Re: [PATCH v4 3/5] media: uvcvideo: Split uvc_stop_streaming()

[Laurent Pinchart <laurent.pinchart@ideasonboard.com>]

On Mon, Jun 16, 2025 at 03:24:40PM +0000, Ricardo Ribalda wrote:
> uvc_stop_streaming() is used for meta and video nodes. Split the function
> in two to avoid confusion.
> 
> Use this opportunity to rename uvc_start_streaming() to
> uvc_start_streaming_video(), as it is only called by the video nodes.
> 
> Reviewed-by: Hans de Goede <hansg@kernel.org>
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> ---
>  drivers/media/usb/uvc/uvc_queue.c | 22 +++++++++++++++-------
>  1 file changed, 15 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c
> index 8f9737ac729546683ca48f5e71ce3dfacbae2926..3f357c2d48cfd258c26f0342007d1d12f1e01007 100644
> --- a/drivers/media/usb/uvc/uvc_queue.c
> +++ b/drivers/media/usb/uvc/uvc_queue.c
> @@ -167,7 +167,7 @@ static void uvc_buffer_finish(struct vb2_buffer *vb)
>  		uvc_video_clock_update(stream, vbuf, buf);
>  }
>  
> -static int uvc_start_streaming(struct vb2_queue *vq, unsigned int count)
> +static int uvc_start_streaming_video(struct vb2_queue *vq, unsigned int count)
>  {
>  	struct uvc_video_queue *queue = vb2_get_drv_priv(vq);
>  	struct uvc_streaming *stream = uvc_queue_to_stream(queue);
> @@ -186,14 +186,22 @@ static int uvc_start_streaming(struct vb2_queue *vq, unsigned int count)
>  	return ret;
>  }
>  
> -static void uvc_stop_streaming(struct vb2_queue *vq)
> +static void uvc_stop_streaming_video(struct vb2_queue *vq)
>  {
>  	struct uvc_video_queue *queue = vb2_get_drv_priv(vq);
>  
>  	lockdep_assert_irqs_enabled();
>  
> -	if (vq->type != V4L2_BUF_TYPE_META_CAPTURE)
> -		uvc_video_stop_streaming(uvc_queue_to_stream(queue));
> +	uvc_video_stop_streaming(uvc_queue_to_stream(queue));
> +
> +	uvc_queue_return_buffers(queue, UVC_BUF_STATE_ERROR);
> +}
> +
> +static void uvc_stop_streaming_meta(struct vb2_queue *vq)
> +{
> +	struct uvc_video_queue *queue = vb2_get_drv_priv(vq);
> +
> +	lockdep_assert_irqs_enabled();
>  
>  	uvc_queue_return_buffers(queue, UVC_BUF_STATE_ERROR);

I haven't checked where it was introduced, but I think you have a race
here. uvc_queue_return_buffers() will return all buffers currently
sitting in the queue->irqqueue. This can race with a bunch of places in
uvc_video.c that call uvc_queue_get_current_buffer() or
uvc_queue_get_next_buffer(), as those functions return a buffer without
removing it from the list.

>  }
> @@ -203,15 +211,15 @@ static const struct vb2_ops uvc_queue_qops = {
>  	.buf_prepare = uvc_buffer_prepare,
>  	.buf_queue = uvc_buffer_queue,
>  	.buf_finish = uvc_buffer_finish,
> -	.start_streaming = uvc_start_streaming,
> -	.stop_streaming = uvc_stop_streaming,
> +	.start_streaming = uvc_start_streaming_video,
> +	.stop_streaming = uvc_stop_streaming_video,
>  };
>  
>  static const struct vb2_ops uvc_meta_queue_qops = {
>  	.queue_setup = uvc_queue_setup,
>  	.buf_prepare = uvc_buffer_prepare,
>  	.buf_queue = uvc_buffer_queue,
> -	.stop_streaming = uvc_stop_streaming,
> +	.stop_streaming = uvc_stop_streaming_meta,
>  };
>  
>  int uvc_queue_init(struct uvc_video_queue *queue, enum v4l2_buf_type type)

-- 
Regards,

Laurent Pinchart