From patchwork Mon May 11 17:12:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Valery Borovsky X-Patchwork-Id: 2218 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from tor.lore.kernel.org (tor.lore.kernel.org [172.105.105.114]) by mxe881.netcup.net (Postfix) with ESMTPS id A1E351C06EA for ; Mon, 11 May 2026 19:27:06 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=gmail.com; spf=pass (sender IP is 172.105.105.114) smtp.mailfrom=linux-sunxi+bounces-23260-noreply=patchwork.local@lists.linux.dev smtp.helo=tor.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.105.105.114 as permitted sender) client-ip=172.105.105.114; envelope-from=linux-sunxi+bounces-23260-noreply=patchwork.local@lists.linux.dev; helo=tor.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id 7CEA331426ED for ; Mon, 11 May 2026 17:12:28 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 417CB44BCBE; Mon, 11 May 2026 17:12:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="B3Z7CTYk" X-Original-To: linux-sunxi@lists.linux.dev Received: from mail-lf1-f45.google.com (mail-lf1-f45.google.com [209.85.167.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C184449EBB for ; Mon, 11 May 2026 17:12:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519539; cv=none; b=iyfCFE6K/pWaHS2wmK4Mz7PePtreGhUArvpx0XAz+rx5VdjoM77hXi8FCMDf2/ardRTK9E2Q7oD6gqIaHC7CrYMAE3oms0MOGM7DH95JYTlTuk4yTqvmJ4AxUmUsxrd3Mo5PSxVQ2+4Qx/so7dwXO0O0RGmyrN1fGXbYT6Y+pf4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519539; c=relaxed/simple; bh=qSesX2ZDGhaCZrzr8oezoBtstChG//vMkmqR9KwS7d0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iVmU8UketKnpqW3uTCXGgKhFpXP/e5YIIx23ugRK6GBO6BRG56FgiarPyVAtZ5FpF64DfAUuwZx5U61X+bekE9473j2nU+bfoVaJ/oOzLCQDN5KY4Kfxe9gNiM1Ae5eUdigb+2gvFSj+I2/a4aTa2o5Fu2Jt5uAb4zfRR5//WQM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=B3Z7CTYk; arc=none smtp.client-ip=209.85.167.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-lf1-f45.google.com with SMTP id 2adb3069b0e04-5a865d1547aso5116305e87.1 for ; Mon, 11 May 2026 10:12:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778519536; x=1779124336; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=s42sCXaEIYI2iT8o/2WjdzJavucMWxgVZFV2JYX3rF8=; b=B3Z7CTYkzhVrE8BFrYHdgAuTwy8+BSwTgCdNwDAfmzo8EXhxjIAgXs8heTkI5T2raS TQaEFInqh9FahsI1g7U3aB/jL4gUv/xrVjQMv5nsoCrXTLpZVD5eSAC9lL/J3mUX9PyT hFfYKo2v0iNElKbmOuNwpfKFAY3gOviwbY4fI7fjR4T8ApYPtfHrqN7VP2MYVM1F412+ DSRkSFQBf32CuOSehHZOI8BV8bgoo5u/Ts3IAtzXcn4MsRElr64VpoQMvzeo/eKw0cIN u8lggt16MyrS6MByq+igliPCH51xBw3Q0oijlnrEA/T5RzE4sHpsfkMwT/ySShxLSe0x airw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778519536; x=1779124336; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=s42sCXaEIYI2iT8o/2WjdzJavucMWxgVZFV2JYX3rF8=; b=IoMdhBGbpH5Es9zMlt7d46/+yuG3yKDRFNHbcv2N58a4K1A0fYq9xMWjjONBAuiKSa DrfRGKcRQXqdlOWH1L5dy4MKzIdIeLbZYK4+KTh8Gmeoty9+PxRkjv4QRC5/SPHvX/lm bDTmM7UJHZmFX3UemAjyXU/wuXmVDpI3Almjr+9QJF+wLyaUWH6FgFllv9nMWKIS3G/9 pANZBbXE1gP95MJB0XuKhbgJa4MAHsIUrO44vqIQbXH6lc0NdhZlsTFE67FSrlIYgpcL 2V0RSuRONRuYEUM3LODMDpHAsHXPvQVlnAUK9CNxr4CqVRpeE8MF/HPxsbkPqj0iKEdc Gljw== X-Forwarded-Encrypted: i=1; AFNElJ8Y1rUXrt/jIXgRw+BgrqxtC6VcdkyggFWn6nGwdpRDKsYWOb0HDD8SODBRQoHyUThKjttg2WP1XqBMNw==@lists.linux.dev X-Gm-Message-State: AOJu0YxsEOTR4LYqFwZhsJBLqzg99Mvg5dVSm/Wre4O5KcY4Ov6UkxZH 4Rwf+60MyebQAkL3+ZmnqRytWJsSyFlGm/UDAwGnB1wfLWKVjUDEq/Ga X-Gm-Gg: Acq92OH3bgOo7FtszLAO4HOcCmkIwe9RUHoh6mHzl76zVAkzJEApyYg3xD5mvQ0EimB 0aZG3NKyh58AIYZpmlPqCUdvtPWCsxn/Dhcr54IHrJYKbdfG67XviGLZFwHEUpReF3bV3rJFRjo omxm3TekBLWXbJsEjs1OBt9Wf2T+THuGbn49Y9ZnXfWRktRPCyfkwDx8dZn5q1PV9jfeyunNKrD 7vbEwgMvnzaUM8f5p/mwxzdp8ksEwvR0U/TeRyVc4FknAjAnCCAzElHFcwHaGQCyc0Tjm1i10Ln i5HlWd1q5WFYktU5vOh0WHVVOdFe0v7c359B9pTY+GsLVsG7J6yVMwsgxMVnH/OUfLUU53hr3S8 vEo71Bsy1rtu3N1yqGGcBJA1NVhVcVFUls3eWnBvpZ29jlJVZ0WCPAJH4n3cSYZSRvhYpyDgU8I S1/jLKO5it8p1YIYMtRnJOZClLoXuXdOf5O3XQv6d1M/QzEyLifg+PYTFxRPnfBedlEQoFYoQ= X-Received: by 2002:a05:6512:a8c:b0:5a8:99dd:1648 with SMTP id 2adb3069b0e04-5a8e0c8c320mr110927e87.0.1778519535453; Mon, 11 May 2026 10:12:15 -0700 (PDT) Received: from va-HP-Pavilion-Desktop-595-p0xxx.mshome.net ([193.0.150.248]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5a8a95660b6sm2765488e87.62.2026.05.11.10.12.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 May 2026 10:12:15 -0700 (PDT) From: Valery Borovsky To: linux-media@vger.kernel.org Cc: mchehab@kernel.org, hverkuil@kernel.org, hansg@kernel.org, hugues.fruchet@foss.st.com, alain.volmat@foss.st.com, mcoquelin.stm32@gmail.com, alexandre.torgue@foss.st.com, sakari.ailus@linux.intel.com, mripard@kernel.org, wens@kernel.org, jernej.skrabec@gmail.com, samuel@sholland.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, Valery Borovsky , stable@vger.kernel.org Subject: [PATCH 1/6] media: airspy: Return queued buffers on start_streaming() failure Date: Mon, 11 May 2026 20:12:06 +0300 Message-ID: <649601988189f031670215cb35add5e80439559d.1778518085.git.vebohr@gmail.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. airspy_start_streaming() returned -ENODEV early when the USB device had been disconnected (s->udev == NULL) without returning any buffers that buf_queue() had already accepted. Take v4l2_lock first and jump to the existing err_clear_bit label, which already drains s->queued_bufs via vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure"). Fixes: 634fe5033951 ("[media] airspy: AirSpy SDR driver") Cc: stable@vger.kernel.org Signed-off-by: Valery Borovsky --- drivers/media/usb/airspy/airspy.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/media/usb/airspy/airspy.c b/drivers/media/usb/airspy/airspy.c index 8f6b721ba107..57edb42463e8 100644 --- a/drivers/media/usb/airspy/airspy.c +++ b/drivers/media/usb/airspy/airspy.c @@ -522,11 +522,13 @@ static int airspy_start_streaming(struct vb2_queue *vq, unsigned int count) dev_dbg(s->dev, "\n"); - if (!s->udev) - return -ENODEV; - mutex_lock(&s->v4l2_lock); + if (!s->udev) { + ret = -ENODEV; + goto err_clear_bit; + } + s->sequence = 0; set_bit(POWER_ON, &s->flags); From patchwork Mon May 11 17:12:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Valery Borovsky X-Patchwork-Id: 2217 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from tor.lore.kernel.org (tor.lore.kernel.org [172.105.105.114]) by mxe881.netcup.net (Postfix) with ESMTPS id 594531C06EA for ; Mon, 11 May 2026 19:26:09 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=gmail.com; spf=pass (sender IP is 172.105.105.114) smtp.mailfrom=linux-sunxi+bounces-23261-noreply=patchwork.local@lists.linux.dev smtp.helo=tor.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.105.105.114 as permitted sender) client-ip=172.105.105.114; envelope-from=linux-sunxi+bounces-23261-noreply=patchwork.local@lists.linux.dev; helo=tor.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id 79510312ACD1 for ; Mon, 11 May 2026 17:12:42 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 01C6A44D695; Mon, 11 May 2026 17:12:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YfCP3rEU" X-Original-To: linux-sunxi@lists.linux.dev Received: from mail-lf1-f51.google.com (mail-lf1-f51.google.com [209.85.167.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 247A944BC91 for ; Mon, 11 May 2026 17:12:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519541; cv=none; b=quotdclDFqJU7UWk5w5f0Z6O7BIkZ6b5nix8biHnXyUDXuc0wFRrnBtCeEPr6ODfwOIWJ2e8FaKK2hJL2L6kT+eS8JH1Y7mMZ4s3ArjZCd3tOCrXhgIDVoLBdKmLX40JW2oO7CHfFXMZ2/sNXx7MIsV9f8/WJa/+qCK7Gf1PDjo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519541; c=relaxed/simple; bh=4DlyG+iXICv8PFIjVe2HgIrTduPnzOhVbzvai6W3884=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ohUbcP2h/vPWpTzCAMGDb5KOudD2VzA8A3RXTyOtytjQIdRXLvR+LH+KyduIkZK3wFYxUDvP63Wy2dImwTaR4zzyRcro1iPjktFaZ5cqN3Ywhcg7EJ6xcRgdbOEOyBKwKdOcf00CSmZfXeEtwX4Yy88vYgCjvHIowkcJNo9nxDY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YfCP3rEU; arc=none smtp.client-ip=209.85.167.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-lf1-f51.google.com with SMTP id 2adb3069b0e04-5a748d5ece4so4398446e87.2 for ; Mon, 11 May 2026 10:12:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778519537; x=1779124337; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=XSIxIJUh3eL2dSuA1xrUNZiqoyBIDeeVRxEk9r/yyRo=; b=YfCP3rEUSNJ1jUNnvn3/Mv1gZqc3npy1qhoyh1RYzd/mk/gZdwuZwxs+r9yTRZV311 2Gh0fB1o/ieBlSt46bcP2jry9vdEgrsKuK/WS8V/hMCMXyJfyQJMvHuNH6W/oSmg4mAZ l8tCXpPeCyOdSzidxNp69TF9Mx2EI4H8+qu0jHdq5jSTSMu4WC4Xk65/swTvPblPO7R8 A58UiZoRi/E05dj7meZUYfqYW+ufoZ6F3dQqA3Q2eJ17Apg2yDRRsQWx0/RqSA/JqKxw ZxwYIUnvxGg4CmGcEZnOTpCJwe9P6bac+hMJGaV79SHypis/ji8+9Rw1serZJjz0VCjT Ku3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778519537; x=1779124337; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=XSIxIJUh3eL2dSuA1xrUNZiqoyBIDeeVRxEk9r/yyRo=; b=RLu6pm+HQYJrQjTjSKFlNed0eGLGmZcTxLBrWgntT1/mW4eI6J9k+8IgO8ROjL4AzN jec4mHwULCQg1hBPGJW3+mVYjLDRJDLvWRkxzpFpeJPaGzoNlXrYT9oVRagfGWt+Nf1r pyUw0f9jW0ceBlYwqo66OZbIDJ+8QrZt+NrKbzd896tUMM/dH/gbIdqf3brSOyTF1c40 8xfGosV5O9ZflF0SkGImdW9LxURUwHx2De6cNLjFHDfHTwSm9C7WIogdqhDBa0vK+efH 5eMt2CZBDrajQhedeA7NFzlh3rz/DP4szNrax1Mujzk/QXsWA8UmMkUScls3XeWZ1iZV e+GQ== X-Forwarded-Encrypted: i=1; AFNElJ8VGWifSLtzK0BHz2B+v44mDsUsCdlm/W6h1L5kRUMKnNjrPvYrUxLNgT6Iv/miQdXWNdFoXbZUXC2XvQ==@lists.linux.dev X-Gm-Message-State: AOJu0Yzxg9pTvfReuKeDwJbEQjZc0so/dg2TMjvjJWmlev9ar65bxGUY Tn1Z1baaEH5DUWEpuJssXissShCVLlDPnU8BntPP0w7fw5/qDBf5HrQY X-Gm-Gg: Acq92OGYzD7ukaWSDK7u8uD8Fa/5Mhr7DGU+lVRamKrcR126mwY881avFnFECOGJqES 6uBLQqWwm/Q9/DPheCNM4c8msYCxvQHW/fRXlSz5he9mmOu6qYp587QK9gBFa7/4f44ZmaO44ZQ Ygg2+pa8cDtuBxozEelF3ToUdkq8P3BYhfS3lOaOPScGEBEqV0eQSaNqcWRTNrxWpyse+TZn4gl SUOoGuRO7RiavdsFmXeocz78bkgsWvDHDLPx9oUqYA8X6kdmoJjdFhQZnr0rfX09yP34D7LnzMq U194tG4raDWohfClxcKPbn8w08cM7VsPfH5x1cqltxhThJbsy2U1EcXIWXYOEV328rjJqotUq9t QXmU9GlshlsKTzwvNjUi3Fv36vh/EUYUGJYuST4HlQMZipyd+9cevN3Mo6fxk8MAcW6bXHZuzKG SF3ywf7I9o002HByXFO+Ltu75fCvZBmLhjQgCNSkulndEoldWkINZh7VKeUGdw X-Received: by 2002:a05:6512:3ca1:b0:5a8:7be1:24c8 with SMTP id 2adb3069b0e04-5a887ceaa65mr9581194e87.37.1778519537055; Mon, 11 May 2026 10:12:17 -0700 (PDT) Received: from va-HP-Pavilion-Desktop-595-p0xxx.mshome.net ([193.0.150.248]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5a8a95660b6sm2765488e87.62.2026.05.11.10.12.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 May 2026 10:12:16 -0700 (PDT) From: Valery Borovsky To: linux-media@vger.kernel.org Cc: mchehab@kernel.org, hverkuil@kernel.org, hansg@kernel.org, hugues.fruchet@foss.st.com, alain.volmat@foss.st.com, mcoquelin.stm32@gmail.com, alexandre.torgue@foss.st.com, sakari.ailus@linux.intel.com, mripard@kernel.org, wens@kernel.org, jernej.skrabec@gmail.com, samuel@sholland.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, Valery Borovsky , stable@vger.kernel.org Subject: [PATCH 2/6] media: msi2500: Return queued buffers on start_streaming() failure Date: Mon, 11 May 2026 20:12:07 +0300 Message-ID: X-Mailer: git-send-email 2.51.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. msi2500_start_streaming() had five error paths that all hit this trap and were further tangled by ret-overwriting between calls: - -ENODEV when the USB device was already disconnected - -ERESTARTSYS when mutex_lock_interruptible() was interrupted - msi2500_set_usb_adc() failure: ret was silently overwritten by the next call (msi2500_isoc_init), so the error was lost entirely - msi2500_isoc_init() failure: cleanup_queued_bufs was called, but the function then fell through to msi2500_ctrl_msg() and again masked the original error by overwriting ret - msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all, leaving isoc URBs submitted with no way for the driver to consume them Consolidate the error paths into a small goto chain. Every failure now stops the function, drains the queued-buffer list, and returns the real error code. The ctrl_msg failure path also rolls back the preceding msi2500_isoc_init() via msi2500_isoc_cleanup() before unlocking and draining. The cleanup helper takes a vb2_buffer_state argument so that the start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as expected by userspace on start_streaming failure) while stop_streaming keeps its existing VB2_BUF_STATE_ERROR semantics. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure"). Fixes: 977e444f59ad ("[media] Mirics MSi3101 SDR Dongle driver") Cc: stable@vger.kernel.org Signed-off-by: Valery Borovsky --- drivers/media/usb/msi2500/msi2500.c | 32 +++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/drivers/media/usb/msi2500/msi2500.c b/drivers/media/usb/msi2500/msi2500.c index 1ff98956b680..0614087c3c3c 100644 --- a/drivers/media/usb/msi2500/msi2500.c +++ b/drivers/media/usb/msi2500/msi2500.c @@ -541,7 +541,8 @@ static int msi2500_isoc_init(struct msi2500_dev *dev) } /* Must be called with vb_queue_lock hold */ -static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev) +static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev, + enum vb2_buffer_state state) { unsigned long flags; @@ -554,7 +555,7 @@ static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev) buf = list_entry(dev->queued_bufs.next, struct msi2500_frame_buf, list); list_del(&buf->list); - vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + vb2_buffer_done(&buf->vb.vb2_buf, state); } spin_unlock_irqrestore(&dev->queued_bufs_lock, flags); } @@ -830,25 +831,40 @@ static int msi2500_start_streaming(struct vb2_queue *vq, unsigned int count) dev_dbg(dev->dev, "\n"); - if (!dev->udev) - return -ENODEV; + if (!dev->udev) { + ret = -ENODEV; + goto err_cleanup; + } - if (mutex_lock_interruptible(&dev->v4l2_lock)) - return -ERESTARTSYS; + if (mutex_lock_interruptible(&dev->v4l2_lock)) { + ret = -ERESTARTSYS; + goto err_cleanup; + } /* wake-up tuner */ v4l2_subdev_call(dev->v4l2_subdev, core, s_power, 1); ret = msi2500_set_usb_adc(dev); + if (ret) + goto err_unlock_cleanup; ret = msi2500_isoc_init(dev); if (ret) - msi2500_cleanup_queued_bufs(dev); + goto err_unlock_cleanup; ret = msi2500_ctrl_msg(dev, CMD_START_STREAMING, 0); + if (ret) + goto err_isoc_cleanup; mutex_unlock(&dev->v4l2_lock); + return 0; +err_isoc_cleanup: + msi2500_isoc_cleanup(dev); +err_unlock_cleanup: + mutex_unlock(&dev->v4l2_lock); +err_cleanup: + msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_QUEUED); return ret; } @@ -863,7 +879,7 @@ static void msi2500_stop_streaming(struct vb2_queue *vq) if (dev->udev) msi2500_isoc_cleanup(dev); - msi2500_cleanup_queued_bufs(dev); + msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_ERROR); /* according to tests, at least 700us delay is required */ msleep(20); From patchwork Mon May 11 17:12:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Valery Borovsky X-Patchwork-Id: 2213 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from sto.lore.kernel.org (sto.lore.kernel.org [172.232.135.74]) by mxe881.netcup.net (Postfix) with ESMTPS id 3F6C61C024C for ; Mon, 11 May 2026 19:13:37 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=gmail.com; spf=pass (sender IP is 172.232.135.74) smtp.mailfrom=linux-sunxi+bounces-23262-noreply=patchwork.local@lists.linux.dev smtp.helo=sto.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.232.135.74 as permitted sender) client-ip=172.232.135.74; envelope-from=linux-sunxi+bounces-23262-noreply=patchwork.local@lists.linux.dev; helo=sto.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sto.lore.kernel.org (Postfix) with ESMTP id 312B430229C3 for ; Mon, 11 May 2026 17:12:52 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 7384045348D; Mon, 11 May 2026 17:12:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="sXmiNaWJ" X-Original-To: linux-sunxi@lists.linux.dev Received: from mail-lf1-f48.google.com (mail-lf1-f48.google.com [209.85.167.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 86219441036 for ; Mon, 11 May 2026 17:12:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519543; cv=none; b=bVLIia7d14wBe52XwkttFlSoUftEG1tm6zKFcerDweyqTwP7Yh0L+b5vSP8lNC6e8JBiza/OWlVv5Wbpv46l5hVN4krWc4XtYdgciFO2XJD1noZGi2332I36amjgLQgrOOGJNA8tf8FPlVD7yxJ3O5X3vkF15JFcri08b31qtRI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519543; c=relaxed/simple; bh=Pm0arqbEMJSuzVfu2XbHYEXxhnKaEaOHkvubnY5Jb24=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PwVP/SFlSbq/7mPV2JIXKoCT+WwbKvuz29PZ7X9xjBMIUav6wjmW9NLSNELXhcIPOe8VKuVrvlxErtzX6HOrKatcSqTps/UBt8+xECI+nUjmFO7aJduQVPDJQE01MFmHLMUSDtiouCI7Ae7Cjn5PT1xOCbLMzvmGy3U5IOhFzzA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=sXmiNaWJ; arc=none smtp.client-ip=209.85.167.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-lf1-f48.google.com with SMTP id 2adb3069b0e04-5a887ebb416so4275852e87.2 for ; Mon, 11 May 2026 10:12:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778519540; x=1779124340; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=JH+u+xhzUiMSlilufXXl7nt5EV8IiDoOquYIB5049q8=; b=sXmiNaWJvQJ83LigbdfhczvdMhPK9fyDTsK8kzkpFOm8LjMs4gjnj+m0EraoRZub3b ETrN3ox6a7hCuzpzC++7tST7Lu8e8Fo2cAU49JCm1CVlwH77/5vKjxfTFbmr4MPHs7BX GsE/iC4pRAb/90RCtTIdHsz6xSl50vDQdYeX48P0aSOAv77BkJd1hmcN11Z2CBoAGpky sJveFxP8ziwS7uRyuQaVy5/la1fINiOWEiUMQDxVx65YO3+H/I4BuCNTFwcqzEGJ8dEn XJhYLPZztPf1ZtAVnWl630hThTO1CnEVr2iOjRKkyWe1L3JMKXjcjFGAxXUJTZTm5IZs p6bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778519540; x=1779124340; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=JH+u+xhzUiMSlilufXXl7nt5EV8IiDoOquYIB5049q8=; b=FKFIMx4YwuzWgbpRYM9cvvyD5vD2HwxAtIkTJ/jGp1NRWROiLsvhjDUmMOxtCmbjP6 xgnDDx/sozTAdYi/TSR2mtp8JP5myFxBnTkG881lEI6PMro4h2tPD8PoyU720V8kvoqv Mvyae2KkBD7M6fi/SCuV0TXQ4/Z6CrdANBTiMoOM5WYV7w2hD3pwzdoyPA05vtoZ1+61 BIKRHtkhOxMwkm4Vjlf46Rz+c2+1jo9KK4IkarKipdfVhnY2zWRgYMKtPjBHk+MwqVsj oIsy9hzfcmHQ1yzGgY7IJeKKfasgXYjuqBSzzuYaF+ZzH9UXDno6NUeGiZkSBQ5PP0WZ /OJA== X-Forwarded-Encrypted: i=1; AFNElJ9vhUE+jw79TRp481rnZ5WB727Rdb/HEXTvlz75gDwiiP9WSGrcxL6yll0L4jcA8fjokm0/aHIYnBg0WA==@lists.linux.dev X-Gm-Message-State: AOJu0YywB5YSiPfJDpodc1Hkd69bS+f1kioRLW4VrYXVKUTTQk0MGoL9 LNTkWQCiKOgWfXub6aNEmgFLYrPHyJTI88rvGsd8FTg8OPFKg4I03anv X-Gm-Gg: Acq92OFQnmwiCp8h7aliRCnmcX6tbD4//PKcFHZQhew+6kFW/2EwesR62vvcaizoVpi Ty1aTbrLigGDoWHtFfI1TQz/Dhv1KMSzGVmcaHmHzDs1M/m1yfINT0MHvFuHDpCV85VysmdlV9D 2fDPuHXxsIhSStYpkJiDLYjwUSDIAoqHtT0CWzVTuevlL9sFAd+qY7sM+6o9lAbX9TO+Ns2wtsV iww0luZeyXM40uyyPeFSnFrJ/vgQM3451ge1zP1PXTkb4SrQGuD/Re4Ic0rbyW+zTulLOg8l5lm By7N1ZYCJaOI3dbZ60bI7lJ032uUbYy80T2cPpEobe3YjB+ZFTXwvTVfdbqq9RxicsvaZlgatqS mAz9B6dBqr0L6eyK5SaFKY7OPuiFp0KO7sYjA8rDqXY/OQmqxOhDFTGdVOI5RVF18NXT5auCkvi g1/WGTYS3Xt6ECqQNmpoGV8/7x/9e+JEjxprOrVX6cdOtTlpHaOB9XleSaQQHCK/KOTmi5zV4= X-Received: by 2002:a05:6512:3e16:b0:5a3:ff5a:d83 with SMTP id 2adb3069b0e04-5a887ae3618mr10520299e87.16.1778519539315; Mon, 11 May 2026 10:12:19 -0700 (PDT) Received: from va-HP-Pavilion-Desktop-595-p0xxx.mshome.net ([193.0.150.248]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5a8a95660b6sm2765488e87.62.2026.05.11.10.12.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 May 2026 10:12:18 -0700 (PDT) From: Valery Borovsky To: linux-media@vger.kernel.org Cc: mchehab@kernel.org, hverkuil@kernel.org, hansg@kernel.org, hugues.fruchet@foss.st.com, alain.volmat@foss.st.com, mcoquelin.stm32@gmail.com, alexandre.torgue@foss.st.com, sakari.ailus@linux.intel.com, mripard@kernel.org, wens@kernel.org, jernej.skrabec@gmail.com, samuel@sholland.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, Valery Borovsky , stable@vger.kernel.org Subject: [PATCH 3/6] media: pwc: Return queued buffers on start_streaming() failure Date: Mon, 11 May 2026 20:12:08 +0300 Message-ID: X-Mailer: git-send-email 2.51.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Rspamd-Server: rspamd-worker-8404 X-Spamd-Result: default: False [0.34 / 15.00]; BAYES_HAM(-5.50)[100.00%]; RBL_SENDERSCORE(2.00)[172.232.135.74:from]; SUSPICIOUS_RECIPS(1.50)[]; MID_CONTAINS_FROM(1.00)[]; DMARC_POLICY_SOFTFAIL(1.00)[gmail.com : SPF not aligned (relaxed), No valid DKIM,none]; R_MISSING_CHARSET(0.50)[]; MAILLIST(-0.15)[generic]; MIME_GOOD(-0.10)[text/plain]; BAD_REP_POLICIES(0.10)[]; HAS_LIST_UNSUB(-0.01)[]; RCPT_COUNT_TWELVE(0.00)[19]; FREEMAIL_FROM(0.00)[gmail.com]; FUZZY_BLOCKED(0.00)[rspamd.com]; FORGED_SENDER_MAILLIST(0.00)[]; DBL_BLOCKED_OPENRESOLVER(0.00)[sto.lore.kernel.org:rdns,sto.lore.kernel.org:helo]; FREEMAIL_CC(0.00)[kernel.org,foss.st.com,gmail.com,linux.intel.com,sholland.org,st-md-mailman.stormreply.com,lists.infradead.org,lists.linux.dev,vger.kernel.org]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(0.00)[+ip4:172.232.135.74]; TAGGED_RCPT(0.00)[]; FROM_HAS_DN(0.00)[]; RCVD_TLS_LAST(0.00)[]; MIME_TRACE(0.00)[0:+]; FORGED_RECIPIENTS_MAILLIST(0.00)[]; PRECEDENCE_BULK(0.00)[]; ASN(0.00)[asn:63949, ipnet:172.232.128.0/19, country:SG]; ARC_ALLOW(0.00)[subspace.kernel.org:s=arc-20240116:i=1]; TAGGED_FROM(0.00)[bounces-23262-noreply=patchwork.local]; RCVD_COUNT_FIVE(0.00)[6]; FROM_NEQ_ENVFROM(0.00)[vebohr@gmail.com,linux-sunxi@lists.linux.dev]; RCVD_VIA_SMTP_AUTH(0.00)[] X-Rspamd-Queue-Id: 3F6C61C024C X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. pwc's start_streaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal. Call the existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED before returning (matching the state already used by the pwc_isoc_init() error path in the same function). This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure"). Fixes: ceede9fa8939 ("[media] pwc: Fix locking") Cc: stable@vger.kernel.org Signed-off-by: Valery Borovsky --- drivers/media/usb/pwc/pwc-if.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c index c416e2fc5754..59b99ac8fcb6 100644 --- a/drivers/media/usb/pwc/pwc-if.c +++ b/drivers/media/usb/pwc/pwc-if.c @@ -710,11 +710,15 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count) struct pwc_device *pdev = vb2_get_drv_priv(vq); int r; - if (!pdev->udev) + if (!pdev->udev) { + pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED); return -ENODEV; + } - if (mutex_lock_interruptible(&pdev->v4l2_lock)) + if (mutex_lock_interruptible(&pdev->v4l2_lock)) { + pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED); return -ERESTARTSYS; + } /* Turn on camera and set LEDS on */ pwc_camera_power(pdev, 1); pwc_set_leds(pdev, leds[0], leds[1]); From patchwork Mon May 11 17:12:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Valery Borovsky X-Patchwork-Id: 2214 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from sto.lore.kernel.org (sto.lore.kernel.org [172.232.135.74]) by mxe881.netcup.net (Postfix) with ESMTPS id 1C1561C06EA for ; Mon, 11 May 2026 19:14:17 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=gmail.com; spf=pass (sender IP is 172.232.135.74) smtp.mailfrom=linux-sunxi+bounces-23263-noreply=patchwork.local@lists.linux.dev smtp.helo=sto.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.232.135.74 as permitted sender) client-ip=172.232.135.74; envelope-from=linux-sunxi+bounces-23263-noreply=patchwork.local@lists.linux.dev; helo=sto.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sto.lore.kernel.org (Postfix) with ESMTP id 226C33028634 for ; Mon, 11 May 2026 17:13:10 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 6F3A7466B68; Mon, 11 May 2026 17:12:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="j8ifwhHq" X-Original-To: linux-sunxi@lists.linux.dev Received: from mail-lf1-f47.google.com (mail-lf1-f47.google.com [209.85.167.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 70EEE45348A for ; Mon, 11 May 2026 17:12:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519545; cv=none; b=uyCtQozyZzoBkLuJk4Wi448r4DimQ0iV1+B7NAUnmF9p046yKJn4jfzr6uqL8bh0xhYketauV73723YV6Ms0KIlw84WYq3gpH7ZjEjYKc9/EOKNwvlZXm4+Vu0iPY6A3IwhRLloQA3jJT71JEI+hOTuH14sajj6NURuBtEqctQ4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519545; c=relaxed/simple; bh=Uc/exHc2g0MJR9S71NefJro1J1WlH0FhS5OXlnyqzIU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lXI8i3w+/fjI3Pl931hX09OOfEawnZyqZh3o/kMzFGqSkXtQq6cu6DEiElol0kM7dkYIj5c6pnhm5i4WAyUnr5FxyrvlrSkHJF8qC2CsKzVgEubuTpACSKAiodeff3JT7zmMRNHtS2mrKltfFbuqb6JYWct9pWgAbBfKFcVwjCU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=j8ifwhHq; arc=none smtp.client-ip=209.85.167.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-lf1-f47.google.com with SMTP id 2adb3069b0e04-5a40b2bc96dso4164506e87.3 for ; Mon, 11 May 2026 10:12:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778519542; x=1779124342; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=TypizH+0naDcsiSshXyXpAX6OorxUGA4/sCVC58lq0U=; b=j8ifwhHq23bdoE5LnTN97BD2MLZcVCXgiBM/OMNMSK3jGZhOo07kxq2xWTCQXLsjIq S9/Yqw0kfH31Zk3225WqZyY3ilZQ1vPCODLsYJudAgbGyhmWFgIjTqbW+y4rPd80S0e0 +XFaz9P6yhI2QuIKCaywoby1v7Yfp+cDql3IKgLirZd+dBtEk57TnsQRA2hqsvTfRXny H0SeSDTrbZtUX07Lit9lubxZsxZaAVw53dcKuTOc8jmlkdqofZcPLxdP59LuHhCq6SHq ze0/4Q4kD/lyNOYxWwjW6X7EoY4Cx8lFHTonhenXu8C7/3INswLIYEgwQWTQXTUt7vj0 Q/ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778519542; x=1779124342; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=TypizH+0naDcsiSshXyXpAX6OorxUGA4/sCVC58lq0U=; b=FB2GCB3WWzwH6ITM/QeCLFJCooZCU1PKpRsvMsJONC5gkiN/tuI898ICJP2PAGEipr PBR+3iirasri0pkRecoJP7X7irYCtujq/wZC2m8RtFoxtlEnihKz51tDempZbRCdaFVS mqSDKm++A1KG6pWPehgLlt9kPPsk6uxTSFlV0OQIToDVACe8U1vNCVbWP3xUxk7P9HqQ yRvor+Xa7Tup4N9GniB/kouohHBiJfGgGWqpY5FE7HZigaLyTA2vyrVuCyOuDc5DiGDZ Q7sNppLsArz0UOMtlKXoTEtjX2q4O0/EXIzBvp0hjFAkFEurhnfr4Y2HkHuPpXBEjFb1 rcGg== X-Forwarded-Encrypted: i=1; AFNElJ/8IBiT9g3mgcGh9eCxNUIUD8rn1S023KVP0uY+4CkylZBFCIlJ46FWkcBkksG9EYyyEHCTF6Lv68HJrQ==@lists.linux.dev X-Gm-Message-State: AOJu0YxbexuYentVimr6zqhRLapZ402hScJxbQpckoj4HyTxjT6GXlAc r+UQBqUddPot13oWzND6WGfy5wum5SR5jQ3gFK9jkHlBKN0wK6Z9eKmN X-Gm-Gg: Acq92OH6rOfPzqw+T0DE1PQDmkBEr8erPZwQpF0RG1r+dfcQTA/mDZeVowKBwYo5sNN CtwwED1Jn07tOtpJBQ4TSYZnONSriZjHZQLzYEOX66e+bNeYZIbCEG9NDZEPXyDEM/Cw04sYbhX ICmCUPb7BrxxB+/O8Fh0YvxogKg+qx4XofP17bGC5UOe7atUke6WkUw7v9CuJM1TFgEIaws/dc+ +VwqUFEa5ZCMYYuzCWg+Pd2/WPMznrJqmDyIvwww4WJtjZ/+zlWG++XmahNZZ1BCHa1Fq9CvtQ3 d76y+Q5e+QhSrB0OpDYf3XJ4p2XDk99kgMQl13LO7c/mTYdlVmdTmsOAO1DK5mHHYI5H2KsJKM/ b/JpcYANYB56Eoq1JYv1dUpHazosKH520OGcHpOUeHiz/sZqLNOSX4EKVfzCGlm4vl1bh2d6x7m Nlu8t2lwIUURRWxmpVtd4doLWFszmWa0qcR1Cq6/BW+7izBtrWo2s5hoOPbtpNpVLmN37Fucc= X-Received: by 2002:a05:6512:b20:b0:5a3:fe60:471c with SMTP id 2adb3069b0e04-5a8a94a8fcfmr4465968e87.16.1778519541397; Mon, 11 May 2026 10:12:21 -0700 (PDT) Received: from va-HP-Pavilion-Desktop-595-p0xxx.mshome.net ([193.0.150.248]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5a8a95660b6sm2765488e87.62.2026.05.11.10.12.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 May 2026 10:12:20 -0700 (PDT) From: Valery Borovsky To: linux-media@vger.kernel.org Cc: mchehab@kernel.org, hverkuil@kernel.org, hansg@kernel.org, hugues.fruchet@foss.st.com, alain.volmat@foss.st.com, mcoquelin.stm32@gmail.com, alexandre.torgue@foss.st.com, sakari.ailus@linux.intel.com, mripard@kernel.org, wens@kernel.org, jernej.skrabec@gmail.com, samuel@sholland.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, Valery Borovsky , stable@vger.kernel.org Subject: [PATCH 4/6] media: rtl2832_sdr: Return queued buffers on start_streaming() failure Date: Mon, 11 May 2026 20:12:09 +0300 Message-ID: X-Mailer: git-send-email 2.51.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. rtl2832_sdr_start_streaming() had multiple error paths that hit this trap: two direct early returns (-ENODEV, -ERESTARTSYS), plus six `goto err` paths covering subdev s_power, tuner setup, ADC setup, stream-buffer allocation, urb allocation, and urb submission failures. None of them returned the queued buffers. The original function had no distinct success exit and fell straight through into the err label, which previously only did mutex_unlock and "return ret". Adding queued-buffer cleanup at err must therefore be paired with an explicit success return; otherwise every successful start would also drain the buffer queue and kill streaming. Add that success return, then add rtl2832_sdr_cleanup_queued_bufs() at the err label and before each early return. The cleanup helper takes a vb2_buffer_state argument so that the start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as expected by userspace on start_streaming failure) while stop_streaming keeps its existing VB2_BUF_STATE_ERROR semantics. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure"). The err label still does not roll back power_ctrl(), frontend_ctrl(), the POWER_ON flag, or stream/URB allocations that may have happened before the failing step. Those are pre-existing leaks of a different class and are not addressed here. Fixes: 771138920eaf ("[media] rtl2832_sdr: Realtek RTL2832 SDR driver module") Cc: stable@vger.kernel.org Signed-off-by: Valery Borovsky --- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/media/dvb-frontends/rtl2832_sdr.c b/drivers/media/dvb-frontends/rtl2832_sdr.c index 422d1a7b5456..c564485e3bbb 100644 --- a/drivers/media/dvb-frontends/rtl2832_sdr.c +++ b/drivers/media/dvb-frontends/rtl2832_sdr.c @@ -399,7 +399,8 @@ static int rtl2832_sdr_alloc_urbs(struct rtl2832_sdr_dev *dev) } /* Must be called with vb_queue_lock hold */ -static void rtl2832_sdr_cleanup_queued_bufs(struct rtl2832_sdr_dev *dev) +static void rtl2832_sdr_cleanup_queued_bufs(struct rtl2832_sdr_dev *dev, + enum vb2_buffer_state state) { struct platform_device *pdev = dev->pdev; unsigned long flags; @@ -413,7 +414,7 @@ static void rtl2832_sdr_cleanup_queued_bufs(struct rtl2832_sdr_dev *dev) buf = list_entry(dev->queued_bufs.next, struct rtl2832_sdr_frame_buf, list); list_del(&buf->list); - vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + vb2_buffer_done(&buf->vb.vb2_buf, state); } spin_unlock_irqrestore(&dev->queued_bufs_lock, flags); } @@ -855,11 +856,15 @@ static int rtl2832_sdr_start_streaming(struct vb2_queue *vq, unsigned int count) dev_dbg(&pdev->dev, "\n"); - if (!dev->udev) + if (!dev->udev) { + rtl2832_sdr_cleanup_queued_bufs(dev, VB2_BUF_STATE_QUEUED); return -ENODEV; + } - if (mutex_lock_interruptible(&dev->v4l2_lock)) + if (mutex_lock_interruptible(&dev->v4l2_lock)) { + rtl2832_sdr_cleanup_queued_bufs(dev, VB2_BUF_STATE_QUEUED); return -ERESTARTSYS; + } if (d->props->power_ctrl) d->props->power_ctrl(d, 1); @@ -900,7 +905,11 @@ static int rtl2832_sdr_start_streaming(struct vb2_queue *vq, unsigned int count) if (ret) goto err; + mutex_unlock(&dev->v4l2_lock); + return 0; + err: + rtl2832_sdr_cleanup_queued_bufs(dev, VB2_BUF_STATE_QUEUED); mutex_unlock(&dev->v4l2_lock); return ret; @@ -920,7 +929,7 @@ static void rtl2832_sdr_stop_streaming(struct vb2_queue *vq) rtl2832_sdr_kill_urbs(dev); rtl2832_sdr_free_urbs(dev); rtl2832_sdr_free_stream_bufs(dev); - rtl2832_sdr_cleanup_queued_bufs(dev); + rtl2832_sdr_cleanup_queued_bufs(dev, VB2_BUF_STATE_ERROR); rtl2832_sdr_unset_adc(dev); /* sleep tuner */ From patchwork Mon May 11 17:12:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Valery Borovsky X-Patchwork-Id: 2216 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from tor.lore.kernel.org (tor.lore.kernel.org [172.105.105.114]) by mxe881.netcup.net (Postfix) with ESMTPS id E9C861C06A8 for ; Mon, 11 May 2026 19:24:55 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=gmail.com; spf=pass (sender IP is 172.105.105.114) smtp.mailfrom=linux-sunxi+bounces-23264-noreply=patchwork.local@lists.linux.dev smtp.helo=tor.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.105.105.114 as permitted sender) client-ip=172.105.105.114; envelope-from=linux-sunxi+bounces-23264-noreply=patchwork.local@lists.linux.dev; helo=tor.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id E6D3C3117BE0 for ; Mon, 11 May 2026 17:13:22 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 26ADE46AEFC; Mon, 11 May 2026 17:12:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JI4BQ0p4" X-Original-To: linux-sunxi@lists.linux.dev Received: from mail-lf1-f46.google.com (mail-lf1-f46.google.com [209.85.167.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5571444B687 for ; Mon, 11 May 2026 17:12:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519548; cv=none; b=RedsDFAq2dNPKBSFiKbm9r7g3cw2MytVBWEHfr5Ctfb/QZCpo7SAhfzYxpr6HrRQGoCwwE+K0nSuNWmsxYyxlyXCe7t3coZsefrp3PTLNQ9koo+MGInXNwcRtE+G95+UuvBJExxKTgAAQaNIfWIyDWrcC4X3gpFy+C9TTsf0RxU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519548; c=relaxed/simple; bh=EB/e87XuFCPUJ72NiJ6scGbM1z6scuWykz1rqgsY/mQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fJjiWljXFUGehnEGXlqjWgH13CUCo/FLgBlTEfbfAJ0i+ijntEi1tuyDYbqJ1AdFFFJic0otQzVUERvb2mqS+n47yDrQZVUaQZIhW2WxMAouEkVfd4qpDkWVbVHso7i6C+ixVCKIF7+o673tjWinM+C6ybTm8SDJ6d9JfGesDdM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JI4BQ0p4; arc=none smtp.client-ip=209.85.167.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-lf1-f46.google.com with SMTP id 2adb3069b0e04-5a865d1547aso5116407e87.1 for ; Mon, 11 May 2026 10:12:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778519544; x=1779124344; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=fxqdxYVfNyLoxNKHswDJZT0z/g1AEcUqUWKcspgGBc8=; b=JI4BQ0p4tJ9YR4hpCJ8Rk6jZbcjfGwA4Kd2wnLyMiY55VmU7PxlQmTQQxlOqDtlD/r WvDFS+Yfb9iterbha49s5x3f+m2TCKCZ4hxqc3QzdjaM5x8syzTl/Bmqr6sEImoxp2kh aLXP1g5xfy4dmRLnsTncD5RCVc5X13pq6TlHKFIKMt9VRhGWmzwS+arIvKhVwfYwZ32J Qsbbit3mQstKU5YgKfDb/mwMw9eY89SXCIaLXhkyp/RjVSof+PueSydg+0WA7eZKBmE0 +iKyb4y/2ZBo1Bdl/Wgkte3x5/t1/9okElVH5103Sd6UQ4x21QLblc0ACME9LrxktYSm MkLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778519544; x=1779124344; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=fxqdxYVfNyLoxNKHswDJZT0z/g1AEcUqUWKcspgGBc8=; b=srOoxJUKw7toNXUb8XHsUupArqa68xVPD1gWAtbhVVxtbszmNITcibEVL1/RI11I5y dczOQHejumcjWhgHatxRMXQp1mbtaLtr+6aaSQheB5UCV5hoRMcDbewpkRTFw9TD9D21 Xt0J0zyXzOt56+ojQFLl8b+DyH/fiVtW9RT9EvBMs5TiwtetgxJJL+d+46Jqblz5vkSV zdGYr1kdrlu6wkEoXVMhPzU+UDo5bUHe8HRETePsEmraL0hmCbDKWKt3sqxd2kpGDToZ R0gyISoRSHcf/Mlp76v+WU9NUzcnOi/60lgIM3zYvGMuSWEngdJ2sy/IsK67iaQpKVqz 38zQ== X-Forwarded-Encrypted: i=1; AFNElJ9EnrialZf+hPPs9AGJPPw9Q104PYrK3n969QBgj5Tg7VaeiUTHOki+6gIj1K5E82PsSU9gaDeDTp+ElQ==@lists.linux.dev X-Gm-Message-State: AOJu0Yxm9ePsYxkTxNFHhVbwcN7k3Qyr6uzYjnGRv7t30il1wTWfNavG b15WII8/O90HOXJi7isYHZUys0c1iZ0Zwhf6ZMbV1wRw7wXhszPm2/y+ X-Gm-Gg: Acq92OEvfTqETxUIR3DTo1EzWHsa6rCD7E0PxwSjL3JL0WKeABQ1ThNWxXxdnilSjU9 iYFIFiSBtPjaqjmrqaoH/T+4+3mdsqZzkBnsfOn0AuqfZGs4sct0SlcSjnTXKvV7p/+oR0J2alq 6g1t+ccTIKoYnHShNkcy18ihsQZqUgaA6rZE4BwaS/3i9lpk2WUir+cUicQZ+yjI1u7dTAvlroJ reTyuh8BPcPKGGtu+YZg6tGfd2MNH15PpslM61Jytk9qWGRxfd1WDWMHxCPmzP0s8IT7LGy9Kpw S8l2cY6GevEQSsS7ReIw4JAKc9fkqSYeG/Z4NCl6hEElo64eO4gBNSRcys3NcRIx9WrRTnfQ4CR 4x59GwCvLLITkL80851PAtzT9cYl5Y+ieFbPTuex3gIXPg72ybDZezluYut5CzB1GtP+BgM8BtT D9ZZ7POeq4xKiC7gPE9uKU1vZeyKVcD+PAFQdR0czZVbEFCVJLoGDZtQE9nBwJ X-Received: by 2002:a05:6512:2309:b0:5a2:b86b:56c2 with SMTP id 2adb3069b0e04-5a8e0f35137mr91615e87.21.1778519544242; Mon, 11 May 2026 10:12:24 -0700 (PDT) Received: from va-HP-Pavilion-Desktop-595-p0xxx.mshome.net ([193.0.150.248]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5a8a95660b6sm2765488e87.62.2026.05.11.10.12.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 May 2026 10:12:23 -0700 (PDT) From: Valery Borovsky To: linux-media@vger.kernel.org Cc: mchehab@kernel.org, hverkuil@kernel.org, hansg@kernel.org, hugues.fruchet@foss.st.com, alain.volmat@foss.st.com, mcoquelin.stm32@gmail.com, alexandre.torgue@foss.st.com, sakari.ailus@linux.intel.com, mripard@kernel.org, wens@kernel.org, jernej.skrabec@gmail.com, samuel@sholland.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, Valery Borovsky , stable@vger.kernel.org Subject: [PATCH 5/6] media: stm32-dcmipp: Return queued buffers on start_streaming() failure Date: Mon, 11 May 2026 20:12:10 +0300 Message-ID: <3b7c3d1be61bcf092484016e25e7b8add98bbe0d.1778518085.git.vebohr@gmail.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. dcmipp_bytecap_start_streaming() returned -EINVAL when the source subdevice could not be resolved from the media graph, before pm_runtime_resume_and_get() and media_pipeline_start() had been called. The remaining error paths already converge on the err_buffer_done label, which calls dcmipp_bytecap_all_buffers_done(..., VB2_BUF_STATE_QUEUED). Jump to that label directly: the intermediate err_pm_put / err_media_pipeline_stop labels are skipped, which is correct because nothing they would undo has happened yet. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure"). Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver") Cc: stable@vger.kernel.org Signed-off-by: Valery Borovsky --- .../media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c index a42f43d19f9e..f0e809458489 100644 --- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c +++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c @@ -401,8 +401,10 @@ static int dcmipp_bytecap_start_streaming(struct vb2_queue *vq, */ if (!vcap->s_subdev) { pad = media_pad_remote_pad_first(&vcap->vdev.entity.pads[0]); - if (!pad || !is_media_entity_v4l2_subdev(pad->entity)) - return -EINVAL; + if (!pad || !is_media_entity_v4l2_subdev(pad->entity)) { + ret = -EINVAL; + goto err_buffer_done; + } vcap->s_subdev = media_entity_to_v4l2_subdev(pad->entity); vcap->s_subdev_pad_nb = pad->index; } From patchwork Mon May 11 17:12:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Valery Borovsky X-Patchwork-Id: 2215 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from sto.lore.kernel.org (sto.lore.kernel.org [172.232.135.74]) by mxe881.netcup.net (Postfix) with ESMTPS id 7B32C1C024C for ; Mon, 11 May 2026 19:15:05 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=gmail.com; spf=pass (sender IP is 172.232.135.74) smtp.mailfrom=linux-sunxi+bounces-23265-noreply=patchwork.local@lists.linux.dev smtp.helo=sto.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.232.135.74 as permitted sender) client-ip=172.232.135.74; envelope-from=linux-sunxi+bounces-23265-noreply=patchwork.local@lists.linux.dev; helo=sto.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sto.lore.kernel.org (Postfix) with ESMTP id AAE5C303089D for ; Mon, 11 May 2026 17:13:34 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id C075F47276C; Mon, 11 May 2026 17:12:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XFKP808I" X-Original-To: linux-sunxi@lists.linux.dev Received: from mail-lf1-f50.google.com (mail-lf1-f50.google.com [209.85.167.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A032346AF2E for ; Mon, 11 May 2026 17:12:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519550; cv=none; b=epeXzgejkuQd/vJzFXLeSknc1ZAZ24dSUpyGmRhPbyHf35nBQThNZYTB/LanPegodM9Mtm6rKjw+R2gT2+T4Kzt+7Sl2g15NFFUAnVtJCgfag4Hln1jvMFodMWvFDp39owz7z7c6fwWgPt1UdNR3nD0W3Hh5oG/hPAHu/FmSZj4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778519550; c=relaxed/simple; bh=Gt3yIVFcMfYZ48mYTPU++4MAqYZaXfW/cae5IEUlc88=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ecPCjeTk4To48sk+3wq/ucuRIIis7skIAbVbvsC8m7uXxQd90mBjzBkR7XKIfacyTAzVscqQ+TCWi1VHErpOzsetn2bIMONk1V7yLT5MDC3bC0W8ibstaj7xyMFVaaOCKn3qdqF6NDcZfv9cxoLSMfiE05t43UahMEjGcOW00nI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XFKP808I; arc=none smtp.client-ip=209.85.167.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-lf1-f50.google.com with SMTP id 2adb3069b0e04-5a86c1fe573so4971139e87.3 for ; Mon, 11 May 2026 10:12:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778519547; x=1779124347; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=7HLgvNKbFd9dvErpzRIPe7Oy/Q20OX1O2SmZxWVb8gM=; b=XFKP808IN9pyJ4MsInVdmvrZqkkU7x1MDSrO2xwjI3NqFiPQ3K3XigHDopN4xJh/AU X6JTo0Ho3aLJEdJKYWWnSAdZT/Nd8OV7GuQgZNVRC/2YQanUoQ+jPetQfydbCrHv88rs PpVUQ2Y6uE0n3mGEYMhE1AMjG/vcLL1I31PFarhnq49I56cH4hJVYBbRWlee7wzPcySK lwmW8wLT+h+gunJ6tnwBv3Ua9u3AOu7i+UIeVxupjo0bIB3HDIX3oYfya3aoOH+AcMA4 3+4VyN/diw/URjjT9ByaCI3kgLOKuJWaSjcy+BD9UeWTCF4qkmovm6CKJMIu4SGcmToQ 1bDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778519547; x=1779124347; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=7HLgvNKbFd9dvErpzRIPe7Oy/Q20OX1O2SmZxWVb8gM=; b=qykWvAUS/ansiC68umv7OrxyeR9B9AXYF/UvPnlX8qlrf2wzePwgO+Yi/3C8geF5gW 6xblGq5+RAMTXUO7Yy0TpElyFsVng5tVUn7MBqLBhOUJsnhkOKJ45c+SSm0HsNywxeev g7YMtoO/nMik5or+CLwF+0B7PBkAxmY5tOo6ybS7Ei8z0bGc3Dg95rm0luWb0P8zwN/c 7wiBv0kd+KiEM7XAjAye2zUkO69m5OrPRlYhAMULeZR02/w+hdEZxUSil9hTBVcKdh1U QUpMrLSrkL2A62ePwJG0O8+o6ldYuDeZD27Yrd4sxfK/1QTBeF34kIL1fCrByL+6Gyk5 Ak/w== X-Forwarded-Encrypted: i=1; AFNElJ/OAC0yHX57tD84QxPrzPV0deSHaDj6ubAhlhNRuILdHUi3hG+RxLjhGxbZeKqYlciumjf/kyCv7q/8kw==@lists.linux.dev X-Gm-Message-State: AOJu0Yy4Y1BoILgWY3D/V98cuCCplaDZrj9kcc7wCNGXbsX/U7anyU5z Q4CThLZQ177VrJ3SBXYV4czC9QDdRBZgSOrY15eHdJ4JfbZe1cmc7R/J X-Gm-Gg: Acq92OH2wC2HWJ3f+xJrLzb3LEwPJ/y6nJSMqLQMGdGw9Y/Ng1BP9X5DcOy+y+lEqmk q/G9HOSl1DIaGgLVNXasUBXik77Hw8x5Pr3e1cDbNXGYTrS7GaZnIHDKoi9cVmY3030UuxsW77k ATSaDNDXeW/6zM3vmQfjN7V+ZgpIAqHNt/EHBl5F652oWuRJz09TwGlDNadJzzCq20M46MPTjE7 zGWK6/7sbvR+Rf5uGF4CgPE51RtLMxWQSpnBlp33OtbAK1sj4KRhG+k+4Ow6kuJ+ODTjJ/AhrEr jA2loHBHA8vMcmGO3ZftDhOhLXdvwMlaLsGsaIjhEZhOxk4vizPGciC75iYvAmQvSR0QK9zDjsx WvU1WH9AH4bbUv6Vgs0iXzJez1kuPAWDaGBvHULaHlufWpVsDyopdM+10NGctTKA6iU2eTzTQTC m5j4o6ACn4Oguf0eo0rdruIZ9id6kNK4ZBh2FDuS+PpEF01QgnyRF9dcAV9HIV X-Received: by 2002:a05:6512:3d8a:b0:5a8:a558:63b3 with SMTP id 2adb3069b0e04-5a8b709b088mr3026360e87.30.1778519546521; Mon, 11 May 2026 10:12:26 -0700 (PDT) Received: from va-HP-Pavilion-Desktop-595-p0xxx.mshome.net ([193.0.150.248]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5a8a95660b6sm2765488e87.62.2026.05.11.10.12.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 May 2026 10:12:26 -0700 (PDT) From: Valery Borovsky To: linux-media@vger.kernel.org Cc: mchehab@kernel.org, hverkuil@kernel.org, hansg@kernel.org, hugues.fruchet@foss.st.com, alain.volmat@foss.st.com, mcoquelin.stm32@gmail.com, alexandre.torgue@foss.st.com, sakari.ailus@linux.intel.com, mripard@kernel.org, wens@kernel.org, jernej.skrabec@gmail.com, samuel@sholland.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, Valery Borovsky , stable@vger.kernel.org Subject: [PATCH 6/6] media: sun4i-csi: Return queued buffers on start_streaming() failure Date: Mon, 11 May 2026 20:12:11 +0300 Message-ID: X-Mailer: git-send-email 2.51.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. sun4i_csi_start_streaming() returned -EINVAL when no matching CSI format could be found, before any setup (scratch buffer allocation, pipeline start) had been performed. The remaining error paths already converge on the err_clear_dma_queue label, which calls return_all_buffers(..., VB2_BUF_STATE_QUEUED) under csi->qlock. Jump to that label directly: the intermediate err_disable_device / err_disable_pipeline / err_free_scratch_buffer labels are skipped, which is correct because nothing they would undo has happened yet. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure"). Fixes: 577bbf23b758 ("media: sunxi: Add A10 CSI driver") Cc: stable@vger.kernel.org Signed-off-by: Valery Borovsky --- drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c index e911c7f7acc5..4781db21c205 100644 --- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c +++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c @@ -234,8 +234,10 @@ static int sun4i_csi_start_streaming(struct vb2_queue *vq, unsigned int count) int ret; csi_fmt = sun4i_csi_find_format(&csi->fmt.pixelformat, NULL); - if (!csi_fmt) - return -EINVAL; + if (!csi_fmt) { + ret = -EINVAL; + goto err_clear_dma_queue; + } dev_dbg(csi->dev, "Starting capture\n");