From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F2E3630567C; Thu, 30 Jul 2026 15:42:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785426165; cv=none; b=U4lAz1FsZZZD2rM5+EhrEQzrMalMyaWkgfpVxNhy9tVj3pLTmymiixypNSh3R2hWEv+GiUQe8qiB2HtERbAsFRzCGFkjNsdUldQGjcAYtmqsFc6ZI65R40oiJrDogiK9m3AWnRHTJyTcLNF9jWNDh8x5dES85XcMLO+CWehrM50= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785426165; c=relaxed/simple; bh=VFgkQvanpFQ+IAl5vw3vt1dlO0kSKl9P/+RZ6U6a75k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Vr0/tNr+PlCZ1qHNYJ9lgUj3mNNJ0Y6rmDroKbg2UxdEQl9iQfSz72YGm2KqOtXqbGdMefp6DaB6Oxkt6RPFXjuNlJeUp3JBPm4Vn/OCjpukJ4Lk2+ZcLhKmYShuZZwH4ysjWr/ZPwNGaVRwt/OdS3fIsOFk7xNf1o0ySUM+43I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JCO2MLtN; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JCO2MLtN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 59E711F00A3A; Thu, 30 Jul 2026 15:42:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785426163; bh=9BsRwCrHmHVxy+qKQ5yx9Z5VfuVz08WpOy5agpn9HVE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JCO2MLtNURdQ8g1FcCU9dZdIdezM5vOv7tyzT5SpXRm+/qoIeDTc8qHaX53LxwCYB /esnjJ35vYJpFxdF/8cXkauZ+joduYpUftTU5J2iSc5ZNEA6FhjbsY2037fYzzLGm7 h+rCybOa1D4gNqSUCTrMOCYW7MxM7YJjjANO50tc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Valery Borovsky , Hans Verkuil Subject: [PATCH 6.12 321/602] media: pwc: Drain fill_buf on start_streaming() failure Date: Thu, 30 Jul 2026 16:11:53 +0200 Message-ID: <20260730141442.711653208@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141435.976815864@linuxfoundation.org> References: <20260730141435.976815864@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Valery Borovsky commit 906e410dcffbbd99fb4081abab817a830033aa28 upstream. pwc_isoc_init() submits its isochronous URBs with usb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB is submitted, its completion handler pwc_isoc_handler() can run on another CPU before the loop finishes: start_streaming() pwc_isoc_init() usb_submit_urb(urbs[0], GFP_KERNEL) pwc_isoc_handler(urbs[0]) pdev->fill_buf = pwc_get_next_fill_buf(pdev) usb_submit_urb(urbs[i>0], ..) -> fails pwc_isoc_cleanup(pdev) /* kills URBs */ return ret; pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED) pwc_get_next_fill_buf() detaches a buffer from pdev->queued_bufs and stores it in pdev->fill_buf. The error path in start_streaming() only drains pdev->queued_bufs, so the buffer parked in pdev->fill_buf is leaked. vb2_start_streaming() then triggers WARN_ON(owned_by_drv_count). stop_streaming() already handles this since commit 80b0963e1698 ("[media] pwc: fix WARN_ON"), which added the fill_buf drain in the teardown path but not in the start_streaming() error path. Mirror that handling on failure so start_streaming() returns with no buffer owned by the driver. Issue identified by automated review of the INV-003 series at https://sashiko.dev/ Fixes: 885fe18f5542 ("[media] pwc: Replace private buffer management code with videobuf2") Cc: stable@vger.kernel.org Signed-off-by: Valery Borovsky Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/pwc/pwc-if.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/media/usb/pwc/pwc-if.c +++ b/drivers/media/usb/pwc/pwc-if.c @@ -727,6 +727,11 @@ static int start_streaming(struct vb2_qu pwc_camera_power(pdev, 0); /* And cleanup any queued bufs!! */ pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED); + if (pdev->fill_buf) { + vb2_buffer_done(&pdev->fill_buf->vb.vb2_buf, + VB2_BUF_STATE_QUEUED); + pdev->fill_buf = NULL; + } } mutex_unlock(&pdev->v4l2_lock);