vb2_dma_contig_set_max_seg_size(dev, UINT_MAX); + if (ret) + return dev_err_probe(dev, ret, + "Failed to set DMA max segment size\n"); + of_id =3D of_match_node(vdec_dt_match, dev->of_node); core->platform =3D of_id->data; =20 --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4BB593F6C55 for ; Mon, 13 Jul 2026 12:11:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944715; cv=none; b=Bd0+UjH3YHjpNuP0baiSVAbne/4CBhGYOnfDtXT0Fs1dv47GA4+MpG/PpNVOFXSpnkHqEYOHtYhYLCe9ogMFCUnWHtCQSEzCjg4J//ebJK847J6nVGySO/neUyTSDfMO1a0JFkjYckjphzCTexfvUXZSBxZ08ua3+FWggcp9I7U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944715; c=relaxed/simple; bh=ptkcLZC/rZ3ISEyM/x91NL/C1Etf2/yRncxk30AlMs0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QaZpjAJnVcePcs90aUYAK5YIuZrcKZVQpt+rSQWj35UlLT5nRBsmePcGkEQd2Hj8zI4pAF6TLG+DnhJeLEtgvseRJIoll6/T+pWt+UuO+wxk2721btd+8lF55HhYQbqy41Q1qZB/1HECNsw1NBamHdqfzTFBHv7Q8xX8BRCkLyo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PjOEqM4o; arc=none smtp.client-ip=209.85.216.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PjOEqM4o" Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-38dc69c74b8so1491841a91.0 for ; Mon, 13 Jul 2026 05:11:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944714; x=1784549514; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=M8Fc1y4+RwjniJfgwRtIk0X9ABaeOzCopsCGLc1zspc=; b=PjOEqM4o0ovCqKiaFjVJqWCJuuV52AYTqcRtlAQKII5bEone2chz6L8trltPCyiVBE Ky6SzkltMCBjlmmvQwgdYzyTbz5/o566wdNMqeVUThx0jsoZ5KZsoa9HwrQ1uuW0AvZv MRZ9Xaj2NQoViPTRh0aqYe057dUQ/0J28AoBf8+boowUuo3ydhhxZ14M9x/ngp8K3li9 OsUL10czxNdEHr75rUzuQxlC3mrZNAHOqKfSrXvJMi1scas3gY5NXz7V3MGyTv7zFBD2 fuIU3VcJXBpvhnZPgQF4yjNy0f1ah688qtByKTDbCFYmNrmB9INUZ8iVLwbBiplXdNpq MoCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944714; x=1784549514; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=M8Fc1y4+RwjniJfgwRtIk0X9ABaeOzCopsCGLc1zspc=; b=hihP56yY2nEzxMhoBg10G0c04tTaGdcL5jwT6N2xtm2P3fAfdG2ummLSRodZkR2TPf 3WCl65jCJm/hYURvVmMcJ6xstu78JYYIpFvTeY4yYXKDrevZZ6HS5MNv5a+PBFggLrNN NJKZO+1LG0jlKUY8jk9pPP1w88vRngs0RIU8hY+W/OCRjfDaIBHWeXgE8luay9XDXQ8I 0KjG2pBG0/Kh3pakTbIEvrYN+MICPqxbubHSydU5VRNTSRM+7YnafBqzYCnDbOmR4jA5 sGNhVEcr/JKnPMroBJuWVZE6DIXDz4bX/srXf95TsfxdsGiQSVX/zQqUdD1uJy5t5eS0 Lozg== X-Forwarded-Encrypted: i=1; AHgh+Rr/HxmRor3agUUfOggvvo2AM5hlNdLBve4Fc6AfchlxESr6FmrH2xoOYwJa/gBMCcRwzAgvJMmMJlO0dug=@vger.kernel.org X-Gm-Message-State: AOJu0YzWE5gOZ49waPZaVnybBd7K21nYVloqaL1O75pOAzyoEz4SkRZP TwW8C3GXcZrFsOq6insudPe/1tR5GxaqC3lE81kXURKMs+/YUvb3O9Jm X-Gm-Gg: AfdE7clbvN5oWfLvCZO85YIdaahBXT6qHyt5KmWDm5f53yzk3kHCYyIH8hVqCoKBBhm CMCyPR+2obqsSDWv33grg7CMXEyo7cNWtHEPVa8SiuHQrcM3rt61PkSkQllne/Fd+eKvnjXHkRS 8docRSzGnXXm2tPEZQlsGaF2pcNz8scKN1TChSFWTQCq9SbOGo0NIJNQHPQettRTSEoN/ZTSCl8 5kBxJ/hv3wyNO+k1/rIJOWWixGlkPP/0Kbta+o56JKGPOIux1zhhhnb5uu7JDmXBpMXlNheuKtV 2f/ovzUQG83s6/TdOHxfKF+zVhZECaLNn/gUus8e1pre7O79tWZjDicc+dORI0M5DZPyU02n4uG 83mHNncCLkLacokPIexomt8UkMYKEFyrKi+BuK+vuNx7hZ7YvbDMp9T1trdk2POxjGttA1KJMtH //MbPbWexl1g== X-Received: by 2002:a17:90b:4c51:b0:37c:607b:2cd9 with SMTP id 98e67ed59e1d1-38dc7607589mr7644160a91.0.1783944713757; Mon, 13 Jul 2026 05:11:53 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.11.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:11:53 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne , Sashiko Subject: [PATCH v7 17/19] media: meson: canvas: Fix Use-After-Free by linking canvas provider device Date: Mon, 13 Jul 2026 17:37:12 +0530 Message-ID: <20260713120840.17427-18-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The vdec driver retrieves a canvas instance using meson_canvas_get() and stores the raw pointer in core->canvas. However, the helper drops the provider device reference via put_device() right before returning. Because no formal device relationship is established, an unbind of the canvas provider driver triggers a Use-After-Free (UAF) bug when the video decoder subsequently attempts to access that memory block. Fix this lifecycle hazard by enhancing meson_canvas_get() to establish a formal managed device link between the consumer device and the underlying canvas platform device. Using DL_FLAG_AUTOREMOVE_CONSUMER ensures the dependency link is automatically torn down when the consumer driver unbinds. Additionally, handle missing link conditions using dev_err_probe() to clean up upstream error diagnostics, and ensure the canvas platform device reference count is dropped safely along the uninitialized driver data path. Cc: Nicolas Dufresne Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260530111022.9C6D71F00893@smtp.kernel= .org Signed-off-by: Anand Moon --- drivers/soc/amlogic/meson-canvas.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/soc/amlogic/meson-canvas.c b/drivers/soc/amlogic/meson= -canvas.c index 79681afea8c61..5102a491bf778 100644 --- a/drivers/soc/amlogic/meson-canvas.c +++ b/drivers/soc/amlogic/meson-canvas.c @@ -54,6 +54,7 @@ struct meson_canvas *meson_canvas_get(struct device *dev) struct device_node *canvas_node; struct platform_device *canvas_pdev; struct meson_canvas *canvas; + struct device_link *link; =20 canvas_node =3D of_parse_phandle(dev->of_node, "amlogic,canvas", 0); if (!canvas_node) @@ -70,9 +71,18 @@ struct meson_canvas *meson_canvas_get(struct device *dev) * current state, this driver probe cannot return -EPROBE_DEFER */ canvas =3D dev_get_drvdata(&canvas_pdev->dev); - put_device(&canvas_pdev->dev); - if (!canvas) + if (!canvas) { + put_device(&canvas_pdev->dev); return ERR_PTR(-EINVAL); + } + + /* Establish device link to prevent Use-After-Free */ + link =3D device_link_add(dev, &canvas_pdev->dev, + DL_FLAG_AUTOREMOVE_CONSUMER); + put_device(&canvas_pdev->dev); + if (!link) + return ERR_PTR(dev_err_probe(dev, -EINVAL, + "Failed to create device link canvas\n")); =20 return canvas; } --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E139E3F4DC7 for ; Mon, 13 Jul 2026 12:12:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944726; cv=none; b=N5IDeUsQ+Fl+nhK8SdsNZVYUbLBW2rjPTT9LTVXdsX+IknYCtISmR0iA2yAHX8lA+He4j0kmQCgVcG3vkMgKfJ8hfbUb8T72IORLA9yd1j/VSTu7YNb88ySpjYHC1ZXj9yOMBN1JNsSP6yI0rzH2W1SYfn9SMoy5usfBEOboIDI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944726; c=relaxed/simple; bh=ONUAUDigrwjdBwgyupNLuYzWtO9nh/4QSdLBbjitlQQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=H1/XgwEpgwYJLO+YdTI2iBGGuwRz8qrY348OknztI3ahpPMlOASzec+O1v9lqWI3IEZpafR/CrtRssqFBDgWSwqJl8I9AvovvizRHbMGnFro4D9Bfl8qE2H5yJuBvKtHNfpEluvMQ/ga4y5Nom1Li2HvzKMa2H5Dxho0ajaYsPE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ToBF5qWG; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ToBF5qWG" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2ce9e39fccbso13061375ad.1 for ; Mon, 13 Jul 2026 05:12:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944724; x=1784549524; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=yPxreeozyC9OlzBX8SeJZagWhfw9u0AGRhVPID7x7h0=; b=ToBF5qWGHIg+CdCXfSqmPk+s9FAw8hpBtFNby9gelAHd6c3Y64mGcgQefkCVt018fH y44qTxs7wbacKnS30OdwiOK+Q5zk957zJLAG6fqY3Z1dQck2O5DswOQGOpmGjIYAcRES Ry1FW5TECKskJbcWyAlpt1BEvcwfvXH8TAqfarCVkzLcuafVs6rRdfYFt58NdVzav9+q KBuyzQJc8AFaLxMoqX2J80c1XWPWkdSKHXcJhDF9TdrFdmlb/yarASqrFqXFAFzZklkq QXKpv4KqUi3kjoG4SPKD4wcz8qH3O9abMR+Lrk+zu+ae9eBLNM8X3xuEHzv5KKwW/gqK Cumw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944724; x=1784549524; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=yPxreeozyC9OlzBX8SeJZagWhfw9u0AGRhVPID7x7h0=; b=DJZB+Fdt8qY+gApbzsMfRBXlc1b++C1gPGU0+l0/Mkxto9DxC3RQHQICkFwmhJJRhN 2greIEiPVtvSm24zigleuwrVxKL2YGnxQ6SpykZ7fxRqcz8p/Ugm303ZP4jwBcsPzx6W Gpc3Kf6l4y4zsFoY6XLOxXU+ti9P+e8kgXt41GE2lC+u5lYwSXNMiR0BnMj1MZECgna3 TO5mcokXAr67Loup9mY2RMQ6DikcBwQmToI5PC/0Vuupoz2gm1h7zWDHu+mOA+vBgF23 ry8ABh1evFtetp/PivEur6bXgMElaVUJtfPdO90z2LpGYy+71Vawig5P9E2ZMgzIDl9X gKzA== X-Forwarded-Encrypted: i=1; AHgh+Rr9oWH81ztyRiokPWjl3P0ukh9q8gXDThNC6C1upBAVjS144n420wL9h+rw0n4tDktMwiS8FgAaUF1tc/Q=@vger.kernel.org X-Gm-Message-State: AOJu0YxPQn+W+o0q0YB44Mk0Wn0Y5KTd3qtx+YK9+RLfAbpTyhvCf4I7 etVVXFqolno7eNoTbdLwnqvde/rbA+/IXbvSCy9L6g5xxdaJdr839Gy6 X-Gm-Gg: AfdE7cm2tHVK7dUNPSNtdYNA0wD/VgiCqDYN4siqu2UKTGoWEE1fZB0ImpyRqqkUV8W un5kWM+Lh1YtRDknYPjQ9S+Cqk5ZQJ4/WTiyhWNA74/kNbY3piMIOL4XyvhnHi+Z42G1chBkibl QVR815IFobGHyvMK9ihp0liPOMJ6Ml1+hdeVXTImJ361EoEV9ZJVmMDooS2CCkUuK6uvv3mwEwk nUURrpv+MxzFl8f+iCqBvpO5SsScL5pNgA1d1AZmtSfahLLEGX7pSTtLkxtYwevVuU1EEmrG4zn lwf2mVV/md1UawA5Rm2eVGKJgDn9gX3jnzfayAOZDI8GjcN4oAqOr4SrLJ4dY3R/vBf5KvMjkz4 NZsW871mH/G4qUeQrA6zKSbrurABRe9V47P9eLZ35C0RVbExnraz6IxwhcKcJV54KyLDpbK5jcp gtv5UEZQFdOiFN0tE0hVbqB9tIdlGed8Y= X-Received: by 2002:a17:90b:4cc7:b0:36b:b903:994 with SMTP id 98e67ed59e1d1-38d13768de2mr15332791a91.4.1783944724165; Mon, 13 Jul 2026 05:12:04 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.11.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:12:03 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 18/19] media: meson: vdec: Increase VIFIFO buffer size to 32 MiB Date: Mon, 13 Jul 2026 17:37:13 +0530 Message-ID: <20260713120840.17427-19-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" During 4K video playback, the hardware Elementary Stream Parser (esparser) can rapidly push massive burst data payloads into the Video Input FIFO faster than the VPU decoding block can consume it. This causes a buffer overflow when stream usage breaks past the allocated hardware boundary: [ 1852.587956] meson-vdec ff620000.video-decoder: VIFIFO usage (16779003) >= VIFIFO size (16777216) When this overflow happens on Amlogic SoCs, it triggers an invalid memory state, leading to stream corruption and fatal kernel panic lockups within videobuf2 error rollback handling routines. Double the parsed bitstream swap exchange memory pool (SIZE_VIFIFO) from 16 MiB (SZ_16M) to 32 MiB (SZ_32M). This provides a larger canvas window to cushion high-frequency frame reordering spikes and prevents the VPU from crashing on demanding modern streams. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c index d33cbebc4453b..824e2f156adeb 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -29,8 +29,8 @@ struct dummy_buf { struct list_head list; }; =20 -/* 16 MiB for parsed bitstream swap exchange */ -#define SIZE_VIFIFO SZ_16M +/* 32 MiB for parsed bitstream swap exchange */ +#define SIZE_VIFIFO SZ_32M =20 static void vdec_free_canvas(struct amvdec_session *sess); static void vdec_reset_timestamps(struct amvdec_session *sess); --=20 2.50.1 From nobody Sat Jul 25 21:18:44 2026 Received: from mail-pg1-f180.google.com (mail-pg1-f180.google.com [209.85.215.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 512E6408629 for ; Mon, 13 Jul 2026 12:12:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944737; cv=none; b=ZFx3DhUbfjMPf4YNVFMKOuyOjy5Q9yOXPnBKVK9G1cWmjikZ8IXRbdOKMZ/K6pnAZsjZyFGASW2eGarP/jrgkGpnAubnVWmigoetidyeW42virCV5+qyPiY4wv6fMjkBiyU5Fghm6B+T4F2d25Si6sp52aH6xS0fUd63we8wb0U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944737; c=relaxed/simple; bh=UMezn0MtVX4wmhIqEFMG2LHdGGi0DGlWMdQqs9pdrgc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XNrTTqrI7Bk8PXnlXYt5rM716tI7QpAX+QQqLbZ8D5icKUge27JtaIRF4jtvARrBlTIelWfB7Fe6q4q8KBmwqpOD1rpxc2Hear+A8zo17NV762jDgUS+BM1tTp2aeMaH9i91p4flJuveg5et98Zc3exqNAFPtxT3Al8m39S8Ngw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=I3YaPjb5; arc=none smtp.client-ip=209.85.215.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="I3YaPjb5" Received: by mail-pg1-f180.google.com with SMTP id 41be03b00d2f7-ca97d139d8dso1952552a12.2 for ; Mon, 13 Jul 2026 05:12:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944734; x=1784549534; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bCvZS+UotNJvFZgti0pR+2qbKuDNmgfw3z2iv69lpMk=; b=I3YaPjb5ZzjEuHzLKf5dGxe0UuhsZNpJ/c9bq8XqFoQZB0HUU+RhkmScD5huaHEw2e Q3Tq349pYSmafF9pIWXkt5K0AXQ/fY9+8cpMhg2HC4hwk+bA8BSyWX9jCu7q79rtNmsM VdHUsI/nt9O0WqyR3MKL9PE/kIT9fS6+KwHh4ZlhyDxmsMNh1j63d6is4fE5O0tnuWDG AViDe5lp5vPAqeH3iPaacg/QOe0isSC9llrYPlEORrZplA7s/wgLshyTjonKgS9eGJ9L zV4YUlrVb5EfqbgzucaMwmgD6b5rCC5t7Sxb/YmkIv7hUApUwI5gBfA6IPv0TfAiEXf/ Eirg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944734; x=1784549534; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=bCvZS+UotNJvFZgti0pR+2qbKuDNmgfw3z2iv69lpMk=; b=KkKhkGAX3b+C0W25aiYypDv8AKIHLCoADEDrjDQ6/ra1r/SWuGPJUIWY+xi9TU79l0 pLX9hb/XdPEyD8l/19aphNTKCHlf+f7TM59gHfcmz8w9Yg52a1QSZRm2iKckZUhxQARR CNy2EIncgPvEQwBhD6vkC3yQ6MC2ZndpMmGzqjgLqEOnX5BYVlgrSebbZHhoAOcZxVyx /xxJBGnqgdmMjd8PtRf96vTdE+/Cg7oz9K+LmEJX/GTpKzxUxxyxwcdyVC7ezlY5imdl n+eYw04YHLcxLuNZTjIp7QJRN9e5rGuwMq1PbBtsA9Ggi4NHspDPtv7Pq0cG1rrdp+mK ih+g== X-Forwarded-Encrypted: i=1; AHgh+Rpi/KWqcOuzpis7kPPkYB46woQ0ff/kPv0xgqXrm/BTgtRMkqvjMjFvzbp7RjXvHrVjmZtZ0xirBdOvo94=@vger.kernel.org X-Gm-Message-State: AOJu0Yxl7gqnJc6mZ8dqvls5okJCZPIrfA79qhQR6uuxBLAKwXyBvDYC rydf02v50U5sHIrg+maPxU3d1nUpQ/+KuCPbUos6qfqz8DqbNY/xbt60 X-Gm-Gg: AfdE7cnnjasFBPB5oea14xft+SkaYXtmPVSv9l9ESANPcT26dw4f96kZhzEm2WMmokB pqW0903LXO0DbuXfqjHt6B6m5ynA97/H2Z8gL6Yp9zoF34/b60HLu61s8ntq+Wnn8TVwbDYUU1c D4/I0bLy7niPZzu1gKmJ5BAR8b3mxoAoH4iuZN0+aHB0EE7f0e4Q3EiCScJNjRrQoh4SPj6EFbz +EdWanQ3WGLSZdZRYb6jcu3rUCxZwpAKmLmwrc00tofsqd/UScdi3/gRV6tBtDQB1ahyupMcQH6 5cwtdwFc7qKUkAQr2RT1Dt7iQ0z75E00ZTlF9QVt8NIj8h7+C4xSFC9Lg/Ns9IaicAsmVJTgz3L 2MBfEAH4VsMmpWHK/1cOqoUPHcxE6+NHBLafgoCAf8GdqhvlUMRdbI2qUFrFIbMSJfej52W1jPQ zpk6cVSsxYhA== X-Received: by 2002:a05:6a21:6817:b0:3bf:80b8:9c8a with SMTP id adf61e73a8af0-3c1102d7cf9mr9542534637.6.1783944734620; Mon, 13 Jul 2026 05:12:14 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.12.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:12:13 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 19/19] gpu: drm: meson: Fix DMA segment size limits and maximize allocation boundaries Date: Mon, 13 Jul 2026 17:37:14 +0530 Message-ID: <20260713120840.17427-20-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When importing DMABUFs exported by the Amlogic video decoder driver (meson_vdec) for hardware-accelerated rendering paths, the DMA core subsystem throws constraint validation warnings. This occurs because the display controller master device lacks explicit DMA layout configuration, causing it to fall back to a default 64KB maximum segment size limit. Address these architectural constraints during the master bind sequence: 1. Initialize and validate a 32-bit coherent DMA allocation window by invoking dma_set_mask_and_coherent() with a DMA_BIT_MASK(32) argument. 2. Maximize the contiguous scatter-gather allocation segment boundary check constraint to UINT_MAX using the dma_set_max_seg_size() helper. This guarantees that large video bitstream frame buffers can be imported and scanned out across sub-driver domains without triggering allocation warnings or page boundary splits. Cc: Nicolas Dufresne Signed-off-by: Anand Moon Acked-by: Nicolas Dufresne --- drivers/gpu/drm/meson/meson_drv.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meso= n_drv.c index 49ff9f1f16d32..899e70bca4ce2 100644 --- a/drivers/gpu/drm/meson/meson_drv.c +++ b/drivers/gpu/drm/meson/meson_drv.c @@ -202,6 +202,12 @@ static int meson_drv_bind_master(struct device *dev, b= ool has_components) if (IS_ERR(drm)) return PTR_ERR(drm); =20 + ret =3D dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32)); + if (ret) + goto free_drm; + + dma_set_max_seg_size(dev, UINT_MAX); + priv =3D devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); if (!priv) { ret =3D -ENOMEM; --=20 2.50.1