[PATCH AUTOSEL 6.16-6.15] media: raspberrypi: cfe: Fix min_reqbufs_allocation

[Sasha Levin <sashal@kernel.org>]

From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>

[ Upstream commit 57b5a302b5d529db96ddc52fbccec005092ebb3d ]

The driver checks if "vq->max_num_buffers + *nbuffers < 3", but
vq->max_num_buffers is (by default) 32, so the check is never true. Nor
does the check make sense.

The original code in the BSP kernel was "vq->num_buffers + *nbuffers <
3", but got mangled along the way to upstream. The intention was to make
sure that at least 3 buffers are allocated.

Fix this by removing the bad lines and setting q->min_reqbufs_allocation
to three.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

**Backport Status: YES**

This commit should be backported to stable kernel trees for the
following reasons:

1. **Clear Bug Fix**: This fixes a logic bug where the condition
   `vq->max_num_buffers + *nbuffers < 3` could never be true since
   `vq->max_num_buffers` defaults to 32. The original BSP kernel code
   was `vq->num_buffers + *nbuffers < 3`, which got incorrectly
   translated during upstreaming.

2. **Functional Impact**: The bug prevents the driver from ensuring a
   minimum of 3 buffers are allocated, which could lead to buffer
   underruns or improper operation of the Raspberry Pi Camera Front End
   (CFE) driver. This directly affects users of Raspberry Pi cameras.

3. **Simple and Contained Fix**: The fix is minimal - it removes 2
   problematic lines and adds 1 line setting `q->min_reqbufs_allocation
   = 3`. This is the proper V4L2 videobuf2 API way to ensure minimum
   buffer allocation rather than manually adjusting buffer counts.

4. **Low Risk**: The change is confined to a single driver file
   (`drivers/media/platform/raspberrypi/rp1-cfe/cfe.c`) and uses the
   standard V4L2 framework mechanism (`min_reqbufs_allocation`)
   properly. There's minimal risk of regression since it's replacing
   broken code with the correct API usage.

5. **Recent Driver**: The rp1-cfe driver was added relatively recently
   (commit 6edb685abb2a), and this bug was introduced during the
   upstreaming process. Users running stable kernels with this driver
   would benefit from having the correct behavior.

6. **Meets Stable Criteria**: This satisfies the stable kernel rules as
   it:
   - Fixes a real bug that affects users
   - Is obviously correct (uses proper V4L2 API)
   - Has been reviewed and signed-off by subsystem maintainers
   - Is small and self-contained

The commit properly uses the videobuf2 framework's
`min_reqbufs_allocation` field which is designed specifically for this
purpose - ensuring a minimum number of buffers are allocated when
VIDIOC_REQBUFS is called.

 drivers/media/platform/raspberrypi/rp1-cfe/cfe.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c b/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c
index fcadb2143c88..62dca76b468d 100644
--- a/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c
+++ b/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c
@@ -1024,9 +1024,6 @@ static int cfe_queue_setup(struct vb2_queue *vq, unsigned int *nbuffers,
 	cfe_dbg(cfe, "%s: [%s] type:%u\n", __func__, node_desc[node->id].name,
 		node->buffer_queue.type);
 
-	if (vq->max_num_buffers + *nbuffers < 3)
-		*nbuffers = 3 - vq->max_num_buffers;
-
 	if (*nplanes) {
 		if (sizes[0] < size) {
 			cfe_err(cfe, "sizes[0] %i < size %u\n", sizes[0], size);
@@ -1998,6 +1995,7 @@ static int cfe_register_node(struct cfe_device *cfe, int id)
 	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
 	q->lock = &node->lock;
 	q->min_queued_buffers = 1;
+	q->min_reqbufs_allocation = 3;
 	q->dev = &cfe->pdev->dev;
 
 	ret = vb2_queue_init(q);
-- 
2.39.5