From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D3748C43458 for ; Mon, 13 Jul 2026 12:32:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=zGWrJmeW+vW2uEWP84Wilyzm7JzVedlFmLbkKUR9wQE=; b=Ls6oSw2j7HS41g geF32equuS1hKl6+fUo9/wIhAOdHmQGJIMkkrew8cVUb7bLNn8ZcEA535+Oz2/aSFQ7kI9adNtYnR hSgZUNpeKQNZtn/ro2qn2ZosriQ0XXXSC6rtBhRz0vT015kwMdU9mKne+O0QCZREDgcq7IF3GlF0Y 8mveUUv3Qu17umjsiXEpOj7zJh5vc1q/wSeuyK7c1dQ5KJkTFC6bQJ8bg78yoJUTG3z8YhcHExU/J lpEiDToL1vNNMrJpxalGutOEpidV04q9VdTVU3kUJ3sJ+EFIM+A3Tz9NAQEvOt6iXfbf8CnPGbcNB JU75avWKR6k0MzUJpLRQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFpn-00000009Ckk-1Dyl; Mon, 13 Jul 2026 12:32:31 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFpl-00000009CkU-2Kjc for linux-amlogic@lists.infradead.org; Mon, 13 Jul 2026 12:32:30 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id C64456004E; Mon, 13 Jul 2026 12:32:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4172B1F000E9; Mon, 13 Jul 2026 12:32:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783945948; bh=dW75QfnLqOtsZkfIoVxbjcFvye9KNi4ujoDy3+7dhfI=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=H5Haj0WHOANsHBtzte03AjnHlVpGzZauYPzFyo4Txa1trxHhG4Vnnr/1yR1pzlHe1 szGZCsyLK6JzQGGIFbPIXtrPsG+tVdYyOzflgcKfw9YWLJou8Spymk2+Mq7R939ao6 AKW2BhBQVXC+QgpQV1zxOdTvayJt+yXzxS+9JPf1hvPj0X6Bnx7ickzembX9CXLSsM Qk6/mns+M8g71AkkKYt5GOe1qWyKeoBxYI6eTnRRMAEDxtSSfLOeYpzI1yuBW8cBIf VDTZ6UKq2XdpYSQWM/E5lM7Ct5M7IrnFXOmGiekETrjE5z2+RTPEdQDJKQunghga9r QkndrZXF1ClTA== From: sashiko-bot@kernel.org Subject: Re: [PATCH v7 03/19] media: meson: vdec: Fix lifecycle leaks and race conditions in recycle_thread To: "Anand Moon" Cc: linux-amlogic@lists.infradead.org, dri-devel@lists.freedesktop.org, neil.armstrong@linaro.org In-Reply-To: <20260713120840.17427-4-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> <20260713120840.17427-4-linux.amoon@gmail.com> Date: Mon, 13 Jul 2026 12:32:27 +0000 Message-Id: <20260713123228.4172B1F000E9@smtp.kernel.org> X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg NiBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtDcml0aWNh bF0gdmRlY19jbG9zZSgpIGZyZWVzIHNlc3Npb24gbWVtb3J5IGJlZm9yZSByZWxlYXNpbmcgdGhl IFY0TDIgTTJNIGNvbnRleHQsIHRyaWdnZXJpbmcgYSBOVUxMIHBvaW50ZXIgZGVyZWZlcmVuY2Ug ZHVyaW5nIHF1ZXVlIHRlYXJkb3duLgotIFtDcml0aWNhbF0gVW5jb25kaXRpb25hbCBleGVjdXRp b24gb2YgdmRlY19wb3dlcm9mZigpIGFuZCBjbGVhcmluZyBvZiBjb3JlLT5jdXJfc2VzcyBpbiB2 ZGVjX2Nsb3NlKCkgY2F1c2VzIERhdGEgQWJvcnQgcGFuaWNzIGFuZCBjcm9zcy1zZXNzaW9uIGNv cnJ1cHRpb24uCi0gW0NyaXRpY2FsXSBVbmNvbmRpdGlvbmFsIGV4ZWN1dGlvbiBvZiB2ZGVjX3Bv d2Vyb2ZmKCkgaW4gdmRlY19jbG9zZSgpIGxlYWRzIHRvIGEgZG91YmxlIGZyZWUgb2YgY29kZWMg RE1BIGFsbG9jYXRpb25zLgotIFtIaWdoXSB2ZGVjX2Nsb3NlKCkgcHJlbWF0dXJlbHkgZnJlZXMg c2Vzc2lvbiBjb250ZXh0IGFuZCBETUEgYnVmZmVycyB3aXRob3V0IGNhbmNlbGluZyBiYWNrZ3Jv dW5kIHdvcmtxdWV1ZXMsIGNhdXNpbmcgVXNlLUFmdGVyLUZyZWUgYW5kIERNQSBjb3JydXB0aW9u LgoKUHJlLWV4aXN0aW5nIGlzc3VlczoKLSBbSGlnaF0gRmxhd2VkIGxvZ2ljIGluIHZkZWNfc3Rv cF9zdHJlYW1pbmcoKSBvcnBoYW5zIHRoZSByZWN5Y2xlIHRocmVhZCwgbGVhZGluZyB0byBVc2Ut QWZ0ZXItRnJlZSBkdXJpbmcgcGFydGlhbCBTVFJFQU1PRkYuCi0gW01lZGl1bV0gVGhlIGVycl9w b3dlcm9mZiB1bndpbmRpbmcgcGF0aCBpbiB2ZGVjX3N0YXJ0X3N0cmVhbWluZygpIGxlYWtzIHNl c3MtPnByaXYgYW5kIGFzc29jaWF0ZWQgY29kZWMgYXNzZXRzLgotLQoKLS0tIFBhdGNoIFszXTog W1BBVENIIHY3IDAzLzE5XSBtZWRpYTogbWVzb246IHZkZWM6IEZpeCBsaWZlY3ljbGUgbGVha3Mg YW5kIHJhY2UgY29uZGl0aW9ucyBpbiByZWN5Y2xlX3RocmVhZCAtLS0KY29tbWl0IDQxZGFjMTM4 Yzg1MTVhYTYyM2IyNDhiNGExMTBkOGE3ODAyYjYwNGIKQXV0aG9yOiBBbmFuZCBNb29uIDxsaW51 eC5hbW9vbkBnbWFpbC5jb20+ClN1YmplY3Q6IG1lZGlhOiBtZXNvbjogdmRlYzogRml4IGxpZmVj eWNsZSBsZWFrcyBhbmQgcmFjZSBjb25kaXRpb25zIGluIHJlY3ljbGVfdGhyZWFkCgpUaGlzIHBh dGNoIHZhbGlkYXRlcyB0aGUga3RocmVhZF9ydW4gcmV0dXJuIHN0YXR1cyBkdXJpbmcgcmVjeWNs aW5nIHRocmVhZAppbml0aWFsaXphdGlvbiB0byBwcmV2ZW50IG1lbW9yeSBsZWFrcy4gSXQgYWxz byBlbnN1cmVzIHRoZSB0aHJlYWQgaXMgc2FmZWx5CnN0b3BwZWQgaW4gYm90aCB2ZGVjX3N0b3Bf c3RyZWFtaW5nIGFuZCB2ZGVjX2Nsb3NlIHRvIHByZXZlbnQga2VybmVsIHBhbmljcwpkdXJpbmcg dGVhcmRvd24uCgpDbG9zZXM6IGh0dHBzOi8vbG9yZS5rZXJuZWwub3JnL2FsbC8yMDI2MDUyMTA5 MDk0NC5GMzU0MDFGMDBBM0RAc210cC5rZXJuZWwub3JnLwoKZGlmZiAtLWdpdCBhL2RyaXZlcnMv c3RhZ2luZy9tZWRpYS9tZXNvbi92ZGVjL3ZkZWMuYyBiL2RyaXZlcnMvc3RhZ2luZy9tZWRpYS9t ZXNvbi92ZGVjL3ZkZWMuYwotLS0gYS9kcml2ZXJzL3N0YWdpbmcvbWVkaWEvbWVzb24vdmRlYy92 ZGVjLmMKKysrIGIvZHJpdmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvdmRlYy5jClsgLi4u IF0KQEAgLTM1MywxMyArMzU3LDIzIEBAIHN0YXRpYyBpbnQgdmRlY19zdGFydF9zdHJlYW1pbmco c3RydWN0IHZiMl9xdWV1ZSAqcSwgdW5zaWduZWQgaW50IGNvdW50KQo+ICAJc2NoZWR1bGVfd29y aygmc2Vzcy0+ZXNwYXJzZXJfcXVldWVfd29yayk7Cj4gIAlyZXR1cm4gMDsKPiAgCj4gIGVycl9w b3dlcm9mZjoKPiAgCXZkZWNfcG93ZXJvZmYoc2Vzcyk7Cj4gIAl2ZGVjX2ZyZWVfY2FudmFzKHNl c3MpOwo+ICAJdmRlY19yZXNldF90aW1lc3RhbXBzKHNlc3MpOwo+ICAJdmRlY19yZXNldF9idWZz X3JlY3ljbGUoc2Vzcyk7CgpbU2V2ZXJpdHk6IE1lZGl1bV0KVGhpcyBpcyBhIHByZS1leGlzdGlu ZyBpc3N1ZSwgYnV0IGRvZXMgdGhlIGVycl9wb3dlcm9mZiB1bndpbmRpbmcgcGF0aCBsZWFrCnNl c3MtPnByaXY/CgpJZiBrdGhyZWFkX3J1bigpIGZhaWxzLCBleGVjdXRpb24ganVtcHMgdG8gdGhl IGVycl9wb3dlcm9mZiBsYWJlbCB3aGljaAp1bndpbmRzIHZhcmlvdXMgaGFyZHdhcmUgc3RhdGVz IGJ1dCBtaXNzZXMgY2FsbGluZyBrZnJlZShzZXNzLT5wcml2KS4KV2hlbiB0aGUgYXBwbGljYXRp b24gcmV0cmllcyBWSURJT0NfU1RSRUFNT04sIHRoZSBjb2RlYydzIHN0YXJ0IHJvdXRpbmUKdW5j b25kaXRpb25hbGx5IGFsbG9jYXRlcyBhIG5ldyBzdHJ1Y3R1cmUgb3ZlciBzZXNzLT5wcml2LCBw ZXJtYW5lbnRseQpzdHJhbmRpbmcgdGhlIHByZXZpb3VzIGFsbG9jYXRpb24uCgo+ICBlcnJfZnJl ZV92aWZpZm86Cj4gIAlpZiAoc2Vzcy0+dmlmaWZvX3ZhZGRyKSB7Cj4gIAkJZG1hX2ZyZWVfY29o ZXJlbnQoc2Vzcy0+Y29yZS0+ZGV2LCBzZXNzLT52aWZpZm9fc2l6ZSwKWyAuLi4gXQpAQCAtNDY0 LDcgKzQ3OCwxMCBAQCBzdGF0aWMgdm9pZCB2ZGVjX3N0b3Bfc3RyZWFtaW5nKHN0cnVjdCB2YjJf cXVldWUgKnEpCj4gIAlpZiAoZnVsbF9jbGVhbnVwKSB7Cj4gIAkJaWYgKChxLT50eXBlICE9IFY0 TDJfQlVGX1RZUEVfVklERU9fQ0FQVFVSRV9NUExBTkUgfHwKPiAgCQkgICAgICFzZXNzLT5zdHJl YW1vbl9vdXQpICYmIHZkZWNfY29kZWNfbmVlZHNfcmVjeWNsZShzZXNzKSkgewoKW1NldmVyaXR5 OiBIaWdoXQpUaGlzIGlzIGEgcHJlLWV4aXN0aW5nIGlzc3VlLCBidXQgZG9lcyB0aGlzIGxvZ2lj IG9ycGhhbiB0aGUgcmVjeWNsZSB0aHJlYWQKbGVhZGluZyB0byBhIHVzZS1hZnRlci1mcmVlIGR1 cmluZyBwYXJ0aWFsIFNUUkVBTU9GRj8KCklmIHVzZXJzcGFjZSBpbnZva2VzIFZJRElPQ19TVFJF QU1PRkYgZXhjbHVzaXZlbHkgb24gdGhlIGNhcHR1cmUgcXVldWUKd2hpbGUgdGhlIG91dHB1dCBx dWV1ZSByZW1haW5zIGFjdGl2ZSwgdGhpcyBjb25kaXRpb24gZXZhbHVhdGVzIHRvIGZhbHNlLApi eXBhc3NpbmcgdGhlIGt0aHJlYWRfc3RvcCgpIGNhbGwuCgpCZWNhdXNlIG9sZF9zdGF0dXMgPT0g U1RBVFVTX1JVTk5JTkcsIGZ1bGxfY2xlYW51cCBldmFsdWF0ZXMgdG8gdHJ1ZSwKcHJvY2VlZGlu ZyB0byBkaXNtYW50bGUgdGhlIHNlc3Npb24gY29udGV4dCBhbmQgZnJlZSBzZXNzLT5wcml2LgpU aGUgb3JwaGFuZWQgcmVjeWNsZSB0aHJlYWQgbWF5IGNvbmN1cnJlbnRseSBhd2FrZW4gYW5kIGF0 dGVtcHQgdG8gYWNjZXNzCnRoaXMgZnJlZWQgbWVtb3J5LgoKPiAtCQkJa3RocmVhZF9zdG9wKHNl c3MtPnJlY3ljbGVfdGhyZWFkKTsKPiArCQkJaWYgKCFJU19FUlJfT1JfTlVMTChzZXNzLT5yZWN5 Y2xlX3RocmVhZCkpIHsKPiArCQkJCWt0aHJlYWRfc3RvcChzZXNzLT5yZWN5Y2xlX3RocmVhZCk7 Cj4gKwkJCQlzZXNzLT5yZWN5Y2xlX3RocmVhZCA9IE5VTEw7Cj4gKwkJCX0KPiAgCQl9ClsgLi4u IF0KQEAgLTk3MCw2ICs5ODcsMzEgQEAgc3RhdGljIGludCB2ZGVjX29wZW4oc3RydWN0IGZpbGUg KmZpbGUpCj4gIHN0YXRpYyBpbnQgdmRlY19jbG9zZShzdHJ1Y3QgZmlsZSAqZmlsZSkKPiAgewo+ ICAJc3RydWN0IGFtdmRlY19zZXNzaW9uICpzZXNzID0gZmlsZV90b19hbXZkZWNfc2Vzc2lvbihm aWxlKTsKPiArCXN0cnVjdCBhbXZkZWNfY29yZSAqY29yZSA9IHNlc3MtPmNvcmU7Cj4gKwo+ICsJ aWYgKCFJU19FUlJfT1JfTlVMTChzZXNzLT5yZWN5Y2xlX3RocmVhZCkpIHsKPiArCQlrdGhyZWFk X3N0b3Aoc2Vzcy0+cmVjeWNsZV90aHJlYWQpOwo+ICsJCXNlc3MtPnJlY3ljbGVfdGhyZWFkID0g TlVMTDsKPiArCX0KPiArCj4gKwltdXRleF9sb2NrKCZjb3JlLT5sb2NrKTsKPiArCj4gKwl2ZGVj X3Bvd2Vyb2ZmKHNlc3MpOwo+ICsJdmRlY19mcmVlX2NhbnZhcyhzZXNzKTsKPiArCWNvcmUtPmN1 cl9zZXNzID0gTlVMTDsKCltTZXZlcml0eTogQ3JpdGljYWxdCkNhbiB0aGlzIHVuY29uZGl0aW9u YWwgaW52b2NhdGlvbiBvZiB2ZGVjX3Bvd2Vyb2ZmKCkgYW5kIGNsZWFyaW5nIG9mCmNvcmUtPmN1 cl9zZXNzIGNhdXNlIERhdGEgQWJvcnQgcGFuaWNzIGFuZCBjcm9zcy1zZXNzaW9uIGNvcnJ1cHRp b24/CgpJZiB1c2Vyc3BhY2Ugb3BlbnMgdHdvIGluc3RhbmNlcyAoRkRzKSwgc3RhcnRzIHN0cmVh bWluZyBvbiBpbnN0YW5jZSBBCihhY3F1aXJpbmcgaGFyZHdhcmUgb3duZXJzaGlwKSwgYW5kIHRo ZW4gY2xvc2VzIGluc3RhbmNlIEI6Cgp2ZGVjX2Nsb3NlKCkgZm9yIGluc3RhbmNlIEIgd2lsbCB1 bmNvbmRpdGlvbmFsbHkgY2FsbCB2ZGVjX3Bvd2Vyb2ZmKHNlc3MpCmFuZCBjbGVhciBjb3JlLT5j dXJfc2Vzcywgd2l0aG91dCB2ZXJpZnlpbmcgaWYgaW5zdGFuY2UgQiBhY3R1YWxseSBvd25zIHRo ZQpoYXJkd2FyZS4KClRoaXMgZm9yY2VzIGNsb2NrIGRpc2FibGVtZW50cyB3aGlsZSBpbnN0YW5j ZSBBIGlzIGFjdGl2ZWx5IGRlY29kaW5nLiBXaGVuCnRoZSBoYXJkd2FyZSBmb3IgaW5zdGFuY2Ug QSBmaXJlcyBhbiBpbnRlcnJ1cHQsIHZkZWNfaXNyKCkgd2lsbCBkZXJlZmVyZW5jZQpjb3JlLT5j dXJfc2Vzcywgd2hpY2ggd2FzIGp1c3Qgd3JvbmdmdWxseSBzZXQgdG8gTlVMTCwgY2F1c2luZyBh IHBhbmljLgoKW1NldmVyaXR5OiBDcml0aWNhbF0KV2lsbCB0aGlzIHVuY29uZGl0aW9uYWwgdmRl Y19wb3dlcm9mZigpIGNhbGwgYWxzbyBsZWFkIHRvIGEgZG91YmxlIGZyZWUgb2YKY29kZWMgRE1B IGFsbG9jYXRpb25zPwoKSWYgdXNlcnNwYWNlIGNsZWFubHkgc2h1dHMgZG93biBzdHJlYW1pbmcg dmlhIFZJRElPQ19TVFJFQU1PRkYsCnZkZWNfc3RvcF9zdHJlYW1pbmcoKSBleGVjdXRlcyB2ZGVj X3Bvd2Vyb2ZmKCkuIFRoaXMgaW52b2tlcyB0aGUgY29kZWMKc3RvcCBjYWxsYmFjayAobGlrZSBj b2RlY19oMjY0X3N0b3ApIHdoaWNoIGZyZWVzIG1lbW9yeSBidWZmZXJzIGJ1dCBkb2VzCm5vdCBz ZXQgdGhlaXIgcG9pbnRlcnMgdG8gTlVMTC4KCldoZW4gdXNlcnNwYWNlIHN1YnNlcXVlbnRseSBj YWxscyBjbG9zZSgpLCB2ZGVjX2Nsb3NlKCkgY2FsbHMKdmRlY19wb3dlcm9mZigpIGFnYWluLiBU aGUgY29kZWMgc3RvcCByb3V0aW5lIHdpbGwgZXhlY3V0ZSBhIHNlY29uZCB0aW1lLApwYXNzaW5n IHRoZSBzYW1lIG5vbi1OVUxMIHBvaW50ZXJzIHRvIGRtYV9mcmVlX2NvaGVyZW50KCkgcmVzdWx0 aW5nIGluIGEKY2F0YXN0cm9waGljIGRvdWJsZS1mcmVlLgoKPiArCj4gKwlpZiAoc2Vzcy0+dmlm aWZvX3ZhZGRyKSB7Cj4gKwkJZG1hX2ZyZWVfY29oZXJlbnQoY29yZS0+ZGV2LCBzZXNzLT52aWZp Zm9fc2l6ZSwKPiArCQkJCSAgc2Vzcy0+dmlmaWZvX3ZhZGRyLCBzZXNzLT52aWZpZm9fcGFkZHIp Owo+ICsJCXNlc3MtPnZpZmlmb192YWRkciA9IE5VTEw7Cj4gKwkJc2Vzcy0+dmlmaWZvX3BhZGRy ID0gMDsKPiArCX0KPiArCXZkZWNfcmVzZXRfdGltZXN0YW1wcyhzZXNzKTsKPiArCXZkZWNfcmVz ZXRfYnVmc19yZWN5Y2xlKHNlc3MpOwo+ICsJa2ZyZWUoc2Vzcy0+cHJpdik7CgpbU2V2ZXJpdHk6 IEhpZ2hdClNob3VsZCB3ZSBjYWxsIGNhbmNlbF93b3JrX3N5bmMoJnNlc3MtPmVzcGFyc2VyX3F1 ZXVlX3dvcmspIGJlZm9yZSBmcmVlaW5nCnRoZSBzZXNzaW9uIGNvbnRleHQgYW5kIERNQSBidWZm ZXJzIGhlcmU/CgpJZiB2ZGVjX2Nsb3NlKCkgaXMgY2FsbGVkIHdoaWxlIHRoZSBiYWNrZ3JvdW5k IHdvcmtxdWV1ZSBpcyBhY3RpdmVseQpwcm9jZXNzaW5nIGZyYW1lcywgdGhlIERNQSBidWZmZXIg KHNlc3MtPnZpZmlmb192YWRkcikgYW5kIHNlc3Npb24Kc3RydWN0dXJlIChzZXNzLT5wcml2KSBh cmUgaW1tZWRpYXRlbHkgZnJlZWQuCgpUaGUgY29uY3VycmVudGx5IGV4ZWN1dGluZyB3b3JrcXVl dWUgY29udGludWVzIGl0cyBvcGVyYXRpb24gaW5zaWRlCmVzcGFyc2VyX3F1ZXVlKCksIGRlcmVm ZXJlbmNpbmcgdGhlIGZyZWVkIHNlc3MtPnByaXYgcG9pbnRlciBhbmQKaW5zdHJ1Y3RpbmcgdGhl IGhhcmR3YXJlIHRvIHBlcmZvcm0gRE1BIHRyYW5zZmVycyBpbnRvIHRoZSBmcmVzaGx5IGZyZWVk CnBoeXNpY2FsIGFkZHJlc3MsIHBvdGVudGlhbGx5IGNhdXNpbmcgc2V2ZXJlIG1lbW9yeSBjb3Jy dXB0aW9uLgoKPiArCXNlc3MtPnByaXYgPSBOVUxMOwo+ICsKPiArCW11dGV4X3VubG9jaygmY29y ZS0+bG9jayk7Cj4gIAo+ICAJdjRsMl9tMm1fY3R4X3JlbGVhc2Uoc2Vzcy0+bTJtX2N0eCk7Cgpb U2V2ZXJpdHk6IENyaXRpY2FsXQpEb2VzIHRoaXMgc2VxdWVuY2UgdHJpZ2dlciBhIE5VTEwgcG9p bnRlciBkZXJlZmVyZW5jZSBkdXJpbmcgcXVldWUgdGVhcmRvd24/CgpJZiBhIHVzZXIgY2xvc2Vz IHRoZSBmaWxlIGRlc2NyaXB0b3Igd2l0aG91dCBjYWxsaW5nIFZJRElPQ19TVFJFQU1PRkYsCnZk ZWNfY2xvc2UoKSB3aWxsIGZyZWUgc2Vzcy0+cHJpdiBhbmQgc2V0IGl0IHRvIE5VTEwuCgpJbW1l ZGlhdGVseSBhZnRlciwgaXQgY2FsbHMgdjRsMl9tMm1fY3R4X3JlbGVhc2UoKSwgd2hpY2ggdHJp Z2dlcnMKdmRlY19zdG9wX3N0cmVhbWluZygpLiBTaW5jZSBzZXNzLT5zdGF0dXMgaXMgc3RpbGwg U1RBVFVTX1JVTk5JTkcsIHRoZQpkcml2ZXIgd2lsbCBleGVjdXRlIGNvZGVjX29wcy0+ZHJhaW4o c2VzcykuCgpUaGUgY29kZWMncyBkcmFpbiBmdW5jdGlvbiB1bmNvbmRpdGlvbmFsbHkgZGVyZWZl cmVuY2VzIHNlc3MtPnByaXYsIHdoaWNoCndhcyBqdXN0IHNldCB0byBOVUxMLCBjYXVzaW5nIGFu IGltbWVkaWF0ZSBwYW5pYy4KCj4gIAl2NGwyX2ZoX2RlbCgmc2Vzcy0+ZmgsIGZpbGUpOwoKLS0g ClNhc2hpa28gQUkgcmV2aWV3IMK3IGh0dHBzOi8vc2FzaGlrby5kZXYvIy9wYXRjaHNldC8yMDI2 MDcxMzEyMDg0MC4xNzQyNy0xLWxpbnV4LmFtb29uQGdtYWlsLmNvbT9wYXJ0PTMKCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCmxpbnV4LWFtbG9naWMgbWFp bGluZyBsaXN0CmxpbnV4LWFtbG9naWNAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMu aW5mcmFkZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWFtbG9naWMK From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A906BC43458 for ; Mon, 13 Jul 2026 12:32:31 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 0F3B210E5C3; Mon, 13 Jul 2026 12:32:31 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.b="H5Haj0WH"; dkim-atps=neutral Received: from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254]) by gabe.freedesktop.org (Postfix) with ESMTPS id 8E53B10E5C3 for ; Mon, 13 Jul 2026 12:32:29 +0000 (UTC) Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id C64456004E; Mon, 13 Jul 2026 12:32:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4172B1F000E9; Mon, 13 Jul 2026 12:32:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783945948; bh=dW75QfnLqOtsZkfIoVxbjcFvye9KNi4ujoDy3+7dhfI=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=H5Haj0WHOANsHBtzte03AjnHlVpGzZauYPzFyo4Txa1trxHhG4Vnnr/1yR1pzlHe1 szGZCsyLK6JzQGGIFbPIXtrPsG+tVdYyOzflgcKfw9YWLJou8Spymk2+Mq7R939ao6 AKW2BhBQVXC+QgpQV1zxOdTvayJt+yXzxS+9JPf1hvPj0X6Bnx7ickzembX9CXLSsM Qk6/mns+M8g71AkkKYt5GOe1qWyKeoBxYI6eTnRRMAEDxtSSfLOeYpzI1yuBW8cBIf VDTZ6UKq2XdpYSQWM/E5lM7Ct5M7IrnFXOmGiekETrjE5z2+RTPEdQDJKQunghga9r QkndrZXF1ClTA== From: sashiko-bot@kernel.org Subject: Re: [PATCH v7 03/19] media: meson: vdec: Fix lifecycle leaks and race conditions in recycle_thread To: "Anand Moon" Cc: linux-amlogic@lists.infradead.org, dri-devel@lists.freedesktop.org, neil.armstrong@linaro.org In-Reply-To: <20260713120840.17427-4-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> <20260713120840.17427-4-linux.amoon@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 13 Jul 2026 12:32:27 +0000 Message-Id: <20260713123228.4172B1F000E9@smtp.kernel.org> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Thank you for your contribution! Sashiko AI review found 6 potential issue(= s) to consider: New issues: - [Critical] vdec_close() frees session memory before releasing the V4L2 M2= M context, triggering a NULL pointer dereference during queue teardown. - [Critical] Unconditional execution of vdec_poweroff() and clearing of cor= e->cur_sess in vdec_close() causes Data Abort panics and cross-session corr= uption. - [Critical] Unconditional execution of vdec_poweroff() in vdec_close() lea= ds to a double free of codec DMA allocations. - [High] vdec_close() prematurely frees session context and DMA buffers wit= hout canceling background workqueues, causing Use-After-Free and DMA corrup= tion. Pre-existing issues: - [High] Flawed logic in vdec_stop_streaming() orphans the recycle thread, = leading to Use-After-Free during partial STREAMOFF. - [Medium] The err_poweroff unwinding path in vdec_start_streaming() leaks = sess->priv and associated codec assets. -- --- Patch [3]: [PATCH v7 03/19] media: meson: vdec: Fix lifecycle leaks and= race conditions in recycle_thread --- commit 41dac138c8515aa623b248b4a110d8a7802b604b Author: Anand Moon Subject: media: meson: vdec: Fix lifecycle leaks and race conditions in rec= ycle_thread This patch validates the kthread_run return status during recycling thread initialization to prevent memory leaks. It also ensures the thread is safely stopped in both vdec_stop_streaming and vdec_close to prevent kernel panics during teardown. Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/medi= a/meson/vdec/vdec.c --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c [ ... ] @@ -353,13 +357,23 @@ static int vdec_start_streaming(struct vb2_queue *q, = unsigned int count) > schedule_work(&sess->esparser_queue_work); > return 0; > =20 > err_poweroff: > vdec_poweroff(sess); > vdec_free_canvas(sess); > vdec_reset_timestamps(sess); > vdec_reset_bufs_recycle(sess); [Severity: Medium] This is a pre-existing issue, but does the err_poweroff unwinding path leak sess->priv? If kthread_run() fails, execution jumps to the err_poweroff label which unwinds various hardware states but misses calling kfree(sess->priv). When the application retries VIDIOC_STREAMON, the codec's start routine unconditionally allocates a new structure over sess->priv, permanently stranding the previous allocation. > err_free_vififo: > if (sess->vififo_vaddr) { > dma_free_coherent(sess->core->dev, sess->vififo_size, [ ... ] @@ -464,7 +478,10 @@ static void vdec_stop_streaming(struct vb2_queue *q) > if (full_cleanup) { > if ((q->type !=3D V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE || > !sess->streamon_out) && vdec_codec_needs_recycle(sess)) { [Severity: High] This is a pre-existing issue, but does this logic orphan the recycle thread leading to a use-after-free during partial STREAMOFF? If userspace invokes VIDIOC_STREAMOFF exclusively on the capture queue while the output queue remains active, this condition evaluates to false, bypassing the kthread_stop() call. Because old_status =3D=3D STATUS_RUNNING, full_cleanup evaluates to true, proceeding to dismantle the session context and free sess->priv. The orphaned recycle thread may concurrently awaken and attempt to access this freed memory. > - kthread_stop(sess->recycle_thread); > + if (!IS_ERR_OR_NULL(sess->recycle_thread)) { > + kthread_stop(sess->recycle_thread); > + sess->recycle_thread =3D NULL; > + } > } [ ... ] @@ -970,6 +987,31 @@ static int vdec_open(struct file *file) > static int vdec_close(struct file *file) > { > struct amvdec_session *sess =3D file_to_amvdec_session(file); > + struct amvdec_core *core =3D sess->core; > + > + if (!IS_ERR_OR_NULL(sess->recycle_thread)) { > + kthread_stop(sess->recycle_thread); > + sess->recycle_thread =3D NULL; > + } > + > + mutex_lock(&core->lock); > + > + vdec_poweroff(sess); > + vdec_free_canvas(sess); > + core->cur_sess =3D NULL; [Severity: Critical] Can this unconditional invocation of vdec_poweroff() and clearing of core->cur_sess cause Data Abort panics and cross-session corruption? If userspace opens two instances (FDs), starts streaming on instance A (acquiring hardware ownership), and then closes instance B: vdec_close() for instance B will unconditionally call vdec_poweroff(sess) and clear core->cur_sess, without verifying if instance B actually owns the hardware. This forces clock disablements while instance A is actively decoding. When the hardware for instance A fires an interrupt, vdec_isr() will dereference core->cur_sess, which was just wrongfully set to NULL, causing a panic. [Severity: Critical] Will this unconditional vdec_poweroff() call also lead to a double free of codec DMA allocations? If userspace cleanly shuts down streaming via VIDIOC_STREAMOFF, vdec_stop_streaming() executes vdec_poweroff(). This invokes the codec stop callback (like codec_h264_stop) which frees memory buffers but does not set their pointers to NULL. When userspace subsequently calls close(), vdec_close() calls vdec_poweroff() again. The codec stop routine will execute a second time, passing the same non-NULL pointers to dma_free_coherent() resulting in a catastrophic double-free. > + > + if (sess->vififo_vaddr) { > + dma_free_coherent(core->dev, sess->vififo_size, > + sess->vififo_vaddr, sess->vififo_paddr); > + sess->vififo_vaddr =3D NULL; > + sess->vififo_paddr =3D 0; > + } > + vdec_reset_timestamps(sess); > + vdec_reset_bufs_recycle(sess); > + kfree(sess->priv); [Severity: High] Should we call cancel_work_sync(&sess->esparser_queue_work) before freeing the session context and DMA buffers here? If vdec_close() is called while the background workqueue is actively processing frames, the DMA buffer (sess->vififo_vaddr) and session structure (sess->priv) are immediately freed. The concurrently executing workqueue continues its operation inside esparser_queue(), dereferencing the freed sess->priv pointer and instructing the hardware to perform DMA transfers into the freshly freed physical address, potentially causing severe memory corruption. > + sess->priv =3D NULL; > + > + mutex_unlock(&core->lock); > =20 > v4l2_m2m_ctx_release(sess->m2m_ctx); [Severity: Critical] Does this sequence trigger a NULL pointer dereference during queue teardown? If a user closes the file descriptor without calling VIDIOC_STREAMOFF, vdec_close() will free sess->priv and set it to NULL. Immediately after, it calls v4l2_m2m_ctx_release(), which triggers vdec_stop_streaming(). Since sess->status is still STATUS_RUNNING, the driver will execute codec_ops->drain(sess). The codec's drain function unconditionally dereferences sess->priv, which was just set to NULL, causing an immediate panic. > v4l2_fh_del(&sess->fh, file); --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260713120840.1742= 7-1-linux.amoon@gmail.com?part=3D3