* Re: [PATCH] staging: rtl8723bs: replace beacon timing magic numbers with named constants
From: Jad Keskes @ 2026-06-16 16:29 UTC (permalink / raw)
To: inasj268; +Cc: Greg Kroah-Hartman, Dan Carpenter, linux-staging
Ping. Any chance this can be picked up?
^ permalink raw reply
* [PATCH v3 2/2] media: atomisp: fix memory leak in atomisp_csi2_bridge_parse_firmware()
From: Dawei Feng @ 2026-06-16 13:43 UTC (permalink / raw)
To: andriy.shevchenko
Cc: andy, error27, hansg, mchehab, sakari.ailus, gregkh,
abdelrahmanfekry375, linux-kernel, linux-media, linux-staging,
jianhao.xu, Dawei Feng, Zilin Guan
In-Reply-To: <20260616134319.3969928-1-dawei.feng@seu.edu.cn>
atomisp_csi2_bridge_parse_firmware() initializes isp->notifier and may
allocate async notifier connections via v4l2_async_nf_add_fwnode_remote().
However, these resources are currently leaked if a subsequent entity
registration or probe step fails, or when the driver is removed.
Fix this by introducing dedicated helpers to clean up and unregister the
async notifier state. Call atomisp_notifier_cleanup() to release the
allocated connections in both the entity registration failure path and the
overall probe unwind path.
Additionally, invoke atomisp_notifier_unregister() during the device
remove path to ensure the notifier is properly unregistered from the V4L2
core before its underlying resources are freed.
Fixes: 8d28ec7e9145 ("media: atomisp: Add support for v4l2-async sensor registration")
Reported-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
---
drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
index 5ba9584b81d7..1073d9e5eafb 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
@@ -798,6 +798,17 @@ static int atomisp_subdev_probe(struct atomisp_device *isp)
return atomisp_csi_lane_config(isp);
}
+static void atomisp_notifier_cleanup(struct atomisp_device *isp)
+{
+ v4l2_async_nf_cleanup(&isp->notifier);
+}
+
+static void atomisp_notifier_unregister(struct atomisp_device *isp)
+{
+ v4l2_async_nf_unregister(&isp->notifier);
+ atomisp_notifier_cleanup(isp);
+}
+
static void atomisp_unregister_entities(struct atomisp_device *isp)
{
unsigned int i;
@@ -869,6 +880,7 @@ static int atomisp_register_entities(struct atomisp_device *isp)
for (i = 0; i < ATOMISP_CAMERA_NR_PORTS; i++)
atomisp_mipi_csi2_unregister_entities(&isp->csi2_port[i]);
csi_and_subdev_probe_failed:
+ atomisp_notifier_cleanup(isp);
v4l2_device_unregister(&isp->v4l2_dev);
v4l2_device_failed:
media_device_unregister(&isp->media_dev);
@@ -1444,6 +1456,7 @@ static int atomisp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
devm_free_irq(&pdev->dev, pdev->irq, isp);
error_unregister_entities:
hmm_cleanup();
+ atomisp_notifier_cleanup(isp);
atomisp_unregister_entities(isp);
error_uninitialize_modules:
atomisp_uninitialize_modules(isp);
@@ -1471,6 +1484,7 @@ static void atomisp_pci_remove(struct pci_dev *pdev)
devm_free_irq(&pdev->dev, pdev->irq, isp);
hmm_cleanup();
+ atomisp_notifier_unregister(isp);
atomisp_unregister_entities(isp);
atomisp_uninitialize_modules(isp);
media_device_cleanup(&isp->media_dev);
--
2.34.1
^ permalink raw reply related
* [PATCH v3 1/2] media: atomisp: fix memory leak in atomisp_pci_probe()
From: Dawei Feng @ 2026-06-16 13:43 UTC (permalink / raw)
To: andriy.shevchenko
Cc: andy, error27, hansg, mchehab, sakari.ailus, gregkh,
abdelrahmanfekry375, linux-kernel, linux-media, linux-staging,
jianhao.xu, Dawei Feng, Zilin Guan
In-Reply-To: <20260616134319.3969928-1-dawei.feng@seu.edu.cn>
atomisp_initialize_modules() creates CSI2 and ISP subdev media entities
before atomisp_pci_probe() registers them. Its counterpart,
atomisp_uninitialize_modules(), only releases part of that module-owned
state and leaves some media entity cleanup to the entity unregister path.
That ownership split is incomplete for probe error paths. If
atomisp_pci_probe() fails after module initialization but before all
entities are registered, the unwind path cannot rely on unregister
helpers to release media entity state whose lifetime started in module
initialization. The CSI2 and ISP subdev media entities can therefore be
left allocated.
Refactor the cleanup boundary so module cleanup releases media entities
created by module initialization, while unregister helpers only undo
registered V4L2 and media device state. Move CSI2 and ISP subdev media
entity cleanup into atomisp_mipi_csi2_cleanup() and the new
atomisp_subdev_cleanup(), and run media_device_cleanup() after module
cleanup in the probe unwind and remove paths.
If atomisp_mipi_csi2_init() itself fails, it has already unwound its
partial setup, so return the error directly. Only the later
atomisp_subdev_init() failure path needs to clean up CSI2 from the
caller.
Fixes: 9d4fa1a16b28 ("media: atomisp: cleanup directory hierarchy")
Reported-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
---
drivers/staging/media/atomisp/pci/atomisp_csi2.c | 5 ++++-
drivers/staging/media/atomisp/pci/atomisp_subdev.c | 9 +++++++--
drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 12 +++++-------
3 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_csi2.c b/drivers/staging/media/atomisp/pci/atomisp_csi2.c
index 95b9113d75e9..2a85d04ade81 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_csi2.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_csi2.c
@@ -185,7 +185,6 @@ static int mipi_csi2_init_entities(struct atomisp_mipi_csi2_device *csi2,
void
atomisp_mipi_csi2_unregister_entities(struct atomisp_mipi_csi2_device *csi2)
{
- media_entity_cleanup(&csi2->subdev.entity);
v4l2_device_unregister_subdev(&csi2->subdev);
}
@@ -331,6 +330,10 @@ void atomisp_csi2_configure(struct atomisp_sub_device *asd)
*/
void atomisp_mipi_csi2_cleanup(struct atomisp_device *isp)
{
+ unsigned int i;
+
+ for (i = 0; i < ATOMISP_CAMERA_NR_PORTS; i++)
+ media_entity_cleanup(&isp->csi2_port[i].subdev.entity);
}
int atomisp_mipi_csi2_init(struct atomisp_device *isp)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_subdev.c b/drivers/staging/media/atomisp/pci/atomisp_subdev.c
index 3d56ca83ecb7..11d7e04d3ec5 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_subdev.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_subdev.c
@@ -886,11 +886,16 @@ void atomisp_subdev_cleanup_pending_events(struct atomisp_sub_device *asd)
void atomisp_subdev_unregister_entities(struct atomisp_sub_device *asd)
{
- atomisp_subdev_cleanup_entities(asd);
v4l2_device_unregister_subdev(&asd->subdev);
atomisp_video_unregister(&asd->video_out);
}
+void atomisp_subdev_cleanup(struct atomisp_device *isp)
+{
+ atomisp_subdev_cleanup_entities(&isp->asd);
+ media_entity_cleanup(&isp->asd.video_out.vdev.entity);
+}
+
int atomisp_subdev_register_subdev(struct atomisp_sub_device *asd,
struct v4l2_device *vdev)
{
@@ -913,7 +918,7 @@ int atomisp_subdev_init(struct atomisp_device *isp)
isp_subdev_init_params(&isp->asd);
ret = isp_subdev_init_entities(&isp->asd);
if (ret < 0)
- atomisp_subdev_cleanup_entities(&isp->asd);
+ atomisp_subdev_cleanup(isp);
return ret;
}
diff --git a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
index 900a67552d6a..5ba9584b81d7 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
@@ -334,10 +334,8 @@ int atomisp_video_init(struct atomisp_video_pipe *video)
void atomisp_video_unregister(struct atomisp_video_pipe *video)
{
- if (video_is_registered(&video->vdev)) {
- media_entity_cleanup(&video->vdev.entity);
+ if (video_is_registered(&video->vdev))
video_unregister_device(&video->vdev);
- }
}
static int atomisp_save_iunit_reg(struct atomisp_device *isp)
@@ -814,7 +812,6 @@ static void atomisp_unregister_entities(struct atomisp_device *isp)
v4l2_device_unregister(&isp->v4l2_dev);
media_device_unregister(&isp->media_dev);
- media_device_cleanup(&isp->media_dev);
for (i = 0; i < isp->input_cnt; i++)
__v4l2_subdev_state_free(isp->inputs[i].try_sd_state);
@@ -875,7 +872,6 @@ static int atomisp_register_entities(struct atomisp_device *isp)
v4l2_device_unregister(&isp->v4l2_dev);
v4l2_device_failed:
media_device_unregister(&isp->media_dev);
- media_device_cleanup(&isp->media_dev);
return ret;
}
@@ -1086,7 +1082,7 @@ static int atomisp_initialize_modules(struct atomisp_device *isp)
ret = atomisp_mipi_csi2_init(isp);
if (ret < 0) {
dev_err(isp->dev, "mipi csi2 initialization failed\n");
- goto error_mipi_csi2;
+ return ret;
}
ret = atomisp_subdev_init(isp);
@@ -1098,13 +1094,13 @@ static int atomisp_initialize_modules(struct atomisp_device *isp)
return 0;
error_isp_subdev:
-error_mipi_csi2:
atomisp_mipi_csi2_cleanup(isp);
return ret;
}
static void atomisp_uninitialize_modules(struct atomisp_device *isp)
{
+ atomisp_subdev_cleanup(isp);
atomisp_mipi_csi2_cleanup(isp);
}
@@ -1451,6 +1447,7 @@ static int atomisp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
atomisp_unregister_entities(isp);
error_uninitialize_modules:
atomisp_uninitialize_modules(isp);
+ media_device_cleanup(&isp->media_dev);
error_irq_uninit:
atomisp_msi_irq_uninit(isp);
pci_free_irq_vectors(pdev);
@@ -1476,6 +1473,7 @@ static void atomisp_pci_remove(struct pci_dev *pdev)
atomisp_unregister_entities(isp);
atomisp_uninitialize_modules(isp);
+ media_device_cleanup(&isp->media_dev);
atomisp_msi_irq_uninit(isp);
pci_free_irq_vectors(pdev);
}
--
2.34.1
^ permalink raw reply related
* [PATCH v3 0/2] media: atomisp: fix probe memory leaks
From: Dawei Feng @ 2026-06-16 13:43 UTC (permalink / raw)
To: andriy.shevchenko
Cc: andy, error27, hansg, mchehab, sakari.ailus, gregkh,
abdelrahmanfekry375, linux-kernel, linux-media, linux-staging,
jianhao.xu, Dawei Feng
This series fixes two memory leaks in the atomisp PCI probe and adjusts
cleanup paths.
Patch 1 fixes the cleanup boundary for media entities created during
module initialization. atomisp_uninitialize_modules() did not release all
module-owned state and instead left some media entity cleanup to unregister
helpers. That split is incomplete for probe failures that happen after
module initialization but before all entities are registered, so the
module cleanup path now owns the corresponding media entity cleanup.
Patch 2 adds cleanup for the V4L2 async notifier state initialized by
atomisp_csi2_bridge_parse_firmware(), including notifier connection
cleanup on probe failures and notifier unregister on remove.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still present in
v7.1-rc7.
An x86_64 allyesconfig build showed no new warnings. As we do not have
an Intel Atom ISP platform with the required camera sensor hardware to
test with, no runtime testing was able to be performed.
Changes in v3:
- Moved the research background and static analysis explanation to the
cover letter.
- Changed Zilin's Signed-off-by to Reported-by.
Dawei Feng (2):
media: atomisp: fix memory leak in atomisp_pci_probe()
media: atomisp: fix memory leak in
atomisp_csi2_bridge_parse_firmware()
.../staging/media/atomisp/pci/atomisp_csi2.c | 5 +++-
.../media/atomisp/pci/atomisp_subdev.c | 9 +++++--
.../staging/media/atomisp/pci/atomisp_v4l2.c | 26 ++++++++++++++-----
3 files changed, 30 insertions(+), 10 deletions(-)
--
2.34.1
^ permalink raw reply
* Re: [PATCH v3] staging: rtl8723bs: use PTR_ALIGN() for rsp_buf
From: Dan Carpenter @ 2026-06-16 13:02 UTC (permalink / raw)
To: Devansh Soni; +Cc: gregkh, linux-staging, linux-kernel, dan.carpenter
In-Reply-To: <20260616123528.44278-1-devanshsoni874@gmail.com>
On Tue, Jun 16, 2026 at 06:05:28PM +0530, Devansh Soni wrote:
> diff --git a/drivers/staging/rtl8723bs/core/rtw_cmd.c b/drivers/staging/rtl8723bs/core/rtw_cmd.c
> index c1185c25e..38ce3156c 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_cmd.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_cmd.c
> @@ -184,7 +184,7 @@ int rtw_init_cmd_priv(struct cmd_priv *pcmdpriv)
> return -ENOMEM;
> }
>
> - pcmdpriv->rsp_buf = pcmdpriv->rsp_allocated_buf + 4 - ((SIZE_PTR)(pcmdpriv->rsp_allocated_buf) & 3);
> + pcmdpriv->rsp_buf = PTR_ALIGN(pcmdpriv->rsp_allocated_buf, 4);
You're working against an old version of the kernel. You should be
working against linux-next or devel-next.
The commit message mentions 8-byte aligned memory, but the code is still
doing PTR_ALIGN(). The kmalloc() alignment is determined by
ARCH_KMALLOC_MINALIGN and it's always at least 8 but it can be higher.
Here the code is trying to ensure that it is 4 byte aligned, and 8 is
already a multiple of 4. You could just delete the PTR_ALIGN() along
with the related code.
1. It allocates 4 extra bytes. "MAX_RSPSZ + 4" bytes. It could instead
just allocate MAX_RSPSZ bytes.
2. This pcmdpriv->rsp_buf = PTR_ALIGN() can be removed.
3. The pcmdpriv->rsp_allocated_buf pointer only exists to store the
unaligned pointer. Just get rid of it.
The early part of function which does CMDBUFF_ALIGN_SZ is more complicated
because that is 512 bytes. It's trying to ensure that the pointers are
aligned enough for DMA. The proper alignment in that case is probably
ARCH_DMA_MINALIGN but I'm less familiar with how that works.
regards,
dan carpenter
^ permalink raw reply
* [PATCH v3] staging: rtl8723bs: use PTR_ALIGN() for rsp_buf
From: Devansh Soni @ 2026-06-16 12:35 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, dan.carpenter, Devansh Soni
The original code was using manual bitwise calculation for the
alignment of rsp_buf.
Replace this with the standard PTR_ALIGN() macro. The manual math
((SIZE_PTR)ptr & 3) always returns 0 and is completely unnecessary
because kzalloc() already returns 8-byte aligned memory.
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Devansh Soni <devanshsoni874@gmail.com>
---
Changes in v3:
- Replaced manual bitwise math with PTR_ALIGN() macro based on feedback
by Dan.
- Updated commit message to detail kzalloc() 8-byte alignment guarantees.
Changes in v2:
- Wrapped commit log text to resolve line length issue noted by Greg.
drivers/staging/rtl8723bs/core/rtw_cmd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_cmd.c b/drivers/staging/rtl8723bs/core/rtw_cmd.c
index c1185c25e..38ce3156c 100644
--- a/drivers/staging/rtl8723bs/core/rtw_cmd.c
+++ b/drivers/staging/rtl8723bs/core/rtw_cmd.c
@@ -184,7 +184,7 @@ int rtw_init_cmd_priv(struct cmd_priv *pcmdpriv)
return -ENOMEM;
}
- pcmdpriv->rsp_buf = pcmdpriv->rsp_allocated_buf + 4 - ((SIZE_PTR)(pcmdpriv->rsp_allocated_buf) & 3);
+ pcmdpriv->rsp_buf = PTR_ALIGN(pcmdpriv->rsp_allocated_buf, 4);
pcmdpriv->cmd_issued_cnt = 0;
pcmdpriv->cmd_done_cnt = 0;
--
2.54.0
^ permalink raw reply related
* Re: [PATCH 0/5] staging: rtl8723bs: Fix coding style issues in header files
From: Dan Carpenter @ 2026-06-16 12:21 UTC (permalink / raw)
To: Subhrojyoti Bala; +Cc: Greg Kroah-Hartman, linux-staging, linux-kernel
In-Reply-To: <20260616110048.45541-1-subhrojyoti0609@gmail.com>
On Tue, Jun 16, 2026 at 04:30:43PM +0530, Subhrojyoti Bala wrote:
> This patch series fixes various coding style issues in the
> rtl8723bs staging driver header files, as reported by
> checkpatch.pl:
>
> - Fix multi-line comment style in wlan_bssdef.h
> - Fix enum indentation in rtw_mlme.h
> - Fix block comment style in rtw_mlme.h
> - Fix multi-line comment style in rtw_mlme.h
> - Fix whitespace in comments in rtw_mlme.h
>
combine patches 1,3-5 since they're all basically the same sort
of patch in the same driver and they're pretty small.
Wait for a day before resending.
https://staticthinking.wordpress.com/2022/07/27/how-to-send-a-v2-patch/
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH 0/5] staging: rtl8723bs: Fix coding style issues in header files
From: Greg Kroah-Hartman @ 2026-06-16 12:09 UTC (permalink / raw)
To: Subhrojyoti Bala; +Cc: linux-staging, linux-kernel
In-Reply-To: <20260616110048.45541-1-subhrojyoti0609@gmail.com>
On Tue, Jun 16, 2026 at 04:30:43PM +0530, Subhrojyoti Bala wrote:
> This patch series fixes various coding style issues in the
> rtl8723bs staging driver header files, as reported by
> checkpatch.pl:
>
> - Fix multi-line comment style in wlan_bssdef.h
> - Fix enum indentation in rtw_mlme.h
> - Fix block comment style in rtw_mlme.h
> - Fix multi-line comment style in rtw_mlme.h
> - Fix whitespace in comments in rtw_mlme.h
>
> Subhrojyoti Bala (5):
> staging: rtl8723bs: Fix multi-line comment style in wlan_bssdef.h
> staging: rtl8723bs: Fix indentation in enum in rtw_mlme.h
> staging: rtl8723bs: Fix block comment style in rtw_mlme.h
> staging: rtl8723bs: Fix multi-line comment style in rtw_mlme.h
> staging: rtl8723bs: Fix whitespace in comments in rtw_mlme.h
>
> drivers/staging/rtl8723bs/include/rtw_mlme.h | 55 ++++++++++---------
> .../staging/rtl8723bs/include/wlan_bssdef.h | 14 ++---
> 2 files changed, 35 insertions(+), 34 deletions(-)
>
> Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
> --
> 2.54.0
>
>
Hi,
This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him
a patch that has triggered this response. He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created. Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.
You are receiving this message because of the following common error(s)
as indicated below:
- This looks like a new version of a previously submitted patch, but you
did not list below the --- line any changes from the previous version.
Please read the section entitled "The canonical patch format" in the
kernel file, Documentation/process/submitting-patches.rst for what
needs to be done here to properly describe this.
If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.
thanks,
greg k-h's patch email bot
^ permalink raw reply
* Re: [PATCH v3] media: atomisp: replace kmalloc() with kmalloc_objs() in sh_css.c
From: Andy Shevchenko @ 2026-06-16 11:01 UTC (permalink / raw)
To: Andrei Khomenkov; +Cc: Greg Kroah-Hartman, linux-staging, linux-media
In-Reply-To: <20260615194548.20963-1-khomenkov@mailbox.org>
On Mon, Jun 15, 2026 at 10:45:48PM +0300, Andrei Khomenkov wrote:
> Replace arithmetic in the kmalloc() function with the kmalloc_objs()
> macro, as this calculation method is unsafe.
...
> Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Nope, I haven't suggested the initial idea.
...
What about patches that were sent against this driver for the past year?
There were at least two patches of the similar changes. Please, check on
the prior work and if needed rebased, updated, upstreamed.
(If you haven't taken that, it has to be explained why.)
https://lore.kernel.org will help you and
https://lore.kernel.org/linux-media/?q=s%3Aatomisp+b%3Akmalloc
as a rough first step.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* [PATCH 5/5] staging: rtl8723bs: Fix whitespace in comments in rtw_mlme.h
From: Subhrojyoti Bala @ 2026-06-16 11:00 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
In-Reply-To: <20260616110048.45541-1-subhrojyoti0609@gmail.com>
Remove extra spaces after /* in single-line comments to comply
with kernel coding style.
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
---
drivers/staging/rtl8723bs/include/rtw_mlme.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/rtw_mlme.h b/drivers/staging/rtl8723bs/include/rtw_mlme.h
index 59b12d9daa71..1b862ec24d36 100644
--- a/drivers/staging/rtl8723bs/include/rtw_mlme.h
+++ b/drivers/staging/rtl8723bs/include/rtw_mlme.h
@@ -13,8 +13,8 @@
/* define MAX_JOIN_TIMEOUT 2500 */
#define MAX_JOIN_TIMEOUT 6500
-/* Commented by Albert 20101105 */
-/* Increase the scanning timeout because of increasing the SURVEY_TO value. */
+/* Commented by Albert 20101105 */
+/* Increase the scanning timeout because of increasing the SURVEY_TO value. */
#define SCANNING_TIMEOUT 8000
--
2.54.0
^ permalink raw reply related
* [PATCH 4/5] staging: rtl8723bs: Fix multi-line comment style in rtw_mlme.h
From: Subhrojyoti Bala @ 2026-06-16 11:00 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
In-Reply-To: <20260616110048.45541-1-subhrojyoti0609@gmail.com>
Block comment was not using * on subsequent lines and had blank
lines inside the comment body. Fix it to comply with kernel
coding style.
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
---
drivers/staging/rtl8723bs/include/rtw_mlme.h | 33 ++++++++++----------
1 file changed, 16 insertions(+), 17 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/rtw_mlme.h b/drivers/staging/rtl8723bs/include/rtw_mlme.h
index dbb523c8a58b..59b12d9daa71 100644
--- a/drivers/staging/rtl8723bs/include/rtw_mlme.h
+++ b/drivers/staging/rtl8723bs/include/rtw_mlme.h
@@ -67,23 +67,22 @@ enum {
};
/*
-
-there are several "locks" in mlme_priv,
-since mlme_priv is a shared resource between many threads,
-like ISR/Call-Back functions, the OID handlers, and even timer functions.
-
-Each struct __queue has its own locks, already.
-Other items in mlme_priv are protected by mlme_priv.lock, while items in
-xmit_priv are protected by xmit_priv.lock.
-
-To avoid possible dead lock, any thread trying to modifying mlme_priv
-SHALL not lock up more than one locks at a time!
-
-The only exception is that queue functions which take the __queue.lock
-may be called with the xmit_priv.lock held. In this case the order
-MUST always be first lock xmit_priv.lock and then call any queue functions
-which take __queue.lock.
-*/
+ * There are several "locks" in mlme_priv,
+ * since mlme_priv is a shared resource between many threads,
+ * like ISR/Call-Back functions, the OID handlers, and even timer functions.
+ *
+ * Each struct __queue has its own locks, already.
+ * Other items in mlme_priv are protected by mlme_priv.lock, while items in
+ * xmit_priv are protected by xmit_priv.lock.
+ *
+ * To avoid possible dead lock, any thread trying to modifying mlme_priv
+ * SHALL not lock up more than one locks at a time!
+ *
+ * The only exception is that queue functions which take the __queue.lock
+ * may be called with the xmit_priv.lock held. In this case the order
+ * MUST always be first lock xmit_priv.lock and then call any queue functions
+ * which take __queue.lock.
+ */
struct sitesurvey_ctrl {
u64 last_tx_pkts;
--
2.54.0
^ permalink raw reply related
* [PATCH 3/5] staging: rtl8723bs: Fix block comment style in rtw_mlme.h
From: Subhrojyoti Bala @ 2026-06-16 11:00 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
In-Reply-To: <20260616110048.45541-1-subhrojyoti0609@gmail.com>
Block comment was not using a trailing */ on a separate line.
Fix it to comply with kernel coding style.
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
---
drivers/staging/rtl8723bs/include/rtw_mlme.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/rtw_mlme.h b/drivers/staging/rtl8723bs/include/rtw_mlme.h
index 403c097b46ef..dbb523c8a58b 100644
--- a/drivers/staging/rtl8723bs/include/rtw_mlme.h
+++ b/drivers/staging/rtl8723bs/include/rtw_mlme.h
@@ -183,8 +183,10 @@ struct mlme_priv {
u8 *wps_probe_req_ie;
u32 wps_probe_req_ie_len;
- /* Number of associated Non-ERP stations (i.e., stations using 802.11b
- * in 802.11g BSS) */
+ /*
+ * Number of associated Non-ERP stations (i.e., stations using 802.11b
+ * in 802.11g BSS)
+ */
int num_sta_non_erp;
/* Number of associated stations that do not support Short Slot Time */
--
2.54.0
^ permalink raw reply related
* [PATCH 2/5] staging: rtl8723bs: Fix indentation in enum in rtw_mlme.h
From: Subhrojyoti Bala @ 2026-06-16 11:00 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
In-Reply-To: <20260616110048.45541-1-subhrojyoti0609@gmail.com>
Enum members were missing tab indentation. Add proper tab
indent to align with kernel coding style.
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
---
drivers/staging/rtl8723bs/include/rtw_mlme.h | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/rtw_mlme.h b/drivers/staging/rtl8723bs/include/rtw_mlme.h
index ac3ba746b64c..403c097b46ef 100644
--- a/drivers/staging/rtl8723bs/include/rtw_mlme.h
+++ b/drivers/staging/rtl8723bs/include/rtw_mlme.h
@@ -44,12 +44,12 @@
enum {
- dot11AuthAlgrthm_Open = 0,
- dot11AuthAlgrthm_Shared,
- dot11AuthAlgrthm_8021X,
- dot11AuthAlgrthm_Auto,
- dot11AuthAlgrthm_WAPI,
- dot11AuthAlgrthm_MaxNum
+ dot11AuthAlgrthm_Open = 0,
+ dot11AuthAlgrthm_Shared,
+ dot11AuthAlgrthm_8021X,
+ dot11AuthAlgrthm_Auto,
+ dot11AuthAlgrthm_WAPI,
+ dot11AuthAlgrthm_MaxNum
};
/* Scan type including active and passive scan. */
--
2.54.0
^ permalink raw reply related
* [PATCH 1/5] staging: rtl8723bs: Fix multi-line comment style in wlan_bssdef.h
From: Subhrojyoti Bala @ 2026-06-16 11:00 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
In-Reply-To: <20260616110048.45541-1-subhrojyoti0609@gmail.com>
Fix block comments that were not following the kernel's multi-line
comment style. Comments should use the following format:
/*
* text
*/
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
---
drivers/staging/rtl8723bs/include/wlan_bssdef.h | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/wlan_bssdef.h b/drivers/staging/rtl8723bs/include/wlan_bssdef.h
index 812a68394268..25ac996e73e3 100644
--- a/drivers/staging/rtl8723bs/include/wlan_bssdef.h
+++ b/drivers/staging/rtl8723bs/include/wlan_bssdef.h
@@ -31,10 +31,9 @@ enum ndis_802_11_network_type {
Ndis802_11NetworkTypeMax /* not a real type, defined as an upper bound */
};
-/*
- FW will only save the channel number in DSConfig.
- ODI Handler will convert the channel number to freq. number.
-*/
+/* FW will only save the channel number in DSConfig. */
+/* ODI Handler will convert the channel number to freq. number. */
+
struct ndis_802_11_conf {
u32 length; /* Length of structure */
u32 beacon_period; /* units are Kusec */
@@ -138,7 +137,8 @@ struct wlan_phy_info {
struct wlan_bcn_info {
/* these infor get from rtw_get_encrypt_info when
- * * translate scan to UI */
+ * translate scan to UI
+ */
u8 encryp_protocol;/* ENCRYP_PROTOCOL_E: OPEN/WEP/WPA/WPA2/WAPI */
int group_cipher; /* WPA/WPA2 group cipher */
int pairwise_cipher;/* WPA/WPA2/WEP pairwise cipher */
@@ -150,8 +150,8 @@ struct wlan_bcn_info {
};
/* temporally add #pragma pack for structure alignment issue of
-* struct wlan_bssid_ex and get_wlan_bssid_ex_sz()
-*/
+ * struct wlan_bssid_ex and get_wlan_bssid_ex_sz()
+ */
struct wlan_bssid_ex {
u32 length;
u8 mac_address[ETH_ALEN];
--
2.54.0
^ permalink raw reply related
* [PATCH 0/5] staging: rtl8723bs: Fix coding style issues in header files
From: Subhrojyoti Bala @ 2026-06-16 11:00 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
This patch series fixes various coding style issues in the
rtl8723bs staging driver header files, as reported by
checkpatch.pl:
- Fix multi-line comment style in wlan_bssdef.h
- Fix enum indentation in rtw_mlme.h
- Fix block comment style in rtw_mlme.h
- Fix multi-line comment style in rtw_mlme.h
- Fix whitespace in comments in rtw_mlme.h
Subhrojyoti Bala (5):
staging: rtl8723bs: Fix multi-line comment style in wlan_bssdef.h
staging: rtl8723bs: Fix indentation in enum in rtw_mlme.h
staging: rtl8723bs: Fix block comment style in rtw_mlme.h
staging: rtl8723bs: Fix multi-line comment style in rtw_mlme.h
staging: rtl8723bs: Fix whitespace in comments in rtw_mlme.h
drivers/staging/rtl8723bs/include/rtw_mlme.h | 55 ++++++++++---------
.../staging/rtl8723bs/include/wlan_bssdef.h | 14 ++---
2 files changed, 35 insertions(+), 34 deletions(-)
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
--
2.54.0
^ permalink raw reply
* Re: [PATCH] staging: rtl8723bs: Fix whitespace in comments in rtw_mlme.h
From: Dan Carpenter @ 2026-06-16 10:53 UTC (permalink / raw)
To: Subhrojyoti Bala; +Cc: Greg Kroah-Hartman, linux-staging, linux-kernel
In-Reply-To: <20260616102348.41973-1-subhrojyoti0609@gmail.com>
On Tue, Jun 16, 2026 at 03:53:48PM +0530, Subhrojyoti Bala wrote:
> Remove extra spaces after /* in single-line comments to comply
> with kernel coding style.
>
> No functional change.
>
> Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
> ---
Please group all your patches into a patch series and send it that
way. We may end up asking you to combine patches together if they
are small and similar.
regards,
dan carpenter
^ permalink raw reply
* [PATCH] staging: rtl8723bs: Fix whitespace in comments in rtw_mlme.h
From: Subhrojyoti Bala @ 2026-06-16 10:23 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
Remove extra spaces after /* in single-line comments to comply
with kernel coding style.
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
---
drivers/staging/rtl8723bs/include/rtw_mlme.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/rtw_mlme.h b/drivers/staging/rtl8723bs/include/rtw_mlme.h
index 59b12d9daa71..1b862ec24d36 100644
--- a/drivers/staging/rtl8723bs/include/rtw_mlme.h
+++ b/drivers/staging/rtl8723bs/include/rtw_mlme.h
@@ -13,8 +13,8 @@
/* define MAX_JOIN_TIMEOUT 2500 */
#define MAX_JOIN_TIMEOUT 6500
-/* Commented by Albert 20101105 */
-/* Increase the scanning timeout because of increasing the SURVEY_TO value. */
+/* Commented by Albert 20101105 */
+/* Increase the scanning timeout because of increasing the SURVEY_TO value. */
#define SCANNING_TIMEOUT 8000
--
2.54.0
^ permalink raw reply related
* [PATCH] staging: rtl8723bs: Fix multi-line comment style in rtw_mlme.h
From: Subhrojyoti Bala @ 2026-06-16 10:03 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
Block comment was not using * on subsequent lines and had blank
lines inside the comment body. Fix it to comply with kernel
coding style.
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
---
drivers/staging/rtl8723bs/include/rtw_mlme.h | 33 ++++++++++----------
1 file changed, 16 insertions(+), 17 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/rtw_mlme.h b/drivers/staging/rtl8723bs/include/rtw_mlme.h
index dbb523c8a58b..59b12d9daa71 100644
--- a/drivers/staging/rtl8723bs/include/rtw_mlme.h
+++ b/drivers/staging/rtl8723bs/include/rtw_mlme.h
@@ -67,23 +67,22 @@ enum {
};
/*
-
-there are several "locks" in mlme_priv,
-since mlme_priv is a shared resource between many threads,
-like ISR/Call-Back functions, the OID handlers, and even timer functions.
-
-Each struct __queue has its own locks, already.
-Other items in mlme_priv are protected by mlme_priv.lock, while items in
-xmit_priv are protected by xmit_priv.lock.
-
-To avoid possible dead lock, any thread trying to modifying mlme_priv
-SHALL not lock up more than one locks at a time!
-
-The only exception is that queue functions which take the __queue.lock
-may be called with the xmit_priv.lock held. In this case the order
-MUST always be first lock xmit_priv.lock and then call any queue functions
-which take __queue.lock.
-*/
+ * There are several "locks" in mlme_priv,
+ * since mlme_priv is a shared resource between many threads,
+ * like ISR/Call-Back functions, the OID handlers, and even timer functions.
+ *
+ * Each struct __queue has its own locks, already.
+ * Other items in mlme_priv are protected by mlme_priv.lock, while items in
+ * xmit_priv are protected by xmit_priv.lock.
+ *
+ * To avoid possible dead lock, any thread trying to modifying mlme_priv
+ * SHALL not lock up more than one locks at a time!
+ *
+ * The only exception is that queue functions which take the __queue.lock
+ * may be called with the xmit_priv.lock held. In this case the order
+ * MUST always be first lock xmit_priv.lock and then call any queue functions
+ * which take __queue.lock.
+ */
struct sitesurvey_ctrl {
u64 last_tx_pkts;
--
2.54.0
^ permalink raw reply related
* [PATCH] staging: rtl8723bs: Fix block comment style in rtw_mlme.h
From: Subhrojyoti Bala @ 2026-06-16 9:54 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
Block comment was not using a trailing */ on a separate line.
Fix it to comply with kernel coding style.
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
---
drivers/staging/rtl8723bs/include/rtw_mlme.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/rtw_mlme.h b/drivers/staging/rtl8723bs/include/rtw_mlme.h
index 403c097b46ef..dbb523c8a58b 100644
--- a/drivers/staging/rtl8723bs/include/rtw_mlme.h
+++ b/drivers/staging/rtl8723bs/include/rtw_mlme.h
@@ -183,8 +183,10 @@ struct mlme_priv {
u8 *wps_probe_req_ie;
u32 wps_probe_req_ie_len;
- /* Number of associated Non-ERP stations (i.e., stations using 802.11b
- * in 802.11g BSS) */
+ /*
+ * Number of associated Non-ERP stations (i.e., stations using 802.11b
+ * in 802.11g BSS)
+ */
int num_sta_non_erp;
/* Number of associated stations that do not support Short Slot Time */
--
2.54.0
^ permalink raw reply related
* [PATCH] staging: rtl8723bs: Fix indentation in enum in rtw_mlme.h
From: Subhrojyoti Bala @ 2026-06-16 9:37 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
Enum members were missing tab indentation. Add proper tab
indent to align with kernel coding style.
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
---
drivers/staging/rtl8723bs/include/rtw_mlme.h | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/rtw_mlme.h b/drivers/staging/rtl8723bs/include/rtw_mlme.h
index ac3ba746b64c..403c097b46ef 100644
--- a/drivers/staging/rtl8723bs/include/rtw_mlme.h
+++ b/drivers/staging/rtl8723bs/include/rtw_mlme.h
@@ -44,12 +44,12 @@
enum {
- dot11AuthAlgrthm_Open = 0,
- dot11AuthAlgrthm_Shared,
- dot11AuthAlgrthm_8021X,
- dot11AuthAlgrthm_Auto,
- dot11AuthAlgrthm_WAPI,
- dot11AuthAlgrthm_MaxNum
+ dot11AuthAlgrthm_Open = 0,
+ dot11AuthAlgrthm_Shared,
+ dot11AuthAlgrthm_8021X,
+ dot11AuthAlgrthm_Auto,
+ dot11AuthAlgrthm_WAPI,
+ dot11AuthAlgrthm_MaxNum
};
/* Scan type including active and passive scan. */
--
2.54.0
^ permalink raw reply related
* [PATCH] staging: rtl8723bs: Fix multi-line comment style in wlan_bssdef.h
From: Subhrojyoti Bala @ 2026-06-16 9:12 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Subhrojyoti Bala
Fix block comments that were not following the kernel's multi-line
comment style. Comments should use the following format:
/*
* text
*/
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
---
drivers/staging/rtl8723bs/include/wlan_bssdef.h | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/wlan_bssdef.h b/drivers/staging/rtl8723bs/include/wlan_bssdef.h
index 812a68394268..25ac996e73e3 100644
--- a/drivers/staging/rtl8723bs/include/wlan_bssdef.h
+++ b/drivers/staging/rtl8723bs/include/wlan_bssdef.h
@@ -31,10 +31,9 @@ enum ndis_802_11_network_type {
Ndis802_11NetworkTypeMax /* not a real type, defined as an upper bound */
};
-/*
- FW will only save the channel number in DSConfig.
- ODI Handler will convert the channel number to freq. number.
-*/
+/* FW will only save the channel number in DSConfig. */
+/* ODI Handler will convert the channel number to freq. number. */
+
struct ndis_802_11_conf {
u32 length; /* Length of structure */
u32 beacon_period; /* units are Kusec */
@@ -138,7 +137,8 @@ struct wlan_phy_info {
struct wlan_bcn_info {
/* these infor get from rtw_get_encrypt_info when
- * * translate scan to UI */
+ * translate scan to UI
+ */
u8 encryp_protocol;/* ENCRYP_PROTOCOL_E: OPEN/WEP/WPA/WPA2/WAPI */
int group_cipher; /* WPA/WPA2 group cipher */
int pairwise_cipher;/* WPA/WPA2/WEP pairwise cipher */
@@ -150,8 +150,8 @@ struct wlan_bcn_info {
};
/* temporally add #pragma pack for structure alignment issue of
-* struct wlan_bssid_ex and get_wlan_bssid_ex_sz()
-*/
+ * struct wlan_bssid_ex and get_wlan_bssid_ex_sz()
+ */
struct wlan_bssid_ex {
u32 length;
u8 mac_address[ETH_ALEN];
--
2.54.0
^ permalink raw reply related
* Re: [PATCH] greybus: audio: bound the topology section sizes against the fetched size
From: Bryam Vargas @ 2026-06-16 8:16 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Dan Carpenter, Mark Greer, Vaibhav Agarwal, Johan Hovold,
Alex Elder, linux-kernel, linux-staging, greybus-dev, stable
In-Reply-To: <2026061643-crowbar-handgrip-620d@gregkh>
Hi Greg, and thanks Dan,
>> Are you sure these checks will not overflow?
> Yep. The cast to u64 ensures that.
Right, and to close the other side of the comparison too: `size` is a u16 and
the function already does `if (size < sizeof(*topo)) return -ENODATA;` above
this point, so `size - sizeof(*topo)` cannot underflow either. The left side is
the (u64) sum of four u32s (max ~2^34), so neither side wraps. The form
`sizeof(*topo) + sum > size` is exactly equivalent if it reads more clearly.
> But we trust the hardware to send us proper data, right? If we don't trust
> modules, then there are lots of other places stuff like this needs to be
> fixed, how many data paths did you audit?
I audited the four size_* fields that gbaudio_tplg_parse_data() turns into
section offsets -- those are the only module-supplied values that feed directly
into unchecked pointer arithmetic (control/widget/route_offset are dai_offset
plus those le32s, then dereferenced as structs). I am not claiming a broader
greybus or topology-parser audit; that is welcome but separate.
It is less "modules are malicious" than "a malformed or buggy module response
should not walk the parser off a slab object" -- the same
untrusted-length-to-offset shape already hardened for USB/HID/BT descriptors.
If you would rather treat module data as trusted and drop the stable tag, that
is your call; I would keep the bound regardless, since it is one branch and the
offsets are otherwise completely unchecked.
> How did you find/fix this? You need to list what tools helped you...
I do not have real greybus audio hardware, so I simulated the module side and
drove the negative case directly: a topology whose fetched `size` is small but
whose size_* fields are large -- exactly the invariant this patch enforces.
With that I reproduced the read two ways:
- in-kernel under KASAN (7.1.0-rc5): slab-out-of-bounds 4 bytes past a
kmalloc-64 object; the patched arm (-EINVAL) and an in-bounds arm are clean;
- a userspace AddressSanitizer model of the process_header() offset walk,
both -m32 and -m64.
Tools: a static read of the audio_gb.c -> audio_topology.c data flow, a litmus
greybus module under KASAN in a VM, and the userspace ASan harness. The
verifiable artifact is the KASAN splat (trimmed under the --- in the original
posting; full log on request).
Thanks,
Bryam
^ permalink raw reply
* [PATCH v2] media: meson: vdec: fix use-after-free of decode work in stop/close path
From: Doruk Tan Ozturk @ 2026-06-16 7:49 UTC (permalink / raw)
To: neil.armstrong, mchehab, gregkh, khilman
Cc: jbrunet, martin.blumenstingl, hverkuil, linux-media,
linux-amlogic, linux-staging, linux-arm-kernel, linux-kernel,
Doruk Tan Ozturk, stable
The ESPARSER worker (esparser_queue_all_src(), scheduled via
sess->esparser_queue_work) dereferences sess->m2m_ctx and accesses the
ESPARSER/DOS registers. On the stop_streaming()/release() paths the
buffers and, on close, the m2m context are torn down while this worker
may still be pending or running, leading to a use-after-free of the
freed session state.
vdec_poweroff() previously only called vdec_ops->stop() and disabled the
clocks; it never synchronized against the worker. Two problems follow:
- The decode (VDEC) interrupt is threaded
(devm_request_threaded_irq(.., vdec_isr, vdec_threaded_isr, ..)) and
its threaded handler re-arms the worker through amvdec_dst_buf_done()
-> schedule_work(&sess->esparser_queue_work). A handler that is still
in flight can therefore queue the worker again after teardown has
begun.
- The worker touches ESPARSER/DOS registers, so it must not run after
the clocks have been disabled.
Quiesce everything in vdec_poweroff(), in order, before disabling the
clocks: vdec_ops->stop() masks the VDEC interrupt in hardware so no new
IRQ can be raised; synchronize_irq() on the VDEC line then drains any
threaded handler still in flight (the only context that re-arms the
worker); cancel_work_sync() finally cancels/waits for the worker. After
this nothing can re-arm the work, and the worker can no longer run with
clocks disabled or against a freed m2m context.
Only the VDEC interrupt is synchronized: the ESPARSER interrupt handler
(esparser_isr()) only acknowledges the start-code-found status and wakes
the internal wait queue used by esparser_write_data(); it never touches
the session or schedules the worker, so it cannot re-arm it.
stop_streaming()/release() run under the video device lock, not under
sess->lock (the mutex the worker takes), so cancel_work_sync() here
cannot deadlock against the worker.
The VDEC IRQ number is now stored in struct amvdec_core so it is
available to synchronize_irq() at teardown.
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
v2: also synchronize_irq() before cancelling the work, so a delayed
threaded IRQ cannot re-arm it after cancel_work_sync() (raised by
automated review). Only the VDEC IRQ is synchronized, as the
ESPARSER IRQ handler does not touch the session or schedule the work.
v1: https://lore.kernel.org/linux-media/20260615140529.52653-1-doruk@0sec.ai/
drivers/staging/media/meson/vdec/vdec.c | 21 +++++++++++++++++++++
drivers/staging/media/meson/vdec/vdec.h | 3 +++
2 files changed, 24 insertions(+)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index 4b77ec1af5a7..5304987546fa 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -123,6 +123,25 @@ static void vdec_poweroff(struct amvdec_session *sess)
codec_ops->drain(sess);
vdec_ops->stop(sess);
+
+ /*
+ * vdec_ops->stop() masks the VDEC interrupt at the hardware level, so
+ * no new IRQ can be raised past this point. The threaded ISR re-arms
+ * the ESPARSER worker via amvdec_dst_buf_done() (schedule_work()), so
+ * drain any in-flight handler before cancelling the worker, otherwise
+ * a late threaded IRQ could schedule it again after the cancel.
+ *
+ * The worker dereferences sess->m2m_ctx and touches the ESPARSER/DOS
+ * registers, so it must be cancelled while m2m_ctx is still valid and
+ * the clocks are still enabled, i.e. before the clk_disable below.
+ *
+ * This runs from the stop_streaming()/release() paths, which are
+ * serialized by the video device lock, not by sess->lock (the lock the
+ * worker takes), so cancel_work_sync() cannot deadlock here.
+ */
+ synchronize_irq(sess->core->vdec_irq);
+ cancel_work_sync(&sess->esparser_queue_work);
+
clk_disable_unprepare(sess->core->dos_clk);
clk_disable_unprepare(sess->core->dos_parser_clk);
}
@@ -1053,6 +1072,8 @@ static int vdec_probe(struct platform_device *pdev)
if (ret)
return ret;
+ core->vdec_irq = irq;
+
ret = esparser_init(pdev, core);
if (ret)
return ret;
diff --git a/drivers/staging/media/meson/vdec/vdec.h b/drivers/staging/media/meson/vdec/vdec.h
index 7a5d8e871d70..9a50116a2665 100644
--- a/drivers/staging/media/meson/vdec/vdec.h
+++ b/drivers/staging/media/meson/vdec/vdec.h
@@ -66,6 +66,8 @@ struct amvdec_session;
* @v4l2_dev: v4l2 device
* @cur_sess: current decoding session
* @lock: video device lock
+ * @vdec_irq: IRQ line of the VDEC, used to synchronize the threaded ISR
+ * against teardown
*/
struct amvdec_core {
void __iomem *dos_base;
@@ -91,6 +93,7 @@ struct amvdec_core {
struct amvdec_session *cur_sess;
struct mutex lock;
+ int vdec_irq;
};
/**
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v3] media: atomisp: replace kmalloc() with kmalloc_objs() in sh_css.c
From: Dan Carpenter @ 2026-06-16 7:44 UTC (permalink / raw)
To: Andrei Khomenkov
Cc: Greg Kroah-Hartman, Andy Shevchenko, linux-staging, linux-media
In-Reply-To: <20260615194548.20963-1-khomenkov@mailbox.org>
On Mon, Jun 15, 2026 at 10:45:48PM +0300, Andrei Khomenkov wrote:
> Replace arithmetic in the kmalloc() function with the kmalloc_objs()
> macro, as this calculation method is unsafe.
>
> Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> Signed-off-by: Andrei Khomenkov <khomenkov@mailbox.org>
> ---
Are you working against the devel-next tree? This doesn't apply to
linux-next.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH] greybus: audio: bound the topology section sizes against the fetched size
From: Dan Carpenter @ 2026-06-16 7:42 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: hexlabsecurity, Mark Greer, Vaibhav Agarwal, Johan Hovold,
linux-kernel, linux-staging, greybus-dev, Alex Elder
In-Reply-To: <2026061643-crowbar-handgrip-620d@gregkh>
On Tue, Jun 16, 2026 at 12:01:30PM +0530, Greg Kroah-Hartman wrote:
> On Tue, Jun 16, 2026 at 01:06:12AM -0500, Bryam Vargas via B4 Relay wrote:
> > ---
> > drivers/staging/greybus/audio_gb.c | 13 +++++++++++++
> > 1 file changed, 13 insertions(+)
> >
> > diff --git a/drivers/staging/greybus/audio_gb.c b/drivers/staging/greybus/audio_gb.c
> > index 9d8994fdb41a..144591f1a512 100644
> > --- a/drivers/staging/greybus/audio_gb.c
> > +++ b/drivers/staging/greybus/audio_gb.c
> > @@ -37,6 +37,19 @@ int gb_audio_gb_get_topology(struct gb_connection *connection,
> > return ret;
> > }
> >
> > + /*
> > + * The size_* fields are supplied by the module and are used by
> > + * gbaudio_tplg_parse_data() to compute offsets into the blob; make
> > + * sure the sections fit within the fetched topology, so walking it
> > + * cannot read out of bounds.
> > + */
> > + if ((u64)le32_to_cpu(topo->size_dais) + le32_to_cpu(topo->size_controls) +
> > + le32_to_cpu(topo->size_widgets) + le32_to_cpu(topo->size_routes) >
> > + size - sizeof(*topo)) {
>
> Are you sure these checks will not overflow?
Yep. The cast to u64 ensures that.
regards,
dan carpenter
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox