From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794062811; b=hRJ/wtJEC0ePA+z1FXec29/6XdBrr8pQ+kcjYg5c14vyDSNINVnyiD1ZoAzlYC+TUcKC gsBLddES4zUG6uHGYuFabZLq6qmEwyFUMEN0Y4ECiiMuDIioorZxBVeU/Ph5SkBsAwqjb h06MmsKWdiRbg/bLl+Bj0x/CwtQPHmvrEyWTcuaTCk+buZo12i6XDjiRg5CVw7ramwQ80 SVJjPNcxbsUvm1TjqPzC9MIPa2WGFr5n0nsKKcGV51B6kA9JtkZuLYIHRSUuR5acbQJWz dDTgFO+kvoFeSRbnIq4ftGxZ2nDrmddfCfiT4+8G+AdAxnMLXoHf+GBiqgvKB/5J6og== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794062811; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=4xwNIyOzWiJdwk40vLsYtkAhQ9wQDmdLrPaHCAHDlfk=; b=DsfGxXiKl7b7Aaldue2uom3xwogSdJ/FXfsrFSb8UafC4ENDTBUK3ek4ded6XURzi+WA v4PdUDT8D6dGmY/yoiYfiPoFiQyM9c4khBfz3QVSBOO+Cl5eybwOJKQEvLANGWGsnriZ5 eQhQO3UeGahn30RJYtDtxwuB1PfWVLCv0++Hxos7MuxWq2QFxdZ9vGcVlWnnw5rtEEQEj tnGv1Kk3fRfX856UdY43fWKBtACDLCR6UrOoVWIlqTy2RfGkfhWUdmOEN8+d+icpaOqy0 3G4WUrnijorohme/1GuwP8be5pTmpp5GTYg1ftyRxbKw/VHSrb82/koaw7pxpp3Umew== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=JcaJfJbU; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7CF51606A33E; Sat, 7 Nov 2026 14:46:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=JcaJfJbU Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2B54E1F0089F; Sat, 7 Nov 2026 14:46:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794062811; bh=4xwNIyOzWiJdwk40vLsYtkAhQ9wQDmdLrPaHCAHDlfk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JcaJfJbU+Tx3Iv4gO/QBaNaDoxryTI6rfXJeeLhgj5Qq9wrSCiqYttb54rJZYUsa/ xbj6sjx4E31JtCdB7TMqJbJ+SEJ1vKi42nDzPNFHs4AHVQH6uFRhTV/+ObQH4wc6Wx T9VCQz62fnXfZLCrOcu+yUcvD0gmi1XSqHXtn/gI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Younho Choi , Nicolas Dufresne , Hans Verkuil , Sasha Levin Subject: [PATCH 6.18 084/869] media: vim2m: keep transaction buffer count stable while streaming Date: Sat, 7 Nov 2026 08:46:06 -0500 Message-ID: <20261107134855.548736411@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Younho Choi [ Upstream commit 50f5fed44d8e24081e8feed5154746fe193f11b8 ] V4L2_CID_TRANS_NUM_BUFS controls how many buffer pairs a vim2m mem2mem job processes before the job is completed. The driver stores the value in ctx->translen and device_work() uses it later to decide whether the current transaction should continue. Letting userspace change this control while streaming is active can make a queued job observe a different transaction length than the one it started with. That leaves the transaction state inconsistent with the buffers currently queued for the job. Grab the transaction buffer count control while either queue is streaming, and release it only after both queues have stopped streaming. The V4L2 control framework then rejects changes with -EBUSY while the value is in use, while still allowing userspace to configure the value before streaming starts. Keep the control handler alive until after v4l2_m2m_ctx_release(), since releasing the mem2mem context can call stop_streaming(), which now ungrabs the control. Fixes: 96d8eab5d0a1 ("V4L/DVB: [v5,2/2] v4l: Add a mem-to-mem videobuf framework test device") Cc: stable@vger.kernel.org Signed-off-by: Younho Choi Reviewed-by: Nicolas Dufresne Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- drivers/media/test-drivers/vim2m.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-drivers/vim2m.c index 86c32699111ad..5db440bf728e9 100644 --- a/drivers/media/test-drivers/vim2m.c +++ b/drivers/media/test-drivers/vim2m.c @@ -205,6 +205,7 @@ struct vim2m_ctx { struct vim2m_dev *dev; struct v4l2_ctrl_handler hdl; + struct v4l2_ctrl *trans_num_bufs_ctrl; /* Processed buffers in this transaction */ u8 num_processed; @@ -1270,9 +1271,27 @@ static int vim2m_start_streaming(struct vb2_queue *q, unsigned int count) ctx->aborting = 0; q_data->sequence = 0; + v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, true); + return 0; } +static bool vim2m_other_queue_is_streaming(struct vim2m_ctx *ctx, + struct vb2_queue *q) +{ + struct vb2_queue *other_vq; + + if (!ctx->fh.m2m_ctx) + return false; + + if (V4L2_TYPE_IS_OUTPUT(q->type)) + other_vq = v4l2_m2m_get_dst_vq(ctx->fh.m2m_ctx); + else + other_vq = v4l2_m2m_get_src_vq(ctx->fh.m2m_ctx); + + return vb2_is_streaming(other_vq); +} + static void vim2m_stop_streaming(struct vb2_queue *q) { struct vim2m_ctx *ctx = vb2_get_drv_priv(q); @@ -1286,11 +1305,14 @@ static void vim2m_stop_streaming(struct vb2_queue *q) else vbuf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); if (!vbuf) - return; + break; v4l2_ctrl_request_complete(vbuf->vb2_buf.req_obj.req, &ctx->hdl); v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR); } + + if (!vim2m_other_queue_is_streaming(ctx, q)) + v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, false); } static void vim2m_buf_request_complete(struct vb2_buffer *vb) @@ -1392,7 +1414,8 @@ static int vim2m_open(struct file *file) vim2m_ctrl_trans_time_msec.def = default_transtime; v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_time_msec, NULL); - v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL); + ctx->trans_num_bufs_ctrl = + v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL); if (hdl->error) { rc = hdl->error; v4l2_ctrl_handler_free(hdl); @@ -1447,10 +1470,10 @@ static int vim2m_release(struct file *file) v4l2_fh_del(&ctx->fh, file); v4l2_fh_exit(&ctx->fh); - v4l2_ctrl_handler_free(&ctx->hdl); mutex_lock(&dev->dev_mutex); v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); mutex_unlock(&dev->dev_mutex); + v4l2_ctrl_handler_free(&ctx->hdl); kfree(ctx); atomic_dec(&dev->num_inst); -- 2.53.0