Skip to content

drivers: media: pisp_be: Fix for job queue removal in stop_streaming() #6999

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
naushir merged 2 commits into from
Aug 14, 2025
Merged

drivers: media: pisp_be: Fix for job queue removal in stop_streaming() #6999

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1506a5e
drivers: media: pisp_be: Fix for job queue removal in stop_streaming()
naushir Aug 13, 2025
3e4f99e
drivers: media: pisp_be: Fix use after free in job queue logic
naushir Aug 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 13 additions & 21 deletions drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -594,9 +594,7 @@ static int pispbe_prepare_job(struct pispbe_node_group *node_group)
return -ENODEV;
}

static void pispbe_schedule(struct pispbe_dev *pispbe,
struct pispbe_node_group *node_group,
bool clear_hw_busy)
static void pispbe_schedule(struct pispbe_dev *pispbe, bool clear_hw_busy)
{
struct pispbe_job_descriptor *job;

Expand All @@ -613,9 +611,6 @@ static void pispbe_schedule(struct pispbe_dev *pispbe,
if (!job)
return;

if (node_group && job->node_group != node_group)
continue;

list_del(&job->queue);

for (unsigned int i = 0; i < PISPBE_NUM_NODES; i++)
Expand Down Expand Up @@ -703,7 +698,7 @@ static irqreturn_t pispbe_isr(int irq, void *dev)
}

/* check if there's more to do before going to sleep */
pispbe_schedule(pispbe, NULL, can_queue_another);
pispbe_schedule(pispbe, can_queue_another);

return IRQ_HANDLED;
}
Expand Down Expand Up @@ -894,7 +889,7 @@ static void pispbe_node_buffer_queue(struct vb2_buffer *buf)
* to do, but only for this client.
*/
if (!pispbe_prepare_job(node_group))
pispbe_schedule(pispbe, node_group, false);
pispbe_schedule(pispbe, false);
}

static int pispbe_node_start_streaming(struct vb2_queue *q, unsigned int count)
Expand All @@ -921,7 +916,7 @@ static int pispbe_node_start_streaming(struct vb2_queue *q, unsigned int count)

/* Maybe we're ready to run. */
if (!pispbe_prepare_job(node_group))
pispbe_schedule(pispbe, node_group, false);
pispbe_schedule(pispbe, false);

return 0;

Expand All @@ -941,7 +936,6 @@ static void pispbe_node_stop_streaming(struct vb2_queue *q)
struct pispbe_dev *pispbe = node_group->pispbe;
struct pispbe_job_descriptor *job, *temp;
struct pispbe_buffer *buf;
LIST_HEAD(tmp_list);

/*
* Now this is a bit awkward. In a simple M2M device we could just wait
Expand All @@ -968,20 +962,18 @@ static void pispbe_node_stop_streaming(struct vb2_queue *q)
spin_lock_irq(&pispbe->hw_lock);
node_group->streaming_map &= ~BIT(node->id);

if (node_group->streaming_map == 0) {
/*
* If all nodes have stopped streaming release all jobs
* without holding the lock.
*/
list_splice_init(&pispbe->job_queue, &tmp_list);
/*
* If a node has stopped streaming release all jobs belonging to the
* node group immediately.
*/
list_for_each_entry_safe(job, temp, &pispbe->job_queue, queue) {
if (job->node_group == node->node_group) {
list_del(&job->queue);
kfree(job);
}
}
spin_unlock_irq(&pispbe->hw_lock);

list_for_each_entry_safe(job, temp, &tmp_list, queue) {
list_del(&job->queue);
kfree(job);
}

pm_runtime_mark_last_busy(pispbe->dev);
pm_runtime_put_autosuspend(pispbe->dev);

Expand Down
Loading