From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Wed, 22 Jul 2020 13:06:51 +0000 Subject: [PATCH] staging: vchiq: Fix refcounting bug in buffer_from_host() Message-Id: <20200722130651.GC220681@mwanda> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Nicolas Saenz Julienne , Dave Stevenson Cc: devel@driverdev.osuosl.org, Jacopo Mondi , Greg Kroah-Hartman , kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, Hans Verkuil , bcm-kernel-feedback-list@broadcom.com, Stefan Wahren , Mauro Carvalho Chehab , Jamal Shareef , linux-rpi-kernel@lists.infradead.org If we fail to queue the buffer then it can never be dequeued. This can lead to a forever loop in stop_streaming() when we wait for everything to finish. Fixes: 70ec64ccdaac ("staging: bcm2835-camera: Ensure all buffers are returned on disable") Signed-off-by: Dan Carpenter --- >From static analysis. Not tested. Please review carefully etc. drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c index dc767730db43..65dd2a55b3da 100644 --- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c +++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c @@ -441,6 +441,8 @@ buffer_from_host(struct vchiq_mmal_instance *instance, ret = vchiq_queue_kernel_message(instance->service_handle, &m, sizeof(struct mmal_msg_header) + sizeof(m.u.buffer_from_host)); + if (ret) + atomic_dec(&port->buffers_with_vpu); vchiq_release_service(instance->service_handle); -- 2.27.0