From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E164408022 for ; Mon, 13 Jul 2026 12:11:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944694; cv=none; b=Zv6yaveGRrmqLMzU877l2kD2RNOVPY1gDoDQIoQUqatNh4uNlFKRIDSWdOEAuOKKHYaPO47S7kSmgKvs9jhFzvKxK0mUlFZ9W3JTthWvN41DRvDlObeoOSSzVNIDpRSWtD8SzLJ1wx2L/aNTIpJYeWdMCAWe/D8qqWLh0FFaQb4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944694; c=relaxed/simple; bh=PdPDblUOn/WdFcz0v/ad9NxuPCUExDaGjMo+g3Frs3w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=md31BcXxVmUD1ljbkrf1hIBE9eLG3frpK5p4KgBBYcyOLvBr8Uy54b9Kg/V/ExWMfrrV9uUIg2CWmMm54zJ5JaVlGVA2YNRT3EMgi0TT6HTYd/OHBDjWj3K1kTDN7Ol8KwkC9tABw+5X33CbdSX9U42NAfh20tGtZODX68b9fpQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=o2N95+fS; arc=none smtp.client-ip=209.85.216.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="o2N95+fS" Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-38511175ad3so2410476a91.2 for ; Mon, 13 Jul 2026 05:11:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944692; x=1784549492; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=o2N95+fSvtnQBbxQmd/l5AZzbWf7C8AD/N8gsbj3hbKkEkrTdE4R7lLPDoFEPfS/wt eH3oI751UNyOPGG5ZAzwjLGCzGqEj6otaKKExQ1mYirWn/+Dc7prPr+C0EIKM9NFE3gZ C6NZAaV8zJxVYXQlfe5gemnYcg0vPwJBU5BQAo8+1D3QqhlgTwhToFVBcAP5sNfftnTf +tRMGSrL4Y9oTGGSAtJ18XigSxqizvAxFiTDXL4hLgOQ0oR7Mr2K1wTX/leILfIaOtRm oddhJ1DuLfIgFnYOhVTx6BZIda7/5C4/PXCy+rXYPL609xzRtoE0aMZlyrUptQ42GnTN ZCRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944692; x=1784549492; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=YLQzxG8gI1fxZ4r/JWspRQeGTNAcYvlV/fZGGpCKn7vsB+BmL7IAV9a4sZNaYKaBy5 7xprxqpC8AmUJbS66lGnQtapsCSzsstClzUVDw3/tSSMih6k7vT1gKos4E6itEPXArC/ hOObsaTDgoYH0b4USRIn46eXZyzsnia/dgy94G09Gb5c62sZYD4IhOp1eXYDOI5snNUh wpPLy40nb0pOXhkJefCsNpszkKB0EWq301KdJ9dek1A19mz1j+YJUo0x8O8zlEVEWQSX EQ4KbOiXsHwY/AQj3Y/gn1TMr5ArpUbpqTuNU6IXTf1paZDuMrvzhy/Wx7rk2VbMhC+5 CpcA== X-Forwarded-Encrypted: i=1; AHgh+RonO5FEvc/SrlxPMG8PgSvy/7OEafINJvR6nvcSmuV4v7AdXlpszWmdmZyJv10IAYnnLEN4qRpSNug6oXA=@vger.kernel.org X-Gm-Message-State: AOJu0YyGWTtm+gyYLCK9khB4iJFzhoHWtn0Z4PXc06rezS2Xa1TTTkE1 EH8SsJ9wCuA/BKNQ3NgcujOIue8yM9moJhJpxSDXOKtaDM5pZX0qSjMX X-Gm-Gg: AfdE7clixZgs/zsHaTHb4rnsTagQofoxJApcMlIqTJ5UJTPT8RQoYHNt7b+HXNVXCJe iZpMxh9rIa1rFOL4XrDoBBUd+yDeqFvwdtJvV3ETUmweviM+nw76MeFeMZXZlGNfOUiBrL4u7xr 8Wq37gZrZgGDKiWGVqaqgYNyR61L0WC2jEp1h8bEKaT81/+rJVLNGAfTSqnLtIBQlogK8l0PU5H 8/2pjSF6+9BeVR3lItCpO+kMU2aWfFa+p4Zkgk10s8LonxOnRIJdzdrBAM9BczCE55GWC7lqabU o5Vn02PsaGJlZzoh3K/60EImXUHBmxUYr+59Sog3944yqHtPKWSGmJ9yndw3IRPy/x5qI6o2+rp UqWFqsQrrh1PbE31u6T+vN63Iy5wI4r9A2rhxh1ig8aRguUkS//7dHMnJDwfz93GHdF9AbE1UaA 62LDYvXvv+Vw== X-Received: by 2002:a17:90b:180c:b0:38e:fbe:b67b with SMTP id 98e67ed59e1d1-38e0fbeb818mr766655a91.0.1783944692422; Mon, 13 Jul 2026 05:11:32 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.11.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:11:31 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 15/19] media: meson: vdec: Fix concurrent firmware loading race and hardware timeout Date: Mon, 13 Jul 2026 17:37:10 +0530 Message-ID: <20260713120840.17427-16-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The vdec_1 firmware loader used static variables for DMA buffer addresses (`mc_addr`, `mc_addr_map`). This made allocations global across sessions, corrupting state when multiple decoders loaded firmware concurrently. Under stress this triggered KASAN reports, lost references, and memory leaks. Making mc_addr and mc_addr_map local to each load call, eliminating cross‑session races. The firmware DMA completion check also relied on a raw decrement loop of 1000 iterations. On modern CPUs this loop completed far too quickly, often before hardware signaled ready, producing false "DMA hang" errors. Replacing the busy‑wait loop with readl_poll_timeout_atomic(), providing a bounded, microsecond scale poll with proper timeout semantics. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec_1.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec_1.c b/drivers/staging/media/meson/vdec/vdec_1.c index a65cb49594465..27363c9a5af3c 100644 --- a/drivers/staging/media/meson/vdec/vdec_1.c +++ b/drivers/staging/media/meson/vdec/vdec_1.c @@ -29,14 +29,14 @@ vdec_1_load_firmware(struct amvdec_session *sess, const char *fwname) struct amvdec_core *core = sess->core; struct device *dev = core->dev_dec; struct amvdec_codec_ops *codec_ops = sess->fmt_out->codec_ops; - static void *mc_addr; - static dma_addr_t mc_addr_map; + void *mc_addr; + dma_addr_t mc_addr_map; int ret; - u32 i = 1000; + u32 val; ret = request_firmware(&fw, fwname, dev); if (ret < 0) - return -EINVAL; + return ret; if (fw->size < MC_SIZE) { dev_err(dev, "Firmware size %zu is too small. Expected %u.\n", @@ -63,11 +63,11 @@ vdec_1_load_firmware(struct amvdec_session *sess, const char *fwname) amvdec_write_dos(core, IMEM_DMA_COUNT, MC_SIZE / 4); amvdec_write_dos(core, IMEM_DMA_CTRL, (0x8000 | (7 << 16))); - while (--i && amvdec_read_dos(core, IMEM_DMA_CTRL) & 0x8000); - - if (i == 0) { + ret = readl_poll_timeout_atomic(core->dos_base + IMEM_DMA_CTRL, val, + !(val & 0x8000), 10, 10000); + if (ret) { dev_err(dev, "Firmware load fail (DMA hang?)\n"); - ret = -EINVAL; + ret = -ETIMEDOUT; goto free_mc; } -- 2.50.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9EB91C43458 for ; Mon, 13 Jul 2026 12:11:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=yNHXu0EEyJH7Idw+puz3Al7p/PwXpC7Oaq7jH+RPgKs=; b=3nXVMKd0wdzNKS SVNiO8/Y82saCZVBW9uX+Me7At0dbqMvE9N/xodf8euIZfFm2MvrnLdDSri1uhj/CSt2Yu3pUo5Gr kY8ZaSv0IeHXSUVv3G64s4IxmM3gvZy9oMUxQjVjetA3rTXLtD7I2CUavXhQxdfL/RtHaq2JxqZiu ++r9cK5mpPExj70e/LFAFIdt0vgof1GJu66FpQtuDRGKFNK/af8x+4K5ExZC8ddqNBOENfaYK4nSF Mr1sfyyDaHW4nUo9GzDbXpwMhA+0dXeJlKtbBRPmuvtM47qPCdH79OK8qeTVM7R9yiUDHNuLESCtj x9ibWZMnL7X70zK4y6fw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFVm-000000099jM-2q88; Mon, 13 Jul 2026 12:11:50 +0000 Received: from desiato.infradead.org ([2001:8b0:10b:1:d65d:64ff:fe57:4e05]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFVa-000000099Zd-274p for linux-amlogic@bombadil.infradead.org; Mon, 13 Jul 2026 12:11:38 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=Content-Transfer-Encoding:Content-Type :MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From: Sender:Reply-To:Content-ID:Content-Description; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=Tehc+RxSMb5Rq2SZGquuPJpnv0 qwaTk3GaqTkkoLdYtCv4QnGa4rSRVMP49DD4bZinyk9fb5mNccxwYfI7kKa+IWiJ3QWvAYT0J209M o2pcmSWPydzhWYT6/Z/acpEkVe235t7xkt2yLpqUk3JgMuTitphEfo9WjRey+sTMVepW/ZJmcxPY+ eECIZaGiSlx60FSVDxCHlB47zjXi+BMcsr0lMt8JUczmpPriCw2dP5PlJ7dFJRShBBCsbxOcWXCsG Mr51nqJj7QNVuwy1uG7+y2jNZpHjHvGnDq8hKgOWydOXuztzvisi2usbhpq6KRHdh1ub9OpkcEJx2 b7zq0dnA==; Received: from mail-pj1-x102d.google.com ([2607:f8b0:4864:20::102d]) by desiato.infradead.org with esmtps (Exim 4.99.2 #2 (Red Hat Linux)) id 1wjFVX-0000000BaYi-0pl7 for linux-amlogic@lists.infradead.org; Mon, 13 Jul 2026 12:11:37 +0000 Received: by mail-pj1-x102d.google.com with SMTP id 98e67ed59e1d1-381216921aaso3398456a91.1 for ; Mon, 13 Jul 2026 05:11:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944692; x=1784549492; darn=lists.infradead.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=Iyp+QIaFz89H0yfPrDgJRlystJXYjhFEiJcf/RcShHBcxULXKwtj4K2ADa/IQzrgru 3BbLtJznz8/XjWjdtb34mVWHPLeCTRDRffb0zmRhuRgIqDfN294YzYbv/LDdMF3Mkbq+ SEPVIVQJWOGH0U/KY/OLLJUyf6s7qthsNijc1q38U2Qzt/eIyGxdhe5/iLnQvdlkR1h/ g4N9J1y48WLK29JCCBJJl3oFmg4QcOMa808QMNlkUnpd2m/MjRuLtAquQSiYEkJSxoMA NzelZbVd2KxpDSU21nwqz7Assh6SEsLJU09sVZ3qSYizKLttynkXpM8ulFs2PDpt3O2B WYWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944692; x=1784549492; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=UGWYAJAwhzQc81EtZ9RDsOPwwUAKLu1C0xwntGoioQxMNBA1gbz85UmCZPdIOshdxg AASVyD0+6TlkYCznVkIHtM9qDlflDBg0SMela4l4ixkaSjXMajPsh++h0KzpG4uEVUht 0yMErvPz7uthHT9er8oLusf3qoBWV9Da/X6IsjaBwz21J2advd2c/f21XWlhEwqcdu5N nALS0nEEwWKZohmG0Ytt4LZ1M6PuJqL8sQ2ezuaKSMEkt7R4/zSSDEQTqVUnA2U9jnYe sExHZ44HqxMOMEqUhiybDLM3mOzORJXHrmLhxXa3WkKLkWFWi8cXOjle7P/plnG54CM6 qV6g== X-Forwarded-Encrypted: i=1; AHgh+RrinVgkYWPlJTZpOHaG8d6zovC37yhr8D/koui/BYlxjyp+UqwovHIVShyeQ8KXhaYB21iC7gEJBaSsXJHQ@lists.infradead.org X-Gm-Message-State: AOJu0YyKg/ghApbKMS/yEjWYeXV08AIgIJPzMIEhZdDc2tnNHNuMHJor jejLG16VNhF1viSKK+QaIJNZTXp4+U30syIQVzrA3m5u5VxLQcWosD4O X-Gm-Gg: AfdE7cmUIu/xntPBmqBlUOQB4z6LGlt6XgAuMP0VYFPM0WkObvcy5m+7Lx0eCtViId0 PfAU8bBXwV3awUL8MNYLnTktKSTbJQWjjgHCnMaPEgHd9jdm/6eGKHyB6y34kPyX8PWjZYWu62k SEXelt68SUGuTTqD7faOVvU64+C3CMDqgu614zGXXqGNRKHXsD7jVlvFDPSdiMr971hT8yZG1he MY+d29meULdKzPkg1zUphY45Rj7xbL1OXAsC5CyuPjvJKU8gGlTrRq/256rJu7jQUzRCCc/MEwz IjUgDyaSuwVDuuRVzZ1o22Xf2mb91EENv56bB5ekk2aSiqC13gZSc9Tum4Au4bK60jSgStLJrB2 eO2Vwg8J2FocfujaswFpMXvMVtPsk2TdD4VW2ETZ+1a/DxJWUyWknzgAeFXuIWnperC6113ifpV KQES/CU2yfdg== X-Received: by 2002:a17:90b:180c:b0:38e:fbe:b67b with SMTP id 98e67ed59e1d1-38e0fbeb818mr766655a91.0.1783944692422; Mon, 13 Jul 2026 05:11:32 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.11.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:11:31 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Subject: [PATCH v7 15/19] media: meson: vdec: Fix concurrent firmware loading race and hardware timeout Date: Mon, 13 Jul 2026 17:37:10 +0530 Message-ID: <20260713120840.17427-16-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260713_131135_413131_B4D3CB5D X-CRM114-Status: GOOD ( 14.41 ) X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Doruk Tan Ozturk , Nicolas Dufresne Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhlIHZkZWNfMSBmaXJtd2FyZSBsb2FkZXIgdXNlZCBzdGF0aWMgdmFyaWFibGVzIGZvciBETUEg YnVmZmVyCmFkZHJlc3NlcyAoYG1jX2FkZHJgLCBgbWNfYWRkcl9tYXBgKS4gVGhpcyBtYWRlIGFs bG9jYXRpb25zIGdsb2JhbAphY3Jvc3Mgc2Vzc2lvbnMsIGNvcnJ1cHRpbmcgc3RhdGUgd2hlbiBt dWx0aXBsZSBkZWNvZGVycyBsb2FkZWQKZmlybXdhcmUgY29uY3VycmVudGx5LiBVbmRlciBzdHJl c3MgdGhpcyB0cmlnZ2VyZWQgS0FTQU4gcmVwb3J0cywKbG9zdCByZWZlcmVuY2VzLCBhbmQgbWVt b3J5IGxlYWtzLiBNYWtpbmcgbWNfYWRkciBhbmQgbWNfYWRkcl9tYXAKbG9jYWwgdG8gZWFjaCBs b2FkIGNhbGwsIGVsaW1pbmF0aW5nIGNyb3Nz4oCRc2Vzc2lvbiByYWNlcy4KClRoZSBmaXJtd2Fy ZSBETUEgY29tcGxldGlvbiBjaGVjayBhbHNvIHJlbGllZCBvbiBhIHJhdyBkZWNyZW1lbnQKbG9v cCBvZiAxMDAwIGl0ZXJhdGlvbnMuIE9uIG1vZGVybiBDUFVzIHRoaXMgbG9vcCBjb21wbGV0ZWQg ZmFyCnRvbyBxdWlja2x5LCBvZnRlbiBiZWZvcmUgaGFyZHdhcmUgc2lnbmFsZWQgcmVhZHksIHBy b2R1Y2luZwpmYWxzZSAiRE1BIGhhbmciIGVycm9ycy4gUmVwbGFjaW5nIHRoZSBidXN54oCRd2Fp dCBsb29wIHdpdGgKcmVhZGxfcG9sbF90aW1lb3V0X2F0b21pYygpLCAgcHJvdmlkaW5nIGEgYm91 bmRlZCwgbWljcm9zZWNvbmQKc2NhbGUgcG9sbCB3aXRoIHByb3BlciB0aW1lb3V0IHNlbWFudGlj cy4KCkNjOiBOaWNvbGFzIER1ZnJlc25lIDxuaWNvbGFzQG5kdWZyZXNuZS5jYT4KU2lnbmVkLW9m Zi1ieTogQW5hbmQgTW9vbiA8bGludXguYW1vb25AZ21haWwuY29tPgotLS0KIGRyaXZlcnMvc3Rh Z2luZy9tZWRpYS9tZXNvbi92ZGVjL3ZkZWNfMS5jIHwgMTYgKysrKysrKystLS0tLS0tLQogMSBm aWxlIGNoYW5nZWQsIDggaW5zZXJ0aW9ucygrKSwgOCBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQg YS9kcml2ZXJzL3N0YWdpbmcvbWVkaWEvbWVzb24vdmRlYy92ZGVjXzEuYyBiL2RyaXZlcnMvc3Rh Z2luZy9tZWRpYS9tZXNvbi92ZGVjL3ZkZWNfMS5jCmluZGV4IGE2NWNiNDk1OTQ0NjUuLjI3MzYz YzlhNWFmM2MgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvc3RhZ2luZy9tZWRpYS9tZXNvbi92ZGVjL3Zk ZWNfMS5jCisrKyBiL2RyaXZlcnMvc3RhZ2luZy9tZWRpYS9tZXNvbi92ZGVjL3ZkZWNfMS5jCkBA IC0yOSwxNCArMjksMTQgQEAgdmRlY18xX2xvYWRfZmlybXdhcmUoc3RydWN0IGFtdmRlY19zZXNz aW9uICpzZXNzLCBjb25zdCBjaGFyICpmd25hbWUpCiAJc3RydWN0IGFtdmRlY19jb3JlICpjb3Jl ID0gc2Vzcy0+Y29yZTsKIAlzdHJ1Y3QgZGV2aWNlICpkZXYgPSBjb3JlLT5kZXZfZGVjOwogCXN0 cnVjdCBhbXZkZWNfY29kZWNfb3BzICpjb2RlY19vcHMgPSBzZXNzLT5mbXRfb3V0LT5jb2RlY19v cHM7Ci0Jc3RhdGljIHZvaWQgKm1jX2FkZHI7Ci0Jc3RhdGljIGRtYV9hZGRyX3QgbWNfYWRkcl9t YXA7CisJdm9pZCAqbWNfYWRkcjsKKwlkbWFfYWRkcl90IG1jX2FkZHJfbWFwOwogCWludCByZXQ7 Ci0JdTMyIGkgPSAxMDAwOworCXUzMiB2YWw7CiAKIAlyZXQgPSByZXF1ZXN0X2Zpcm13YXJlKCZm dywgZnduYW1lLCBkZXYpOwogCWlmIChyZXQgPCAwKQotCQlyZXR1cm4gLUVJTlZBTDsKKwkJcmV0 dXJuIHJldDsKIAogCWlmIChmdy0+c2l6ZSA8IE1DX1NJWkUpIHsKIAkJZGV2X2VycihkZXYsICJG aXJtd2FyZSBzaXplICV6dSBpcyB0b28gc21hbGwuIEV4cGVjdGVkICV1LlxuIiwKQEAgLTYzLDEx ICs2MywxMSBAQCB2ZGVjXzFfbG9hZF9maXJtd2FyZShzdHJ1Y3QgYW12ZGVjX3Nlc3Npb24gKnNl c3MsIGNvbnN0IGNoYXIgKmZ3bmFtZSkKIAlhbXZkZWNfd3JpdGVfZG9zKGNvcmUsIElNRU1fRE1B X0NPVU5ULCBNQ19TSVpFIC8gNCk7CiAJYW12ZGVjX3dyaXRlX2Rvcyhjb3JlLCBJTUVNX0RNQV9D VFJMLCAoMHg4MDAwIHwgKDcgPDwgMTYpKSk7CiAKLQl3aGlsZSAoLS1pICYmIGFtdmRlY19yZWFk X2Rvcyhjb3JlLCBJTUVNX0RNQV9DVFJMKSAmIDB4ODAwMCk7Ci0KLQlpZiAoaSA9PSAwKSB7CisJ cmV0ID0gcmVhZGxfcG9sbF90aW1lb3V0X2F0b21pYyhjb3JlLT5kb3NfYmFzZSArIElNRU1fRE1B X0NUUkwsIHZhbCwKKwkJCQkJISh2YWwgJiAweDgwMDApLCAxMCwgMTAwMDApOworCWlmIChyZXQp IHsKIAkJZGV2X2VycihkZXYsICJGaXJtd2FyZSBsb2FkIGZhaWwgKERNQSBoYW5nPylcbiIpOwot CQlyZXQgPSAtRUlOVkFMOworCQlyZXQgPSAtRVRJTUVET1VUOwogCQlnb3RvIGZyZWVfbWM7CiAJ fQogCi0tIAoyLjUwLjEKCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpsaW51eC1hbWxvZ2ljIG1haWxpbmcgbGlzdApsaW51eC1hbWxvZ2ljQGxpc3RzLmlu ZnJhZGVhZC5vcmcKaHR0cDovL2xpc3RzLmluZnJhZGVhZC5vcmcvbWFpbG1hbi9saXN0aW5mby9s aW51eC1hbWxvZ2ljCg== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 05AAAC44501 for ; Mon, 13 Jul 2026 12:11:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=H9ZpmBB02RTpaG wFvKnhWcrCcnAeYOTr67GUQMcKUb7pMZ0Asn3qMU9LTMd4U8MjYz6e7WZ5/bdxypLXqsHAk1WSSc0 ubTXNwHY2+yTnRVx+g0VIoK20Ss11DwsZweRq64PEUcx83AWwWYkRdpn7N/yFByNoOJw0HDPXKal6 rNs344Fbpm2LNbP2i/F0NRR8pQ5KmkA7CIgFQYxLKow4aDV6vG6KIL4F8YoBC1lJtktFL3xD/JNRi CEHBibtm4MRsfFOWTV/w9McfsQ937cshppgEJt12WGVHtpUV+V4QgHfKeJi/oYiT5+LQtszlgbVaZ tpsPJNqz7guJrZP2pRrA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFVj-000000099hf-3WWm; Mon, 13 Jul 2026 12:11:48 +0000 Received: from desiato.infradead.org ([2001:8b0:10b:1:d65d:64ff:fe57:4e05]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFVa-000000099ZS-1KIO for linux-arm-kernel@bombadil.infradead.org; Mon, 13 Jul 2026 12:11:38 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=Content-Transfer-Encoding:Content-Type :MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From: Sender:Reply-To:Content-ID:Content-Description; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=Tehc+RxSMb5Rq2SZGquuPJpnv0 qwaTk3GaqTkkoLdYtCv4QnGa4rSRVMP49DD4bZinyk9fb5mNccxwYfI7kKa+IWiJ3QWvAYT0J209M o2pcmSWPydzhWYT6/Z/acpEkVe235t7xkt2yLpqUk3JgMuTitphEfo9WjRey+sTMVepW/ZJmcxPY+ eECIZaGiSlx60FSVDxCHlB47zjXi+BMcsr0lMt8JUczmpPriCw2dP5PlJ7dFJRShBBCsbxOcWXCsG Mr51nqJj7QNVuwy1uG7+y2jNZpHjHvGnDq8hKgOWydOXuztzvisi2usbhpq6KRHdh1ub9OpkcEJx2 b7zq0dnA==; Received: from mail-pj1-x1035.google.com ([2607:f8b0:4864:20::1035]) by desiato.infradead.org with esmtps (Exim 4.99.2 #2 (Red Hat Linux)) id 1wjFVX-0000000BaYh-0WJS for linux-arm-kernel@lists.infradead.org; Mon, 13 Jul 2026 12:11:36 +0000 Received: by mail-pj1-x1035.google.com with SMTP id 98e67ed59e1d1-38dc4553f62so1786723a91.0 for ; Mon, 13 Jul 2026 05:11:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944692; x=1784549492; darn=lists.infradead.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=Iyp+QIaFz89H0yfPrDgJRlystJXYjhFEiJcf/RcShHBcxULXKwtj4K2ADa/IQzrgru 3BbLtJznz8/XjWjdtb34mVWHPLeCTRDRffb0zmRhuRgIqDfN294YzYbv/LDdMF3Mkbq+ SEPVIVQJWOGH0U/KY/OLLJUyf6s7qthsNijc1q38U2Qzt/eIyGxdhe5/iLnQvdlkR1h/ g4N9J1y48WLK29JCCBJJl3oFmg4QcOMa808QMNlkUnpd2m/MjRuLtAquQSiYEkJSxoMA NzelZbVd2KxpDSU21nwqz7Assh6SEsLJU09sVZ3qSYizKLttynkXpM8ulFs2PDpt3O2B WYWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944692; x=1784549492; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=PKJfzcOO3DPVFtYYdFmzNXMgq4lw0a0uxvJDNfRGA24=; b=gQDcic6o6yTrpIHiC1/TITiqkrk9WQl/IjF2vClN8PHgMZoz6nmaJNeKbGfxLmj3/k jzcXZd6CFb4orD/hIYeP1nuZ5/hguR18HTRzx4dIqo8zB5ZpzIum+2pbuscRB2I53DXg f7KlVfVQujPmNIo9cn/tzbunLv8zbl0UxLTlRDljZiFkfGQGjeFhPCi3HqeSn20b+cr6 hfcOkNR0MYHutSzAB4ZQd44GbooMgNQxB/oU8wgrY0d9o8TEwcKunl7MO/FZrDIJ+lxg mhQb6fRTqkQgO+pUyre2yRFSPkuhowUv+H5Ggpa7Mn+FPPuluk71US8H7WH6VnoIfEkx yyIQ== X-Forwarded-Encrypted: i=1; AHgh+Rq07D2ZGhky+xAI23dfCF13Mkltut3XM6/gageme7bA+vWfhLeCMeGTwHPIYO+P5d9qzJ4XB1m/uNLefunsQUJv@lists.infradead.org X-Gm-Message-State: AOJu0YzSu8g8KVXiU9GMa+KHKnayYU8jtY2+ZETEtjZAkABn/KiI5hPF QE7y/UI9NP6YjW6DRJA0BPfaJmkh4fp0F1YzwrkiX8oAQCJPjpgHk8/N X-Gm-Gg: AfdE7cma9xbV2dDJGQY77mCzGZZDUxmZFpYTPKaXtI+ra0XeQgKwoSgouZLfIEG1m+t jMUzwfJTP3fcZuCEDCnyaYrZGZ/s8Xq96UN0yRSmTcwPhVlON9hxdWh2eb0Pd0UJ931GP7IK9s9 SkuWPc4xdYsVbO4cEt5x3Ga2B2J5ApGGOAEngAqCa6aTL5WrY1KgejSrbzHhGmulIbXhN5FNDDW kHD21A1OSAq1wXRbUTup33dE7jNY/rIdSKP59qMWqzv2rWuiVn0+dcysJ6Napq8a33jSobidSkb 4+48JSb2E8Cg8rmdiuXYxz/5WOxbxg9SvqspLwxG0bixZcsD41k2j0MahznDJg62FRaXEUhmth8 7FDJIij6vyS6zhrut19ETrLw+xyzazWZrDmWlMWEjcgP42u8SazYE7YUA22tOYugzi361ipf2vF iW5c2KpP24Kg== X-Received: by 2002:a17:90b:180c:b0:38e:fbe:b67b with SMTP id 98e67ed59e1d1-38e0fbeb818mr766655a91.0.1783944692422; Mon, 13 Jul 2026 05:11:32 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.11.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:11:31 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Subject: [PATCH v7 15/19] media: meson: vdec: Fix concurrent firmware loading race and hardware timeout Date: Mon, 13 Jul 2026 17:37:10 +0530 Message-ID: <20260713120840.17427-16-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260713_131135_276050_BEC8C31B X-CRM114-Status: GOOD ( 16.03 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Doruk Tan Ozturk , Nicolas Dufresne Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The vdec_1 firmware loader used static variables for DMA buffer addresses (`mc_addr`, `mc_addr_map`). This made allocations global across sessions, corrupting state when multiple decoders loaded firmware concurrently. Under stress this triggered KASAN reports, lost references, and memory leaks. Making mc_addr and mc_addr_map local to each load call, eliminating cross‑session races. The firmware DMA completion check also relied on a raw decrement loop of 1000 iterations. On modern CPUs this loop completed far too quickly, often before hardware signaled ready, producing false "DMA hang" errors. Replacing the busy‑wait loop with readl_poll_timeout_atomic(), providing a bounded, microsecond scale poll with proper timeout semantics. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/vdec_1.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec_1.c b/drivers/staging/media/meson/vdec/vdec_1.c index a65cb49594465..27363c9a5af3c 100644 --- a/drivers/staging/media/meson/vdec/vdec_1.c +++ b/drivers/staging/media/meson/vdec/vdec_1.c @@ -29,14 +29,14 @@ vdec_1_load_firmware(struct amvdec_session *sess, const char *fwname) struct amvdec_core *core = sess->core; struct device *dev = core->dev_dec; struct amvdec_codec_ops *codec_ops = sess->fmt_out->codec_ops; - static void *mc_addr; - static dma_addr_t mc_addr_map; + void *mc_addr; + dma_addr_t mc_addr_map; int ret; - u32 i = 1000; + u32 val; ret = request_firmware(&fw, fwname, dev); if (ret < 0) - return -EINVAL; + return ret; if (fw->size < MC_SIZE) { dev_err(dev, "Firmware size %zu is too small. Expected %u.\n", @@ -63,11 +63,11 @@ vdec_1_load_firmware(struct amvdec_session *sess, const char *fwname) amvdec_write_dos(core, IMEM_DMA_COUNT, MC_SIZE / 4); amvdec_write_dos(core, IMEM_DMA_CTRL, (0x8000 | (7 << 16))); - while (--i && amvdec_read_dos(core, IMEM_DMA_CTRL) & 0x8000); - - if (i == 0) { + ret = readl_poll_timeout_atomic(core->dos_base + IMEM_DMA_CTRL, val, + !(val & 0x8000), 10, 10000); + if (ret) { dev_err(dev, "Firmware load fail (DMA hang?)\n"); - ret = -EINVAL; + ret = -ETIMEDOUT; goto free_mc; } -- 2.50.1