From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794062721; b=BZv4kN881xSHxu3vjAVEIUt6WtqCP9SGKZ3BUiJ/D+usYZA76cto2Dtj4ZSWrVZxSNDB YMGio3iTLWYP72y2M/Xr9oaeRxSESRKblmi0/AriLOatZbNdy6wj7utuP8fm57KprlKgY CzvFPVNfHTz+Ft5+XqskBsGBpb1NcWg7NepPvMF5+Dj1H4sdwNC6q1NtvRTW/KlMGRRne Avb/k4vgLNHKcSMOz1OfbQYw3dbpdcEEu9350/VpSW7EEw7Fw5xC8y3QagnpR7/IEDsQO qFF/JTKRgy1FwqESkz4AaLpzzXks+gcKG5QyUtCr970Zw02LL/w/HwdM0ar9LljsF+w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794062721; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=d/vZmOpG4a54uQpPrvAOnEhWCb0FThuMLvfOfGFOrA0=; b=EKJtksfGfx27olZHlBW8Uc0CPLxO8fL/l1Rh1IXDLY56wX0NRTvk7HRQyGPjEGmKdmt6 yV20MrM/w3fZcqATZChwcyTGFf4r3rBPR8s/7nCFxvEUKObmgyUJCil48YhWQ68g46Rpf s0z4bjYC1bpW6FD22+iXfVmhIK+6OepwV5dbYIBzchKM6DExi/6+Phw7fvyClrqmGTev1 PcH++z+mgQmZunCo93ut0lfTTVGZdiWyRL+HTRxTYsgmvXHYU3Zq4RSpF6lTi9lwQkZhX 3SkyH54lpDXCG4IvR6cJ/G7VfGfClmX1Y3BGcalFAh2auVXMp7xbPDZVetGK3E8akeA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=yO0sSEbL; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF0F0606A32C; Sat, 7 Nov 2026 14:45:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=yO0sSEbL Received: by smtp.kernel.org (Postfix) with ESMTPSA id E1CA11F0089F; Sat, 7 Nov 2026 14:45:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794062720; bh=d/vZmOpG4a54uQpPrvAOnEhWCb0FThuMLvfOfGFOrA0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=yO0sSEbL8lhKT44MQ03n7JQS5bcBMU5xEXxDmxPX+wU60AXXJWSOCrGj29SFOWiKv wUDg4jfbPqrpHUaeEvz2GIvVk290SKH16MqE+/esosNOMsb2EcVyXcs7R8VZ2FEnBc u0N7+oo/jPbqu9+SB6kYOSCmSR6fNv3pEBjDqbYw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Fan Wu , Ming Qian , Frank Li , Hans Verkuil , Sasha Levin Subject: [PATCH 6.18 039/869] media: imx-jpeg: finish the job on device_run() error paths Date: Sat, 7 Nov 2026 08:45:21 -0500 Message-ID: <20261107134853.488776040@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fan Wu [ Upstream commit 30b35fd2b999e1b8c26f8191d974d20c8848d2d6 ] mxc_jpeg_device_run() returns early through a shared "end" label on several error paths (no free slot, mxc_jpeg_alloc_slot_data() failure, or missing buffers or queue data), and none of them calls v4l2_m2m_job_finish(). Since the delayed work is queued only after the hardware is started, those paths neither finish the job directly nor queue timeout work that could finish it later. The job is left with TRANS_RUNNING set, so the wait_event() in v4l2_m2m_cancel_job() (reached from v4l2_m2m_ctx_release() at close) waits indefinitely and the close hangs. mxc_jpeg_alloc_slot_data() uses dma_alloc_coherent(), so the failure path is reachable under memory pressure. Return the src/dst buffers with VB2_BUF_STATE_ERROR and call v4l2_m2m_job_finish() on those paths: paths that have buffers use a "buf_finish" label; the no-buffer path uses "job_finish" directly. This mirrors the existing jpeg_parse_error path. This bug was found by static analysis. Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Cc: stable@vger.kernel.org Signed-off-by: Fan Wu Reviewed-by: Ming Qian Signed-off-by: Frank Li Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- .../media/platform/nxp/imx-jpeg/mxc-jpeg.c | 21 +++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c index 4ac4f576fdd10..9f0794dd5c544 100644 --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c @@ -1525,15 +1525,15 @@ static void mxc_jpeg_device_run(void *priv) dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); if (!src_buf || !dst_buf) { dev_err(dev, "Null src or dst buf\n"); - goto end; + goto job_finish; } q_data_cap = mxc_jpeg_get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE); if (!q_data_cap) - goto end; + goto buf_finish; q_data_out = mxc_jpeg_get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT); if (!q_data_out) - goto end; + goto buf_finish; src_buf->sequence = q_data_out->sequence++; dst_buf->sequence = q_data_cap->sequence++; @@ -1571,11 +1571,11 @@ static void mxc_jpeg_device_run(void *priv) ctx->slot = mxc_get_free_slot(&jpeg->slot_data); if (ctx->slot < 0) { dev_err(dev, "No more free slots\n"); - goto end; + goto buf_finish; } if (!mxc_jpeg_alloc_slot_data(jpeg)) { dev_err(dev, "Cannot allocate slot data\n"); - goto end; + goto buf_finish; } mxc_jpeg_enable_slot(reg, ctx->slot); @@ -1597,8 +1597,17 @@ static void mxc_jpeg_device_run(void *priv) mxc_jpeg_dec_mode_go(dev, reg); } schedule_delayed_work(&ctx->task_timer, msecs_to_jiffies(hw_timeout)); -end: + spin_unlock_irqrestore(&ctx->mxc_jpeg->hw_lock, flags); + return; +buf_finish: + v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); + v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); + v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_ERROR); + v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR); +job_finish: + spin_unlock_irqrestore(&ctx->mxc_jpeg->hw_lock, flags); + v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx); } static int mxc_jpeg_decoder_cmd(struct file *file, void *priv, -- 2.53.0