From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 528EC369208 for ; Mon, 13 Jul 2026 12:10:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944620; cv=none; b=aFKpci/e7TQPAzrvoAMS70MZGU+hDOSjppi+bCC1HixRkAiBw2vyfYgv11zaqlNuH7aHyqryu4UXAjTlxtnHeo6PYoBxAZcPvPj9d3HKGv6UzkNSwuOEGW1zMaHAvWRpFzAkCzFpzjbzNVv+yHYoCB0YLbWhivkkCSgatjLoHH4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944620; c=relaxed/simple; bh=bhI4E6oc6F1Tv+IuuQmSjw+SHYMiXdNdT/xsno/HW2o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rV3ozCYCaol2TMVAE/2wPkLc/JT1dm8Yf2aYxeJWoD7Ma0N/QfEfV8mTjjUeEnn7ljzj+7ewxf/4/OtyYbhEc7fwB6v9Z3nnScXrzH21iX0aQ936M6zpW9JX80AOwYwUg3d7e/rJ1ujDKMhOFQndOVu0oKA58C4rtC0NAvSNtf8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JynEyQ70; arc=none smtp.client-ip=209.85.216.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JynEyQ70" Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-38dc69c74b8so1490311a91.0 for ; Mon, 13 Jul 2026 05:10:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944619; x=1784549419; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=M52KCQrGH2efvkkWtyT/9Kw89ZxEs+AuVcYa54xJZ9k=; b=JynEyQ70NN/FuAZuIP8sAttKvTrDGKKRZ3isVFk+YeljEw0WXEnSztb1fGzMHFBjUB l0FXDePnB4jpA199ATp+2d2UiahO7I1HNRGlKVwza9RfxC3kEPJ+UqVBSfcJAyEAslCT CCQmEM7nPVhBRhl8o2NypiRdnt74CXsm55qgT3fh79bbjcLbyk9DFQQRL0DUIkL8p8C/ LjqpEpNVA/ahcMr1m4tsmM4FMUGDlIieWxz6/Ha8HF0QitD6SLeRDPFIE6t1b31mrqw8 qQjtiww2PYjXKO4TxEjX0NQESRaj7zk0eT08xvEnhKB+7hIwlz5Z08OEpkodquDmf3H2 O5Ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944619; x=1784549419; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=M52KCQrGH2efvkkWtyT/9Kw89ZxEs+AuVcYa54xJZ9k=; b=fsklRKtjtLMBODrNyx1tBJODkRl2QrM2gEeFlMoxkD8QsClz0O8KuZvrgBA3K55oCj NSFl4uyiXXFJB0CnWkfaCH4HfgBuU/Fla9ip1z6w9JBOHCdgSJLo0d6ChpKU/Fu1D2Pd p781R6NQNpt5Yg3r4tNx0NtcGpbfC5XT/sPTSXJWM0r4G72pMawjssWVhE0Q27Uq0Z4D db1WZjT65teksCdl2XeJ1USOv2WjZIyvmPqnRRL4nDr2Sov4aZBTMY0nx+MBz2qXa8a7 N1oyrb9QILc6gifnwQJQGjJHSoMr/k3/usW6kiUN+b8WeDCxfy8Aku1CuN64sqF1B+JO JdmA== X-Forwarded-Encrypted: i=1; AHgh+RoEv9sknKYf2Frpu8LMFlpzi7EVZzuUiq1qx2hdaOsXxFQi5VB75//O4bJXLeMTtL5QFF5VO4anywMLDCEz@lists.linux.dev X-Gm-Message-State: AOJu0YzaIBmaWAdv7dhue1gEXhGBqsy9J7RtrEUlHJSrxySV8/l+uHdR IFhgc/DYCmCex5poru0WovotmPwSujwxuwaGJEmICvxN7G/sLHHVc1px X-Gm-Gg: AfdE7cmp02NO+nqv/spkFU4VcLw0Lxb/ZPp8VRpnnVVHphn8BjbHYqpEeZ4/30wTU5b CVbVPpUL/DQCudzo51VYoaIqWAMTcOMMSUTjU3pYDb9GvvtzROG/0t4dmi7yXEf7g/7p39okdSA KnJdjOIpWAXihHA/C7ZDMPWh1ZhkReFY8BNj2xX71PCD1c7pI3BX0vX1w5WITmJykJn7Y0jsnK5 doGP969s5GHPk+9TU7TrrDAK3XyzS7/Yeaui+JpbLfAS0H2z4erQ8tJy6sqlqxRTCAog21WGhEn HmI0oV52OIzeogPRJ63MhcQhNIDY3KlhW79VNmQyyX5ZmSLAKN1EidWYEjE/ayNBQVU0gprDL0C yUnDoulj5Nm5fPucJZLGEFR/dAeJA+Rm8SMFFnbam+w7KSQaDeKHbc1hnjnjoArZdmAMDoS9W3F Sgb7HTZ/gjMQ== X-Received: by 2002:a17:90b:58cc:b0:380:540:d499 with SMTP id 98e67ed59e1d1-38dc78224a5mr7942822a91.6.1783944618568; Mon, 13 Jul 2026 05:10:18 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:17 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 08/19] media: meson: vdec: Fix concurrent execution races and unsafe teardown Date: Mon, 13 Jul 2026 17:37:03 +0530 Message-ID: <20260713120840.17427-9-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-staging@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Address data races involving 'should_stop' and prevent multi-session hardware clobbering by enforcing atomic tracking and strict owner validation during device teardown. The esparser work queue reads 'sess->should_stop' outside of critical regions without serialization primitives, risking data races or visibility delays. Furthermore, vdec_close() and vdec_stop_streaming() blindly shut down hardware components (via poweroff and canvas frees) and nullify 'core->cur_sess' without confirming that the executing session actually owns the active hardware context. In multi-session scenarios, this allows a closing inactive session to inadvertently break a running session. To fix these synchronization and lifecycle issues with the following changes use thread-safe flagging: Wrap reads and writes of 'sess->should_stop' in READ_ONCE() and WRITE_ONCE() to prevent compiler optimizations from caching the condition variables across scheduling boundaries and optimizations across workqueue execution threads. Also safe context releasing: transition 'core->cur_sess' pointer clearings to use smp_store_release(). This ensures all prior internal memory structures are entirely flushed and visible to other execution cores. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 2 +- drivers/staging/media/meson/vdec/vdec.c | 88 ++++++++++++++------- 2 files changed, 59 insertions(+), 31 deletions(-) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/media/meson/vdec/esparser.c index e5d3d817b9b2b..959673742e699 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -379,7 +379,7 @@ void esparser_queue_all_src(struct work_struct *work) scoped_guard(mutex, &sess->lock) { /* Safe atomic tracking check: exit loop if session is shutting down */ - if (sess->should_stop) + if (READ_ONCE(sess->should_stop)) return; /* Queue completely empty: exit work loop cleanly */ diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c index 6fe9722577179..83a9b1238972a 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -287,9 +287,13 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count) struct amvdec_session *sess = vb2_get_drv_priv(q); struct amvdec_codec_ops *codec_ops = sess->fmt_out->codec_ops; struct amvdec_core *core = sess->core; + struct device *dev = core->dev_dec; struct vb2_v4l2_buffer *buf; int ret; + /* Reset workqueue loop shutdown signal to allow streaming */ + WRITE_ONCE(sess->should_stop, 0); + if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) sess->streamon_out = 1; else @@ -336,7 +340,7 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count) dma_alloc_coherent(sess->core->dev, sess->vififo_size, &sess->vififo_paddr, GFP_KERNEL); if (!sess->vififo_vaddr) { - dev_err(sess->core->dev, "Failed to request VIFIFO buffer\n"); + dev_err(dev, "Failed to request VIFIFO buffer\n"); ret = -ENOMEM; goto err_cleanup_session; } @@ -388,10 +392,12 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count) sess->streamon_cap = 0; mutex_lock(&core->lock); - if (core->cur_sess == sess) - core->cur_sess = NULL; - if (sess->status != STATUS_NEEDS_RESUME) - sess->status = STATUS_STOPPED; + if (core->cur_sess == sess) { + /* Safely clear hardware ownership since we were confirmed as the owner */ + smp_store_release(&core->cur_sess, NULL); + if (sess->status != STATUS_NEEDS_RESUME) + sess->status = STATUS_STOPPED; + } mutex_unlock(&core->lock); err_unlock_no_hw: while ((buf = v4l2_m2m_src_buf_remove(sess->m2m_ctx))) @@ -441,6 +447,9 @@ static void vdec_stop_streaming(struct vb2_queue *q) enum amvdec_status old_status; bool full_cleanup = false; + /* Signal workqueue loop to abort instantly */ + WRITE_ONCE(sess->should_stop, 1); + /* flush buffers to kill background workqueue thread */ if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) { while ((buf = v4l2_m2m_src_buf_remove(sess->m2m_ctx))) @@ -493,26 +502,33 @@ static void vdec_stop_streaming(struct vb2_queue *q) cancel_work_sync(&sess->esparser_queue_work); mutex_lock(&core->lock); - vdec_poweroff(sess); - vdec_free_canvas(sess); + if (core->cur_sess == sess) { + vdec_poweroff(sess); + vdec_free_canvas(sess); + + if (sess->vififo_vaddr) { + dma_free_coherent(sess->core->dev, + sess->vififo_size, + sess->vififo_vaddr, + sess->vififo_paddr); + sess->vififo_vaddr = NULL; + sess->vififo_paddr = 0; + } - if (sess->vififo_vaddr) { - dma_free_coherent(sess->core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); - sess->vififo_vaddr = NULL; - sess->vififo_paddr = 0; - } + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); - vdec_reset_timestamps(sess); - vdec_reset_bufs_recycle(sess); - core->cur_sess = NULL; + kfree(sess->priv); + sess->priv = NULL; - kfree(sess->priv); - sess->priv = NULL; + /* Safely clear hardware ownership since we were confirmed as the owner */ + smp_store_release(&core->cur_sess, NULL); + } } else { if (sess->status == STATUS_NEEDS_RESUME) sess->changed_format = 0; } + mutex_unlock(&core->lock); } @@ -802,7 +818,7 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd) if (cmd->cmd == V4L2_DEC_CMD_START) { v4l2_m2m_clear_state(sess->m2m_ctx); - sess->should_stop = 0; + WRITE_ONCE(sess->should_stop, 0); return 0; } @@ -812,7 +828,7 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd) dev_dbg(dev, "Received V4L2_DEC_CMD_STOP\n"); - sess->should_stop = 1; + WRITE_ONCE(sess->should_stop, 1); v4l2_m2m_mark_stopped(sess->m2m_ctx); @@ -998,6 +1014,9 @@ static int vdec_close(struct file *file) struct amvdec_session *sess = file_to_amvdec_session(file); struct amvdec_core *core = sess->core; + /* Signal workqueue loop to abort instantly */ + WRITE_ONCE(sess->should_stop, 1); + /* Synchronize and flush pending hardware interrupt service routines */ synchronize_irq(core->vdec_irq); /* Ensure esparser ISR finishes executing */ @@ -1012,21 +1031,30 @@ static int vdec_close(struct file *file) mutex_lock(&core->lock); - vdec_poweroff(sess); - vdec_free_canvas(sess); - core->cur_sess = NULL; + if (core->cur_sess == sess) { + vdec_poweroff(sess); + vdec_free_canvas(sess); - if (sess->vififo_vaddr) { - dma_free_coherent(core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); - sess->vififo_vaddr = NULL; - sess->vififo_paddr = 0; + if (sess->vififo_vaddr) { + dma_free_coherent(core->dev, + sess->vififo_size, + sess->vififo_vaddr, + sess->vififo_paddr); + sess->vififo_vaddr = NULL; + sess->vififo_paddr = 0; + } + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); } - vdec_reset_timestamps(sess); - vdec_reset_bufs_recycle(sess); + kfree(sess->priv); sess->priv = NULL; + /* Unconditionally set our local status to stopped */ + sess->status = STATUS_STOPPED; + /* Safely clear hardware ownership since we were confirmed as the owner */ + smp_store_release(&core->cur_sess, NULL); + mutex_unlock(&core->lock); v4l2_m2m_ctx_release(sess->m2m_ctx); -- 2.50.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4B8B4C44501 for ; Mon, 13 Jul 2026 12:10:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date :Subject:To:From:Reply-To:Content-Type:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=M52KCQrGH2efvkkWtyT/9Kw89ZxEs+AuVcYa54xJZ9k=; b=lZG+y+vAvyCQQM EAxWuTO4+VZ/R7/xz8hd/IPPXHkMWzsOhxcSxEB/tdLZrlKvSO/xmDbFBTRdugK8RnfXuBhW5mn7j 5mnjRm/gJkPev1or87lhP674qWAWjM/ZRiBKiIlELaKy8gRgAXRKYJnddu7z+U7Fkkm3xC6au5P7I bATmQskM+mCqn/iOJ/+wDW2hVyZ/gb/fZ/e9xrWc7kSPNoisg5qZh8U/aW/Kq9ow+yietM1Uwt5ZA L0wLYCEl9iMgP4PJcCRCehl871Fdhwi2gYbKfN06TRX0yuRSk2mGFaKF/PDwfqCLL5v8X7EInGHBP TOHkonOnIKlNNWCumOhQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFUM-000000098gn-1FQ8; Mon, 13 Jul 2026 12:10:22 +0000 Received: from mail-pj1-x102c.google.com ([2607:f8b0:4864:20::102c]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFUJ-000000098em-2yKe for linux-arm-kernel@lists.infradead.org; Mon, 13 Jul 2026 12:10:21 +0000 Received: by mail-pj1-x102c.google.com with SMTP id 98e67ed59e1d1-38759bcd877so2456432a91.2 for ; Mon, 13 Jul 2026 05:10:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944619; x=1784549419; darn=lists.infradead.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=M52KCQrGH2efvkkWtyT/9Kw89ZxEs+AuVcYa54xJZ9k=; b=S2sGS9nW3ki7m7QiQsAv0XG6u0BfJcrxQGRZ0rf2i1ENlYpOlH9q3Tk9nPhtZWUB4n BkY4q3OLbNOjYzGz2wZ1hj4YDtNJDPL5CETHeRzvpnDPkucnwGRUiaguHLiFJF7jJwAj cdvc+CavEVghjro8YNYE77wYPKcN01/oFNB894BdKzCXwLdaYm4vXl3IvoB2Vk99CMBB 0a1JzvLG67CLv3/RxvgHibJA2ohfkJx9uVvrwObQ+FeWeJxdL3aeB13fW4hKdocHTw5l V0Q4pdcLf0yxu+ot35uEktnpBLe3hILNrknx688XmMcW8FoiRHui15yad4wXVIhcUEbI p/Hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944619; x=1784549419; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=M52KCQrGH2efvkkWtyT/9Kw89ZxEs+AuVcYa54xJZ9k=; b=dBq4kNlP8SESMFjhz5XCThp3mG3M7NI5KeP0Ol5UoXbon6/ilErrfur7u0oNt2QdLq qmbU7U+RVdauXwKPw3mQaCutBbSb4bjdPpOiMC1GU0NSEGPWmGoeC4tHIP0H+zjAQSxS 1uWER8i7aJARBRKimaXPSRkWeoIflYpuSrik04KUGV7VzXMjV6nUBxffy+3MdbGM5M5r qrw48bAvst4aw6h8URH4M0UaEWvoBeIYCuxs4tp8pneu/W/H2c2cOeElXLk1WV9RYp44 HTuDxqTJ9BJA9Q3onLEklZFBXWmHS5w4Q9gh7lv6KG64TM1G8qrhNlXYg23ojmB9ZKwT 4gtA== X-Forwarded-Encrypted: i=1; AHgh+RqUe0TKeVbRrKf7oCUNdTMjWEf289Ds4yHGXdt60E2ODl4fGrLh9oGXiHSJ+wI6QLJIixUrryEPQ5CNPu9+K/en@lists.infradead.org X-Gm-Message-State: AOJu0Yyxm6KJLs9sbt4IiHvON1l/gcEvfQb8xdgeFzUjuxATrDcrpQUu kGCnRiA15rD1ij5moqvYh+MQ6JImRQPetUM/bS1hSY6oI2gYkdid538O X-Gm-Gg: AfdE7ckXYbTusyltXie1XR3aY270trCXYaf5Q1z1C2OTQ8HZoetJhlkGZvl3KW92q0W l0KQPSuAftC7c7p9dSA+5K5R0lS1u+wTvQiJYQ7Yrj2BiRcA3/ORsgayPgCrRWm3IpexG5S6/b+ tbMfEPQ8mGoPeeeDyjwc2IV2rXIXOmN4GARhpMDY6pIX5MAW+lkKe0vjdrMurymzc7CB5xOSQfB GaVU+zUwVNClupwPf5tD7JWpOnxgV0rpzZ9ILNa7YlvCN+VGeZF3HWC/Bk+jpLY6RkZDzBzpBgC XXDCBTz9aWMk/4Di7B9xLSCbZkoHK2gDUKCf5nj3EgSP6o9xhLKU1mEqi4ODoiaIlDQOqTsInQC 7z2dHVtNRcYj4vLuKtyjmYMUCw2vHjYEqh9HPnp+7a8mNibOQp9l+jiudNHbyl8i0L4yb15/Y09 6cVgCOfX48fQ== X-Received: by 2002:a17:90b:58cc:b0:380:540:d499 with SMTP id 98e67ed59e1d1-38dc78224a5mr7942822a91.6.1783944618568; Mon, 13 Jul 2026 05:10:18 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:17 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Subject: [PATCH v7 08/19] media: meson: vdec: Fix concurrent execution races and unsafe teardown Date: Mon, 13 Jul 2026 17:37:03 +0530 Message-ID: <20260713120840.17427-9-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260713_051019_754793_6D5A9DB3 X-CRM114-Status: GOOD ( 22.33 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Doruk Tan Ozturk , Nicolas Dufresne Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Address data races involving 'should_stop' and prevent multi-session hardware clobbering by enforcing atomic tracking and strict owner validation during device teardown. The esparser work queue reads 'sess->should_stop' outside of critical regions without serialization primitives, risking data races or visibility delays. Furthermore, vdec_close() and vdec_stop_streaming() blindly shut down hardware components (via poweroff and canvas frees) and nullify 'core->cur_sess' without confirming that the executing session actually owns the active hardware context. In multi-session scenarios, this allows a closing inactive session to inadvertently break a running session. To fix these synchronization and lifecycle issues with the following changes use thread-safe flagging: Wrap reads and writes of 'sess->should_stop' in READ_ONCE() and WRITE_ONCE() to prevent compiler optimizations from caching the condition variables across scheduling boundaries and optimizations across workqueue execution threads. Also safe context releasing: transition 'core->cur_sess' pointer clearings to use smp_store_release(). This ensures all prior internal memory structures are entirely flushed and visible to other execution cores. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 2 +- drivers/staging/media/meson/vdec/vdec.c | 88 ++++++++++++++------- 2 files changed, 59 insertions(+), 31 deletions(-) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/media/meson/vdec/esparser.c index e5d3d817b9b2b..959673742e699 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -379,7 +379,7 @@ void esparser_queue_all_src(struct work_struct *work) scoped_guard(mutex, &sess->lock) { /* Safe atomic tracking check: exit loop if session is shutting down */ - if (sess->should_stop) + if (READ_ONCE(sess->should_stop)) return; /* Queue completely empty: exit work loop cleanly */ diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c index 6fe9722577179..83a9b1238972a 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -287,9 +287,13 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count) struct amvdec_session *sess = vb2_get_drv_priv(q); struct amvdec_codec_ops *codec_ops = sess->fmt_out->codec_ops; struct amvdec_core *core = sess->core; + struct device *dev = core->dev_dec; struct vb2_v4l2_buffer *buf; int ret; + /* Reset workqueue loop shutdown signal to allow streaming */ + WRITE_ONCE(sess->should_stop, 0); + if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) sess->streamon_out = 1; else @@ -336,7 +340,7 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count) dma_alloc_coherent(sess->core->dev, sess->vififo_size, &sess->vififo_paddr, GFP_KERNEL); if (!sess->vififo_vaddr) { - dev_err(sess->core->dev, "Failed to request VIFIFO buffer\n"); + dev_err(dev, "Failed to request VIFIFO buffer\n"); ret = -ENOMEM; goto err_cleanup_session; } @@ -388,10 +392,12 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count) sess->streamon_cap = 0; mutex_lock(&core->lock); - if (core->cur_sess == sess) - core->cur_sess = NULL; - if (sess->status != STATUS_NEEDS_RESUME) - sess->status = STATUS_STOPPED; + if (core->cur_sess == sess) { + /* Safely clear hardware ownership since we were confirmed as the owner */ + smp_store_release(&core->cur_sess, NULL); + if (sess->status != STATUS_NEEDS_RESUME) + sess->status = STATUS_STOPPED; + } mutex_unlock(&core->lock); err_unlock_no_hw: while ((buf = v4l2_m2m_src_buf_remove(sess->m2m_ctx))) @@ -441,6 +447,9 @@ static void vdec_stop_streaming(struct vb2_queue *q) enum amvdec_status old_status; bool full_cleanup = false; + /* Signal workqueue loop to abort instantly */ + WRITE_ONCE(sess->should_stop, 1); + /* flush buffers to kill background workqueue thread */ if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) { while ((buf = v4l2_m2m_src_buf_remove(sess->m2m_ctx))) @@ -493,26 +502,33 @@ static void vdec_stop_streaming(struct vb2_queue *q) cancel_work_sync(&sess->esparser_queue_work); mutex_lock(&core->lock); - vdec_poweroff(sess); - vdec_free_canvas(sess); + if (core->cur_sess == sess) { + vdec_poweroff(sess); + vdec_free_canvas(sess); + + if (sess->vififo_vaddr) { + dma_free_coherent(sess->core->dev, + sess->vififo_size, + sess->vififo_vaddr, + sess->vififo_paddr); + sess->vififo_vaddr = NULL; + sess->vififo_paddr = 0; + } - if (sess->vififo_vaddr) { - dma_free_coherent(sess->core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); - sess->vififo_vaddr = NULL; - sess->vififo_paddr = 0; - } + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); - vdec_reset_timestamps(sess); - vdec_reset_bufs_recycle(sess); - core->cur_sess = NULL; + kfree(sess->priv); + sess->priv = NULL; - kfree(sess->priv); - sess->priv = NULL; + /* Safely clear hardware ownership since we were confirmed as the owner */ + smp_store_release(&core->cur_sess, NULL); + } } else { if (sess->status == STATUS_NEEDS_RESUME) sess->changed_format = 0; } + mutex_unlock(&core->lock); } @@ -802,7 +818,7 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd) if (cmd->cmd == V4L2_DEC_CMD_START) { v4l2_m2m_clear_state(sess->m2m_ctx); - sess->should_stop = 0; + WRITE_ONCE(sess->should_stop, 0); return 0; } @@ -812,7 +828,7 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd) dev_dbg(dev, "Received V4L2_DEC_CMD_STOP\n"); - sess->should_stop = 1; + WRITE_ONCE(sess->should_stop, 1); v4l2_m2m_mark_stopped(sess->m2m_ctx); @@ -998,6 +1014,9 @@ static int vdec_close(struct file *file) struct amvdec_session *sess = file_to_amvdec_session(file); struct amvdec_core *core = sess->core; + /* Signal workqueue loop to abort instantly */ + WRITE_ONCE(sess->should_stop, 1); + /* Synchronize and flush pending hardware interrupt service routines */ synchronize_irq(core->vdec_irq); /* Ensure esparser ISR finishes executing */ @@ -1012,21 +1031,30 @@ static int vdec_close(struct file *file) mutex_lock(&core->lock); - vdec_poweroff(sess); - vdec_free_canvas(sess); - core->cur_sess = NULL; + if (core->cur_sess == sess) { + vdec_poweroff(sess); + vdec_free_canvas(sess); - if (sess->vififo_vaddr) { - dma_free_coherent(core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); - sess->vififo_vaddr = NULL; - sess->vififo_paddr = 0; + if (sess->vififo_vaddr) { + dma_free_coherent(core->dev, + sess->vififo_size, + sess->vififo_vaddr, + sess->vififo_paddr); + sess->vififo_vaddr = NULL; + sess->vififo_paddr = 0; + } + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); } - vdec_reset_timestamps(sess); - vdec_reset_bufs_recycle(sess); + kfree(sess->priv); sess->priv = NULL; + /* Unconditionally set our local status to stopped */ + sess->status = STATUS_STOPPED; + /* Safely clear hardware ownership since we were confirmed as the owner */ + smp_store_release(&core->cur_sess, NULL); + mutex_unlock(&core->lock); v4l2_m2m_ctx_release(sess->m2m_ctx); -- 2.50.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id ED4DCC43458 for ; Mon, 13 Jul 2026 12:10:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=BeHslHjIlSMS4Pm+d0beG1IbZ+bdoCwLTPT2MhpK2bk=; b=yTlP/9ZlS+W/mL 0CR+4tOk9YgymTaENuWlwJo+ZrrgpF+8BfeIpXbh4k1Pxjjs5Zza7kT3Tjs1hvQQiTcC9Ra7qn/fm 8UAij18d9LLxb0h28ZmX7bnmPN7UpPTk6RPMu3MyOGAtJt+51GVwXdhGQnQv7YtSQiQhnnT2Uei3Y JPXw3S3SWnNdZW3Q1qy8Kgffi7+/mlu3X1xe+CAMM2p1RpHQt8iWeoqHmK7BKMwVOb6W62Geh9UPG TvQtYxvZDllZeNIWNudcN7B1PTCLTEpWJ58JHEHVJC0OhZZ+5M9YA9Cgt8B3j0ADdMhLp2BmD2U74 V2E1b/Y//v3XAM2kugHg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFUO-000000098in-1voA; Mon, 13 Jul 2026 12:10:24 +0000 Received: from mail-pj1-x102b.google.com ([2607:f8b0:4864:20::102b]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFUJ-000000098en-1h36 for linux-amlogic@lists.infradead.org; Mon, 13 Jul 2026 12:10:22 +0000 Received: by mail-pj1-x102b.google.com with SMTP id 98e67ed59e1d1-383cb94f742so2618410a91.3 for ; Mon, 13 Jul 2026 05:10:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944619; x=1784549419; darn=lists.infradead.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=M52KCQrGH2efvkkWtyT/9Kw89ZxEs+AuVcYa54xJZ9k=; b=S2sGS9nW3ki7m7QiQsAv0XG6u0BfJcrxQGRZ0rf2i1ENlYpOlH9q3Tk9nPhtZWUB4n BkY4q3OLbNOjYzGz2wZ1hj4YDtNJDPL5CETHeRzvpnDPkucnwGRUiaguHLiFJF7jJwAj cdvc+CavEVghjro8YNYE77wYPKcN01/oFNB894BdKzCXwLdaYm4vXl3IvoB2Vk99CMBB 0a1JzvLG67CLv3/RxvgHibJA2ohfkJx9uVvrwObQ+FeWeJxdL3aeB13fW4hKdocHTw5l V0Q4pdcLf0yxu+ot35uEktnpBLe3hILNrknx688XmMcW8FoiRHui15yad4wXVIhcUEbI p/Hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944619; x=1784549419; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=M52KCQrGH2efvkkWtyT/9Kw89ZxEs+AuVcYa54xJZ9k=; b=bUZWWVpqwTmW6s/A6NI24JBK1YHfKXs9ijgI4fWP3JToHvR9BAoBSL6Nrtqyl5R3L5 T87Nfa7UhPJBo5m+qM9+y5jFHKgSoiPzq5LlxE0Z9YtxmX/jWKOsEwXc7SeVRyS1fyxI NAOkUjx8m5o94n8SR9BHyAToPmcstch3yJJ5e9Kr0D7jY+60YcjV6XvzxmFHYmO+ab43 wlOlIn6jP/6GF4wzPacqbqsvNRTEJtmwZWx+tjrXZBgHZuUPOIcpPftqzRmg01GswT+Q JYIkwmWDAy1TFA+HX9/i7BPAtcVFpRW4IfzBi4vMg6V8Fm2/pOrSsaoUDUz4og9EJucQ Z02A== X-Forwarded-Encrypted: i=1; AHgh+RrYhulBi1TNiLBkTuIZk3r5sWeq9xjNtUqdGZmoMYgIh4x/IhAAPD9bzVHqJVDq6XA8BWv6Aqk5lh8gM8YG@lists.infradead.org X-Gm-Message-State: AOJu0YwYajlwtZcrhRw5No0hULStNZ4xku6vWWOQ8ub52irH3BeIKdrD lq1EaDU50/YCuPB1CaHNKqYjjBxJj68Xjza7U3j3ZLk90FaxRl2miDNP X-Gm-Gg: AfdE7clqJnpffTTD/LfkjZWf1y+SxOdQ901PtU1s7tzwtVB8s3ouKtyChM4kUyDucEA SGeBVlbl5TwYvAeTGsi/KRJSMQ1mAyLXy77/JZu5fH00Ld3kcR8OmNn3dZH54bQ/iNjMBxkykPW 9t7TQhh3IK3jA/n9vMnN+X9T9xVOylswGTU3ul7D6s7cN315lyRNbXL0TGrG3R30E6tYzBUiVrs ZU49WdDsgVgyqm3N75F903LkMR3tbXECG7322+41wYaK+FrtHrDE811nD34EXzp3Xu493QF1l8h J2bqWL/1rHLWIHubISuzfPhPwKYJDtM6eXy/+RnIEdJjJP/213paxZU2kuUE5WVn9oVydWMpNrr S02DllJlHBATN/nP400azOxI/O8Cn2mO/QJWIzm1BilWk1UTHSZBTbHWr1fbYEg6KDELiugfNUf /tctCTi2zW/w== X-Received: by 2002:a17:90b:58cc:b0:380:540:d499 with SMTP id 98e67ed59e1d1-38dc78224a5mr7942822a91.6.1783944618568; Mon, 13 Jul 2026 05:10:18 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:17 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Subject: [PATCH v7 08/19] media: meson: vdec: Fix concurrent execution races and unsafe teardown Date: Mon, 13 Jul 2026 17:37:03 +0530 Message-ID: <20260713120840.17427-9-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260713_051019_460053_A5D1256B X-CRM114-Status: GOOD ( 20.71 ) X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Doruk Tan Ozturk , Nicolas Dufresne Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org Address data races involving 'should_stop' and prevent multi-session hardware clobbering by enforcing atomic tracking and strict owner validation during device teardown. The esparser work queue reads 'sess->should_stop' outside of critical regions without serialization primitives, risking data races or visibility delays. Furthermore, vdec_close() and vdec_stop_streaming() blindly shut down hardware components (via poweroff and canvas frees) and nullify 'core->cur_sess' without confirming that the executing session actually owns the active hardware context. In multi-session scenarios, this allows a closing inactive session to inadvertently break a running session. To fix these synchronization and lifecycle issues with the following changes use thread-safe flagging: Wrap reads and writes of 'sess->should_stop' in READ_ONCE() and WRITE_ONCE() to prevent compiler optimizations from caching the condition variables across scheduling boundaries and optimizations across workqueue execution threads. Also safe context releasing: transition 'core->cur_sess' pointer clearings to use smp_store_release(). This ensures all prior internal memory structures are entirely flushed and visible to other execution cores. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 2 +- drivers/staging/media/meson/vdec/vdec.c | 88 ++++++++++++++------- 2 files changed, 59 insertions(+), 31 deletions(-) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/media/meson/vdec/esparser.c index e5d3d817b9b2b..959673742e699 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -379,7 +379,7 @@ void esparser_queue_all_src(struct work_struct *work) scoped_guard(mutex, &sess->lock) { /* Safe atomic tracking check: exit loop if session is shutting down */ - if (sess->should_stop) + if (READ_ONCE(sess->should_stop)) return; /* Queue completely empty: exit work loop cleanly */ diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c index 6fe9722577179..83a9b1238972a 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -287,9 +287,13 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count) struct amvdec_session *sess = vb2_get_drv_priv(q); struct amvdec_codec_ops *codec_ops = sess->fmt_out->codec_ops; struct amvdec_core *core = sess->core; + struct device *dev = core->dev_dec; struct vb2_v4l2_buffer *buf; int ret; + /* Reset workqueue loop shutdown signal to allow streaming */ + WRITE_ONCE(sess->should_stop, 0); + if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) sess->streamon_out = 1; else @@ -336,7 +340,7 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count) dma_alloc_coherent(sess->core->dev, sess->vififo_size, &sess->vififo_paddr, GFP_KERNEL); if (!sess->vififo_vaddr) { - dev_err(sess->core->dev, "Failed to request VIFIFO buffer\n"); + dev_err(dev, "Failed to request VIFIFO buffer\n"); ret = -ENOMEM; goto err_cleanup_session; } @@ -388,10 +392,12 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count) sess->streamon_cap = 0; mutex_lock(&core->lock); - if (core->cur_sess == sess) - core->cur_sess = NULL; - if (sess->status != STATUS_NEEDS_RESUME) - sess->status = STATUS_STOPPED; + if (core->cur_sess == sess) { + /* Safely clear hardware ownership since we were confirmed as the owner */ + smp_store_release(&core->cur_sess, NULL); + if (sess->status != STATUS_NEEDS_RESUME) + sess->status = STATUS_STOPPED; + } mutex_unlock(&core->lock); err_unlock_no_hw: while ((buf = v4l2_m2m_src_buf_remove(sess->m2m_ctx))) @@ -441,6 +447,9 @@ static void vdec_stop_streaming(struct vb2_queue *q) enum amvdec_status old_status; bool full_cleanup = false; + /* Signal workqueue loop to abort instantly */ + WRITE_ONCE(sess->should_stop, 1); + /* flush buffers to kill background workqueue thread */ if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) { while ((buf = v4l2_m2m_src_buf_remove(sess->m2m_ctx))) @@ -493,26 +502,33 @@ static void vdec_stop_streaming(struct vb2_queue *q) cancel_work_sync(&sess->esparser_queue_work); mutex_lock(&core->lock); - vdec_poweroff(sess); - vdec_free_canvas(sess); + if (core->cur_sess == sess) { + vdec_poweroff(sess); + vdec_free_canvas(sess); + + if (sess->vififo_vaddr) { + dma_free_coherent(sess->core->dev, + sess->vififo_size, + sess->vififo_vaddr, + sess->vififo_paddr); + sess->vififo_vaddr = NULL; + sess->vififo_paddr = 0; + } - if (sess->vififo_vaddr) { - dma_free_coherent(sess->core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); - sess->vififo_vaddr = NULL; - sess->vififo_paddr = 0; - } + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); - vdec_reset_timestamps(sess); - vdec_reset_bufs_recycle(sess); - core->cur_sess = NULL; + kfree(sess->priv); + sess->priv = NULL; - kfree(sess->priv); - sess->priv = NULL; + /* Safely clear hardware ownership since we were confirmed as the owner */ + smp_store_release(&core->cur_sess, NULL); + } } else { if (sess->status == STATUS_NEEDS_RESUME) sess->changed_format = 0; } + mutex_unlock(&core->lock); } @@ -802,7 +818,7 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd) if (cmd->cmd == V4L2_DEC_CMD_START) { v4l2_m2m_clear_state(sess->m2m_ctx); - sess->should_stop = 0; + WRITE_ONCE(sess->should_stop, 0); return 0; } @@ -812,7 +828,7 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd) dev_dbg(dev, "Received V4L2_DEC_CMD_STOP\n"); - sess->should_stop = 1; + WRITE_ONCE(sess->should_stop, 1); v4l2_m2m_mark_stopped(sess->m2m_ctx); @@ -998,6 +1014,9 @@ static int vdec_close(struct file *file) struct amvdec_session *sess = file_to_amvdec_session(file); struct amvdec_core *core = sess->core; + /* Signal workqueue loop to abort instantly */ + WRITE_ONCE(sess->should_stop, 1); + /* Synchronize and flush pending hardware interrupt service routines */ synchronize_irq(core->vdec_irq); /* Ensure esparser ISR finishes executing */ @@ -1012,21 +1031,30 @@ static int vdec_close(struct file *file) mutex_lock(&core->lock); - vdec_poweroff(sess); - vdec_free_canvas(sess); - core->cur_sess = NULL; + if (core->cur_sess == sess) { + vdec_poweroff(sess); + vdec_free_canvas(sess); - if (sess->vififo_vaddr) { - dma_free_coherent(core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); - sess->vififo_vaddr = NULL; - sess->vififo_paddr = 0; + if (sess->vififo_vaddr) { + dma_free_coherent(core->dev, + sess->vififo_size, + sess->vififo_vaddr, + sess->vififo_paddr); + sess->vififo_vaddr = NULL; + sess->vififo_paddr = 0; + } + vdec_reset_timestamps(sess); + vdec_reset_bufs_recycle(sess); } - vdec_reset_timestamps(sess); - vdec_reset_bufs_recycle(sess); + kfree(sess->priv); sess->priv = NULL; + /* Unconditionally set our local status to stopped */ + sess->status = STATUS_STOPPED; + /* Safely clear hardware ownership since we were confirmed as the owner */ + smp_store_release(&core->cur_sess, NULL); + mutex_unlock(&core->lock); v4l2_m2m_ctx_release(sess->m2m_ctx); -- 2.50.1 _______________________________________________ linux-amlogic mailing list linux-amlogic@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-amlogic