[PATCH] media: mc: Remove spurious WARN_ON in __media_pipeline_start

[PATCH] media: mc: Remove spurious WARN_ON in __media_pipeline_start

[Niharika Khare]

Vimc driver's entity topology has three capture nodes and two of
those (Raw Capture 0 and RGB/YUV Capture) are reachable from each
other via enabled links. The crash report and the C repro show that
the two capture nodes attempt to invoke a STREAMON session one after
the other, which resulted in the WARNING getting triggered by the
media controller.

  vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0)
  vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0)
  origin->pipe && origin->pipe != pipe
  WARNING: drivers/media/mc/mc-entity.c:785 at __media_pipeline_start+0x1add/0x22b0, CPU#1: syz.0.17/5912

The graph walk originating from Raw Capture 0 (first STREAMON in C
repro on /dev/video0) reaches RGB/YUV Capture and marks its origin
pad's pipe with its own pipe. When RGB/YUV Capture's graph walk starts
(second STREAMON in C repro on /dev/video4), the pad is already
claimed. This is a legitimate userspace request but not something that
kernel should allow while the pad remains claimed. Hence, the kernel
checks the pipe and returns -EBUSY instead of raising a bug, same as
the other non-origin pads. The check on origin pad's pipe needs to stay
otherwise the origin pad case would go through the increment on the
start_count path, even though there exists a loop few lines below this
block to check the pad and return -EBUSY. The check also provides early
failure detection and prevents the complete graph walk.

Fixes: ae219872834a ("media: mc: entity: Rewrite media_pipeline_start()")
Reported-by: syzbot+68e901d044baaea1f60c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=68e901d044baaea1f60c
Tested-by: syzbot+68e901d044baaea1f60c@syzkaller.appspotmail.com
Signed-off-by: Niharika Khare <niharikakhare2101@gmail.com>
---
 drivers/media/mc/mc-entity.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c
index 3fa0bc687..7b4ef2c95 100644
--- a/drivers/media/mc/mc-entity.c
+++ b/drivers/media/mc/mc-entity.c
@@ -778,12 +778,18 @@ __must_check int __media_pipeline_start(struct media_pad *origin,
 
 	lockdep_assert_held(&mdev->graph_mutex);
 
-	/*
-	 * If the pad is already part of a pipeline, that pipeline must be the
-	 * same as the pipe given to media_pipeline_start().
-	 */
-	if (WARN_ON(origin->pipe && origin->pipe != pipe))
-		return -EINVAL;
+	/*
+	 * If the pad is part of a different pipeline than the one passed on to
+	 * media_pipeline_start(), the pad must wait for the ongoing session on
+	 * this previous pipeline to complete before it starts a new session.
+	 * The request for starting the pipeline, although valid, cannot be
+	 * served until the ongoing request finishes.
+	 */
+	if (origin->pipe && origin->pipe != pipe) {
+		dev_dbg(mdev->dev, "Failed to start pipeline: pad '%s':%u busy\n",
+			origin->entity->name, origin->index);
+		return -EBUSY;
+	}
 
 	/*
 	 * If the pipeline has already been started, it is guaranteed to be
-- 
2.53.0

Re: [PATCH] media: mc: Remove spurious WARN_ON in __media_pipeline_start

[Laurent Pinchart]

On Fri, Aug 21, 2026 at 10:28:07PM +0530, Niharika Khare wrote:
> Vimc driver's entity topology has three capture nodes and two of
> those (Raw Capture 0 and RGB/YUV Capture) are reachable from each
> other via enabled links. The crash report and the C repro show that
> the two capture nodes attempt to invoke a STREAMON session one after
> the other, which resulted in the WARNING getting triggered by the
> media controller.
> 
>   vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0)
>   vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0)
>   origin->pipe && origin->pipe != pipe
>   WARNING: drivers/media/mc/mc-entity.c:785 at __media_pipeline_start+0x1add/0x22b0, CPU#1: syz.0.17/5912
> 
> The graph walk originating from Raw Capture 0 (first STREAMON in C
> repro on /dev/video0) reaches RGB/YUV Capture and marks its origin
> pad's pipe with its own pipe. When RGB/YUV Capture's graph walk starts
> (second STREAMON in C repro on /dev/video4), the pad is already
> claimed. This is a legitimate userspace request but not something that

No, that's not supposed to be a legitimate use case. The WARN_ON
indicates a driver bug.

> kernel should allow while the pad remains claimed. Hence, the kernel
> checks the pipe and returns -EBUSY instead of raising a bug, same as
> the other non-origin pads. The check on origin pad's pipe needs to stay
> otherwise the origin pad case would go through the increment on the
> start_count path, even though there exists a loop few lines below this
> block to check the pad and return -EBUSY. The check also provides early
> failure detection and prevents the complete graph walk.
> 
> Fixes: ae219872834a ("media: mc: entity: Rewrite media_pipeline_start()")
> Reported-by: syzbot+68e901d044baaea1f60c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=68e901d044baaea1f60c
> Tested-by: syzbot+68e901d044baaea1f60c@syzkaller.appspotmail.com
> Signed-off-by: Niharika Khare <niharikakhare2101@gmail.com>
> ---
>  drivers/media/mc/mc-entity.c | 18 ++++++++++++------
>  1 file changed, 12 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c
> index 3fa0bc687..7b4ef2c95 100644
> --- a/drivers/media/mc/mc-entity.c
> +++ b/drivers/media/mc/mc-entity.c
> @@ -778,12 +778,18 @@ __must_check int __media_pipeline_start(struct media_pad *origin,
>  
>  	lockdep_assert_held(&mdev->graph_mutex);
>  
> -	/*
> -	 * If the pad is already part of a pipeline, that pipeline must be the
> -	 * same as the pipe given to media_pipeline_start().
> -	 */
> -	if (WARN_ON(origin->pipe && origin->pipe != pipe))
> -		return -EINVAL;
> +	/*
> +	 * If the pad is part of a different pipeline than the one passed on to
> +	 * media_pipeline_start(), the pad must wait for the ongoing session on
> +	 * this previous pipeline to complete before it starts a new session.
> +	 * The request for starting the pipeline, although valid, cannot be
> +	 * served until the ongoing request finishes.
> +	 */
> +	if (origin->pipe && origin->pipe != pipe) {
> +		dev_dbg(mdev->dev, "Failed to start pipeline: pad '%s':%u busy\n",
> +			origin->entity->name, origin->index);
> +		return -EBUSY;
> +	}
>  
>  	/*
>  	 * If the pipeline has already been started, it is guaranteed to be

-- 
Regards,

Laurent Pinchart

Re: [PATCH] media: mc: Remove spurious WARN_ON in __media_pipeline_start

[Niharika Khare]

On Fri, Aug 21, 2026 at 09:33:26PM +0200, Laurent Pinchart wrote:
> On Fri, Aug 21, 2026 at 10:28:07PM +0530, Niharika Khare wrote:
> > Vimc driver's entity topology has three capture nodes and two of
> > those (Raw Capture 0 and RGB/YUV Capture) are reachable from each
> > other via enabled links. The crash report and the C repro show that
> > the two capture nodes attempt to invoke a STREAMON session one after
> > the other, which resulted in the WARNING getting triggered by the
> > media controller.
> > 
> >   vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0)
> >   vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0)
> >   origin->pipe && origin->pipe != pipe
> >   WARNING: drivers/media/mc/mc-entity.c:785 at __media_pipeline_start+0x1add/0x22b0, CPU#1: syz.0.17/5912
> > 
> > The graph walk originating from Raw Capture 0 (first STREAMON in C
> > repro on /dev/video0) reaches RGB/YUV Capture and marks its origin
> > pad's pipe with its own pipe. When RGB/YUV Capture's graph walk starts
> > (second STREAMON in C repro on /dev/video4), the pad is already
> > claimed. This is a legitimate userspace request but not something that
> 
> No, that's not supposed to be a legitimate use case. The WARN_ON
> indicates a driver bug.

Thanks for the direction Laurent, I'll look into vimc's architecture to
check on how the two capture nodes ended up starting the pipeline back
to back.

> > kernel should allow while the pad remains claimed. Hence, the kernel
> > checks the pipe and returns -EBUSY instead of raising a bug, same as
> > the other non-origin pads. The check on origin pad's pipe needs to stay
> > otherwise the origin pad case would go through the increment on the
> > start_count path, even though there exists a loop few lines below this
> > block to check the pad and return -EBUSY. The check also provides early
> > failure detection and prevents the complete graph walk.
> > 
> > Fixes: ae219872834a ("media: mc: entity: Rewrite media_pipeline_start()")
> > Reported-by: syzbot+68e901d044baaea1f60c@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=68e901d044baaea1f60c
> > Tested-by: syzbot+68e901d044baaea1f60c@syzkaller.appspotmail.com
> > Signed-off-by: Niharika Khare <niharikakhare2101@gmail.com>
> > ---
> >  drivers/media/mc/mc-entity.c | 18 ++++++++++++------
> >  1 file changed, 12 insertions(+), 6 deletions(-)
> > 
> > diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c
> > index 3fa0bc687..7b4ef2c95 100644
> > --- a/drivers/media/mc/mc-entity.c
> > +++ b/drivers/media/mc/mc-entity.c
> > @@ -778,12 +778,18 @@ __must_check int __media_pipeline_start(struct media_pad *origin,
> >  
> >  	lockdep_assert_held(&mdev->graph_mutex);
> >  
> > -	/*
> > -	 * If the pad is already part of a pipeline, that pipeline must be the
> > -	 * same as the pipe given to media_pipeline_start().
> > -	 */
> > -	if (WARN_ON(origin->pipe && origin->pipe != pipe))
> > -		return -EINVAL;
> > +	/*
> > +	 * If the pad is part of a different pipeline than the one passed on to
> > +	 * media_pipeline_start(), the pad must wait for the ongoing session on
> > +	 * this previous pipeline to complete before it starts a new session.
> > +	 * The request for starting the pipeline, although valid, cannot be
> > +	 * served until the ongoing request finishes.
> > +	 */
> > +	if (origin->pipe && origin->pipe != pipe) {
> > +		dev_dbg(mdev->dev, "Failed to start pipeline: pad '%s':%u busy\n",
> > +			origin->entity->name, origin->index);
> > +		return -EBUSY;
> > +	}
> >  
> >  	/*
> >  	 * If the pipeline has already been started, it is guaranteed to be
> 
> -- 
> Regards,
> 
> Laurent Pinchart

Regards,

Niharika Khare

Re: [PATCH] media: mc: Remove spurious WARN_ON in __media_pipeline_start

[Niharika Khare]

On Sat, Aug 22, 2026 at 09:53:46AM +0530, Niharika Khare wrote:
> On Fri, Aug 21, 2026 at 09:33:26PM +0200, Laurent Pinchart wrote:
> > On Fri, Aug 21, 2026 at 10:28:07PM +0530, Niharika Khare wrote:
> > > Vimc driver's entity topology has three capture nodes and two of
> > > those (Raw Capture 0 and RGB/YUV Capture) are reachable from each
> > > other via enabled links. The crash report and the C repro show that
> > > the two capture nodes attempt to invoke a STREAMON session one after
> > > the other, which resulted in the WARNING getting triggered by the
> > > media controller.
> > > 
> > >   vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0)
> > >   vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0)
> > >   origin->pipe && origin->pipe != pipe
> > >   WARNING: drivers/media/mc/mc-entity.c:785 at __media_pipeline_start+0x1add/0x22b0, CPU#1: syz.0.17/5912
> > > 
> > > The graph walk originating from Raw Capture 0 (first STREAMON in C
> > > repro on /dev/video0) reaches RGB/YUV Capture and marks its origin
> > > pad's pipe with its own pipe. When RGB/YUV Capture's graph walk starts
> > > (second STREAMON in C repro on /dev/video4), the pad is already
> > > claimed. This is a legitimate userspace request but not something that
> > 
> > No, that's not supposed to be a legitimate use case. The WARN_ON
> > indicates a driver bug.
> 
> Thanks for the direction Laurent, I'll look into vimc's architecture to
> check on how the two capture nodes ended up starting the pipeline back
> to back.

Hi Laurent,

The WARN reproduces without the syzkaller reproducer by configuring
formats with
media-ctl, then concurrently running VIDIOC_STREAMON on
/dev/video0 and /dev/video2. Both sit in the same connected component
via Sensor A.

I tried checking the pad in vimc before video_device_pipeline_start()
and returning
-EBUSY, and this removes the WARN.

However, a couple of other drivers are structured differently:

1. rkisp1 embeds a single media_pipeline in struct rkisp1_device; both
   capture
nodes pass it to video_device_pipeline_start(), serialized
   by stream_lock.
vimc embeds one per vimc_capture_device, so the
   second STREAMON sees a
different pipe pointer.

2. imx8-isi acquires the pipeline with media_entity_pipeline(), falling
   back to
the node's own pipe, under graph_mutex.

I also tried the imx8-isi approach in vimc. Both nodes stream, but
teardown
NULL-derefs in kthread_stop() as the core refcounts one
pipeline while vimc
keeps a kthread per capture node.

Before working on the teardown: should vimc share a pipeline across a
connected component like these drivers, or refuse the second STREAMON?

Regards,

Niharika
 
> > > kernel should allow while the pad remains claimed. Hence, the kernel
> > > checks the pipe and returns -EBUSY instead of raising a bug, same as
> > > the other non-origin pads. The check on origin pad's pipe needs to stay
> > > otherwise the origin pad case would go through the increment on the
> > > start_count path, even though there exists a loop few lines below this
> > > block to check the pad and return -EBUSY. The check also provides early
> > > failure detection and prevents the complete graph walk.
> > > 
> > > Fixes: ae219872834a ("media: mc: entity: Rewrite media_pipeline_start()")
> > > Reported-by: syzbot+68e901d044baaea1f60c@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=68e901d044baaea1f60c
> > > Tested-by: syzbot+68e901d044baaea1f60c@syzkaller.appspotmail.com
> > > Signed-off-by: Niharika Khare <niharikakhare2101@gmail.com>
> > > ---
> > >  drivers/media/mc/mc-entity.c | 18 ++++++++++++------
> > >  1 file changed, 12 insertions(+), 6 deletions(-)
> > > 
> > > diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c
> > > index 3fa0bc687..7b4ef2c95 100644
> > > --- a/drivers/media/mc/mc-entity.c
> > > +++ b/drivers/media/mc/mc-entity.c
> > > @@ -778,12 +778,18 @@ __must_check int __media_pipeline_start(struct media_pad *origin,
> > >  
> > >  	lockdep_assert_held(&mdev->graph_mutex);
> > >  
> > > -	/*
> > > -	 * If the pad is already part of a pipeline, that pipeline must be the
> > > -	 * same as the pipe given to media_pipeline_start().
> > > -	 */
> > > -	if (WARN_ON(origin->pipe && origin->pipe != pipe))
> > > -		return -EINVAL;
> > > +	/*
> > > +	 * If the pad is part of a different pipeline than the one passed on to
> > > +	 * media_pipeline_start(), the pad must wait for the ongoing session on
> > > +	 * this previous pipeline to complete before it starts a new session.
> > > +	 * The request for starting the pipeline, although valid, cannot be
> > > +	 * served until the ongoing request finishes.
> > > +	 */
> > > +	if (origin->pipe && origin->pipe != pipe) {
> > > +		dev_dbg(mdev->dev, "Failed to start pipeline: pad '%s':%u busy\n",
> > > +			origin->entity->name, origin->index);
> > > +		return -EBUSY;
> > > +	}
> > >  
> > >  	/*
> > >  	 * If the pipeline has already been started, it is guaranteed to be
> > 
> > -- 
> > Regards,
> > 
> > Laurent Pinchart
> 
> Regards,
> 
> Niharika Khare