From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794063893; b=PoFlB3VYHACZBG+OGMuDt9uAiPGyflGeoUqWaqR+Yx3CaV5rLjCSXTcFW58Dlz0GlIol TrvqgRR7nx7ecDBdvOlc2srTdOW30Xo1Fb/e1UFCDC8j+eO/6YT53qHvKe6/8+nVcxTPG E5AMYZYAfI8uJTPgWf1euXPkNO8hJ/ZeYg8BLVNZmhcm1g53p0ZXZlbYlUqD5ZWwHjC2Y BPIr4miGSe/EqrFhAVPG82s8aUbADXIjU7Sl+cQMcU+bjrarpAPBU3imU0wafCV8tffXR 68DoOHZMfdyetCAgYk5nyJbrlOeKvUsaEBpzLUIKU0BwvUbXSKcvPa3cGlNuKJoerOQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794063893; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=L1+mEVU/UtUFWqNdbQ/AHeIfxNWjgSfkzsHp6d1zqcQ=; b=Cod8oXl+88yFqCFIXTujOI04HOh/3WryTsBRnYty0/cQQUVwzN3tU+LjOuAlSh6FGAXC LLuLyeV9drvDAATWMJYROuNUH2Dga4oZm3+U6urRIzaphwla73X9hqpsOnUXWoyfYbpFg yw0+ty8ntZAlB31aTFPoJvSJVJqIZVO0MvoTKMwLKfTxEknJrZOW436W4f7fyYcBIsgsR GKoXtkymlENR7N2TFUyBjM+D9Zm2ssK3/heCN2FEBb6OY6LOxVzg+TxYKORnf13REvA3a 0OIOAr8/pbPsPqfFyIbMsQ7rzdt/E1wq82SWZJwTsatQ26qltU6f/UnxHWw46K8FAdA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=oRk9eRCx; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CFB73606B8BF; Sat, 7 Nov 2026 15:04:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=oRk9eRCx Received: by smtp.kernel.org (Postfix) with ESMTPSA id 79B2C1F0089F; Sat, 7 Nov 2026 15:04:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794063892; bh=L1+mEVU/UtUFWqNdbQ/AHeIfxNWjgSfkzsHp6d1zqcQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=oRk9eRCxm2zolCvl+AoRYzykXXpcYD4BVsYlk9v1JB0SBo9FprfO30SmSpU5+rXfE Y5qTNVy2d5YuTYvFQjvTXAhk0wMXKA134NV1GqAmOkD8QQfT324PIV/+91zuh99QFz cFvhIbyQWgpTKH1p2UuufucwR4awIE/2KTaVuYhQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Younho Choi , Nicolas Dufresne , Hans Verkuil , Sasha Levin Subject: [PATCH 7.3 0095/1257] media: vim2m: keep transaction buffer count stable while streaming Date: Sat, 7 Nov 2026 08:39:51 -0500 Message-ID: <20261107134941.984824573@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Younho Choi [ Upstream commit 50f5fed44d8e24081e8feed5154746fe193f11b8 ] V4L2_CID_TRANS_NUM_BUFS controls how many buffer pairs a vim2m mem2mem job processes before the job is completed. The driver stores the value in ctx->translen and device_work() uses it later to decide whether the current transaction should continue. Letting userspace change this control while streaming is active can make a queued job observe a different transaction length than the one it started with. That leaves the transaction state inconsistent with the buffers currently queued for the job. Grab the transaction buffer count control while either queue is streaming, and release it only after both queues have stopped streaming. The V4L2 control framework then rejects changes with -EBUSY while the value is in use, while still allowing userspace to configure the value before streaming starts. Keep the control handler alive until after v4l2_m2m_ctx_release(), since releasing the mem2mem context can call stop_streaming(), which now ungrabs the control. Fixes: 96d8eab5d0a1 ("V4L/DVB: [v5,2/2] v4l: Add a mem-to-mem videobuf framework test device") Cc: stable@vger.kernel.org Signed-off-by: Younho Choi Reviewed-by: Nicolas Dufresne Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- drivers/media/test-drivers/vim2m.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-drivers/vim2m.c index bb2dd11eef0e4..f4a2c40838292 100644 --- a/drivers/media/test-drivers/vim2m.c +++ b/drivers/media/test-drivers/vim2m.c @@ -205,6 +205,7 @@ struct vim2m_ctx { struct vim2m_dev *dev; struct v4l2_ctrl_handler hdl; + struct v4l2_ctrl *trans_num_bufs_ctrl; /* Processed buffers in this transaction */ u8 num_processed; @@ -1258,9 +1259,27 @@ static int vim2m_start_streaming(struct vb2_queue *q, unsigned int count) ctx->aborting = 0; q_data->sequence = 0; + v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, true); + return 0; } +static bool vim2m_other_queue_is_streaming(struct vim2m_ctx *ctx, + struct vb2_queue *q) +{ + struct vb2_queue *other_vq; + + if (!ctx->fh.m2m_ctx) + return false; + + if (V4L2_TYPE_IS_OUTPUT(q->type)) + other_vq = v4l2_m2m_get_dst_vq(ctx->fh.m2m_ctx); + else + other_vq = v4l2_m2m_get_src_vq(ctx->fh.m2m_ctx); + + return vb2_is_streaming(other_vq); +} + static void vim2m_stop_streaming(struct vb2_queue *q) { struct vim2m_ctx *ctx = vb2_get_drv_priv(q); @@ -1274,11 +1293,14 @@ static void vim2m_stop_streaming(struct vb2_queue *q) else vbuf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); if (!vbuf) - return; + break; v4l2_ctrl_request_complete(vbuf->vb2_buf.req_obj.req, &ctx->hdl); v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR); } + + if (!vim2m_other_queue_is_streaming(ctx, q)) + v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, false); } static void vim2m_buf_request_complete(struct vb2_buffer *vb) @@ -1380,7 +1402,8 @@ static int vim2m_open(struct file *file) vim2m_ctrl_trans_time_msec.def = default_transtime; v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_time_msec, NULL); - v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL); + ctx->trans_num_bufs_ctrl = + v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL); if (hdl->error) { rc = hdl->error; v4l2_ctrl_handler_free(hdl); @@ -1435,10 +1458,10 @@ static int vim2m_release(struct file *file) v4l2_fh_del(&ctx->fh, file); v4l2_fh_exit(&ctx->fh); - v4l2_ctrl_handler_free(&ctx->hdl); mutex_lock(&dev->dev_mutex); v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); mutex_unlock(&dev->dev_mutex); + v4l2_ctrl_handler_free(&ctx->hdl); kfree(ctx); atomic_dec(&dev->num_inst); -- 2.53.0