From patchwork Wed Apr 8 21:33:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stanimir Varbanov X-Patchwork-Id: 210247 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D5B12C2D0F4 for ; Wed, 8 Apr 2020 21:34:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id AA8C42078E for ; Wed, 8 Apr 2020 21:34:05 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="ZVsytK8o" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730728AbgDHVeF (ORCPT ); Wed, 8 Apr 2020 17:34:05 -0400 Received: from mail-lf1-f68.google.com ([209.85.167.68]:37229 "EHLO mail-lf1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729070AbgDHVeE (ORCPT ); Wed, 8 Apr 2020 17:34:04 -0400 Received: by mail-lf1-f68.google.com with SMTP id t11so6327447lfe.4 for ; Wed, 08 Apr 2020 14:34:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=m0H+TjYWwXJL6hiVHCn9qdA94+TCG5AQ9tgfxlqydng=; b=ZVsytK8oepa/xsA0sM8t3gMRagHJuW5Qs0EVWvZ7J1bdzExT/XHV6k5yG+Er1smbpE zP/G7J3t98FuREH7B3bviEHc+AVvKwsnh2sKGF2QbbhNkjsiU7YtGMxQex2bDeQnQ3W1 HJiAywwY/trHlixyjU0xgyyIOyCGkJwsxeBYtx+UCzYuj7V96ZujQd92tms66/dkKvVh DBq+na8TDe4hLVPANGgzqPMHpyJ/l1SLA64P50yo45ya4W9YcAhX6GMbLpXEkhL8Vrla kC5PTPrpHrrwqiu9lrjoov4lp+gBRR7Bf7Za8+dQ19q4eCyFHHQWGIWa2BDEqovsQzlZ 2zcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=m0H+TjYWwXJL6hiVHCn9qdA94+TCG5AQ9tgfxlqydng=; b=SjLobfDJrCehmDyLsPUDw1DsUHp+mi1LOsDkugJum07/g+sstisbdNu2rr5s0yqWpq 1mabv6qadGNsyl2AYhawoYLWUF7wPgx2MsD77p1N4BSMyvUWn9znpy53yVF4j4E7KKY+ 68KuPFypewkHpPyE5L+GGkh5JrFjYbKWUtka+mz+w6g3KxbFTjGaaN+fPL3fSNIGtVsn PTkeEM1dP/338V5fI0Y2pp5dhQgmb9dnpZJKx4m75quMre1AYkmYW3j56IApqD41y7pU PSZs5Kncb27W7cfo346/gKs+sciYs2I7fBroa95BjEBM8F/WwCseXI66oBirt26sSor2 jb3A== X-Gm-Message-State: AGi0PuZV0QWcAoJs6UtVtnsMZNz72u4rw7M7GUCehHmaY8qfMQkNGGqd AA3nI6lz9ycEeXkEBKDQXUn/oQF/r+k= X-Google-Smtp-Source: APiQypLo2KsnOD3IP8EornlujL2uN5qo/QX3SVWS4aKcbrkUnfD9UjEAD2+xFgq0GNZnpZovYZc74A== X-Received: by 2002:ac2:4116:: with SMTP id b22mr877544lfi.172.1586381641914; Wed, 08 Apr 2020 14:34:01 -0700 (PDT) Received: from localhost.localdomain (212-5-158-138.ip.btc-net.bg. [212.5.158.138]) by smtp.gmail.com with ESMTPSA id t6sm15746688lfb.55.2020.04.08.14.33.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Apr 2020 14:34:01 -0700 (PDT) From: Stanimir Varbanov To: linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Vikash Garodia , Stanimir Varbanov Subject: [PATCH 2/7] venus: core: Fix mutex destroy in remove Date: Thu, 9 Apr 2020 00:33:25 +0300 Message-Id: <20200408213330.27665-3-stanimir.varbanov@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200408213330.27665-1-stanimir.varbanov@linaro.org> References: <20200408213330.27665-1-stanimir.varbanov@linaro.org> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org The hfi_destroy function is called too early in remove method. It destroys a mutex which is used later in the .remove from pmruntime. Solve the issue by moving hfi_destroy after last usage of the mutex. Signed-off-by: Stanimir Varbanov --- drivers/media/platform/qcom/venus/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c index f8b9a732bc65..afd76bcd9978 100644 --- a/drivers/media/platform/qcom/venus/core.c +++ b/drivers/media/platform/qcom/venus/core.c @@ -318,7 +318,6 @@ static int venus_remove(struct platform_device *pdev) ret = hfi_core_deinit(core, true); WARN_ON(ret); - hfi_destroy(core); venus_shutdown(core); of_platform_depopulate(dev); @@ -330,6 +329,8 @@ static int venus_remove(struct platform_device *pdev) if (pm_ops->core_put) pm_ops->core_put(dev); + hfi_destroy(core); + icc_put(core->video_path); icc_put(core->cpucfg_path); From patchwork Wed Apr 8 21:33:28 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stanimir Varbanov X-Patchwork-Id: 210245 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8FECC2BA2B for ; Wed, 8 Apr 2020 21:34:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 785A42082D for ; Wed, 8 Apr 2020 21:34:26 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="Rs+1EAWz" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730590AbgDHVeZ (ORCPT ); Wed, 8 Apr 2020 17:34:25 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:38548 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730770AbgDHVeK (ORCPT ); Wed, 8 Apr 2020 17:34:10 -0400 Received: by mail-lj1-f196.google.com with SMTP id v16so9327006ljg.5 for ; Wed, 08 Apr 2020 14:34:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=KqwTl0YCgxCFoD6QzWeacolgi5eHFyPVK66/B9eGEJU=; b=Rs+1EAWzy1VV58B8ic72umCM2g0DVr+FxSWDqFmuwQmbfcsQpCSPb7ozP5rsx/AY+v WRNLg7tvETXoGITLQpT/VnxMGFH2obCaWmepQI3a9qkWRDDXkdyEQIJCH/3Sj4/nTST0 T26x+BW6P1xRvZ0cSj/M70vkWbWi5s+NJMYTnYH/DbwSaaSfOTaD0im2zjRHktmqAotY eTtHSQcVx3L32UzappU/dibiG6+F0TR+g7dexzBVWP8PzFLig3R/qXtGrOiOd9MlGYES aJvKlWhE3FdV0pJwG+LKBZRLJeBP0lQhpN5F530MQF5kQY1xQj/NaWdktwvQT35PKwoy WzIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=KqwTl0YCgxCFoD6QzWeacolgi5eHFyPVK66/B9eGEJU=; b=cOBSZsxJ4ZtzxjEz3c2zD1KZ85W+O0I2pWHJ/6CenjcR/X42B3Aij49ysvMGuLaZ7m d1McuHZWjukNtrWcy4XghW4/Zqp3Mc6rNbx431ncc2EgZc3AzPiRR+SqsbNFcfLCJGGt IJTzkAMbhMUXf0Stmj4dTnUtfm1/htfKTrFSR3HkJ9TVczObf+Mh55J/cFmbAS3ajYMG qm+wreukf2S9VVAgAAlp8A5udTnIvNPgPRKQ9UY8WjxZ38G9lXshv+fj3ynWfvDfTiLy xLUz4jyEzVbx7QF5dk+E6OLtMGsT52dHatLD+IWmTRJ0Mq+y+q79GK8DcCGFQ7FhnaAz SjrQ== X-Gm-Message-State: AGi0PuZyZfWRTOe72W28qJJf75rWhC5WyTMPCnfFD1SAsVkSlOpeOSdF DOOTkJJ6BULqA+PSW4XhRH6B+tgP+AI= X-Google-Smtp-Source: APiQypLMz6OhjtqiITix26SHaGKIE/PNn8sq0YjVxchoC3Vnmc57okLBEnC2m/RXu2OROr26JHycvw== X-Received: by 2002:a2e:9ccd:: with SMTP id g13mr6174687ljj.147.1586381648068; Wed, 08 Apr 2020 14:34:08 -0700 (PDT) Received: from localhost.localdomain (212-5-158-138.ip.btc-net.bg. [212.5.158.138]) by smtp.gmail.com with ESMTPSA id t6sm15746688lfb.55.2020.04.08.14.34.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Apr 2020 14:34:07 -0700 (PDT) From: Stanimir Varbanov To: linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Vikash Garodia , Stanimir Varbanov Subject: [PATCH 5/7] venus: vdec: Mark flushed buffers with error state Date: Thu, 9 Apr 2020 00:33:28 +0300 Message-Id: <20200408213330.27665-6-stanimir.varbanov@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200408213330.27665-1-stanimir.varbanov@linaro.org> References: <20200408213330.27665-1-stanimir.varbanov@linaro.org> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Once the hfi_session_flush is issued by the vdec all queued buffers to firmware should be returned to the v4l driver. Some of those buffers are not processed at the time of flush command, those buffers has filled len zero (no data). Catch that in buffer_done callback and mark not filled capture buffers with error state so that client can discard them. Signed-off-by: Stanimir Varbanov --- drivers/media/platform/qcom/venus/vdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c index 7d093accbd59..5823537b3131 100644 --- a/drivers/media/platform/qcom/venus/vdec.c +++ b/drivers/media/platform/qcom/venus/vdec.c @@ -1241,6 +1241,9 @@ static void vdec_buf_done(struct venus_inst *inst, unsigned int buf_type, if (inst->codec_state == VENUS_DEC_STATE_DRAIN) inst->codec_state = VENUS_DEC_STATE_STOPPED; } + + if (!bytesused) + state = VB2_BUF_STATE_ERROR; } else { vbuf->sequence = inst->sequence_out++; } From patchwork Wed Apr 8 21:33:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stanimir Varbanov X-Patchwork-Id: 210246 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20D34C2BA80 for ; Wed, 8 Apr 2020 21:34:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E85F82082D for ; Wed, 8 Apr 2020 21:34:23 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="LnInvZrd" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730807AbgDHVeR (ORCPT ); Wed, 8 Apr 2020 17:34:17 -0400 Received: from mail-lf1-f68.google.com ([209.85.167.68]:37238 "EHLO mail-lf1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730784AbgDHVeN (ORCPT ); Wed, 8 Apr 2020 17:34:13 -0400 Received: by mail-lf1-f68.google.com with SMTP id t11so6327691lfe.4 for ; Wed, 08 Apr 2020 14:34:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=i8clFFvhHtURStOSkT8VPHksSoNdpLFd6h/Iv5cyGI4=; b=LnInvZrdIwupNbyGWWNiLyou/EL25bZac5eBr3jTVOIfPEW+fE4DypVYwGBMQR/ohi fz3GmUoCkoIQWq86bcc0NR4/uLND/ulWi1n90PaOt1C4xNZ0rydmjkToAOnIl6dyh2Qz ORP6KVN7HP9MipYbv15xeQf0Khg3Ts99bfLeksOG7tT4GRHGSgpVVlgZnS0zq68BPcJF 8GECRu1EQDr7ptBiqZBFqJ0J1LgAyLNLoUaiKTExZB6I4iaOzUQCHMKtWKntxWKWxEdn ga0+B9sf+h5bikFzqacmy/T/YhwbvTU7Z1FEup/UHx2sqyVAAR1NnkFA7lliMFZ8GnPf bp+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=i8clFFvhHtURStOSkT8VPHksSoNdpLFd6h/Iv5cyGI4=; b=DhaBJNy8GjFhgDE5BHFqNkU96DjwBRMb79/o2eweYB9Kp3NkZQfeBj5XCX1AKLAug8 bwELxgOhKnUHBY5tNY5D4MKJ4qdxyc/rcYDEmIZJkq7uB8Mr/gIQKL9NOYeeRT5QekA3 /exS0RC4PE8osmImGCVlX55SND6CWZ2TCsLwUMnt5RinIJVHAbyMI5o7LLRcDlW9VAHn V6bcGwCnmjAnIuNUmLysxIsYHfCkTtEE/Q75duYQZyZZBcHfc2CCr989T6JD/+Dm+DwZ Ccj+QnvwYRrxmt6M3XwFWfKs6frqp6CwlBc0qBVLhjsuvJUamoP+ZXd2ds4Jt6sV6lmX iuHw== X-Gm-Message-State: AGi0PuY+371l+EYOeIHtkiYMQfTh+J8De2NwXJmJESBxXdTk9uJeZ5Dn LNysYR4pVhLCcNipSP6RYUkRdoKO6mI= X-Google-Smtp-Source: APiQypIafYSBQ7sBXl2z33XJ4IVDpuvO6hb/lUDU0fCXq73HvkPJCCXY3/XQQspt3/SUnsH3GZurEQ== X-Received: by 2002:ac2:4da7:: with SMTP id h7mr5216375lfe.95.1586381651346; Wed, 08 Apr 2020 14:34:11 -0700 (PDT) Received: from localhost.localdomain (212-5-158-138.ip.btc-net.bg. [212.5.158.138]) by smtp.gmail.com with ESMTPSA id t6sm15746688lfb.55.2020.04.08.14.34.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Apr 2020 14:34:10 -0700 (PDT) From: Stanimir Varbanov To: linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Vikash Garodia , Stanimir Varbanov Subject: [PATCH 6/7] venus: vdec: Init registered list unconditionally Date: Thu, 9 Apr 2020 00:33:29 +0300 Message-Id: <20200408213330.27665-7-stanimir.varbanov@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200408213330.27665-1-stanimir.varbanov@linaro.org> References: <20200408213330.27665-1-stanimir.varbanov@linaro.org> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Presently the list initialization is done only in dynamic-resolution-change state, which leads to list corruptions and use-after-free. Init list_head unconditionally in vdec_stop_capture called by vb2 stop_streaming without takeing into account current codec state. Signed-off-by: Stanimir Varbanov --- drivers/media/platform/qcom/venus/vdec.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c index 5823537b3131..f23cbd812ef4 100644 --- a/drivers/media/platform/qcom/venus/vdec.c +++ b/drivers/media/platform/qcom/venus/vdec.c @@ -1072,13 +1072,14 @@ static int vdec_stop_capture(struct venus_inst *inst) case VENUS_DEC_STATE_DRC: ret = hfi_session_flush(inst, HFI_FLUSH_OUTPUT); inst->codec_state = VENUS_DEC_STATE_CAPTURE_SETUP; - INIT_LIST_HEAD(&inst->registeredbufs); venus_helper_free_dpb_bufs(inst); break; default: - return 0; + break; } + INIT_LIST_HEAD(&inst->registeredbufs); + return ret; }