linux-kernel - Re: [PATCH v11 08/12] media: mediatek: jpeg: fix remove buffer operation for multi-core

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <61f6d2af71bc6dabb55a866915d765b82007fedc.camel@mediatek.com>
Date: Thu, 25 Dec 2025 07:15:42 +0000
From: Kyrie Wu (吴晗) <Kyrie.Wu@...iatek.com>
To: "nicolas@...fresne.ca" <nicolas@...fresne.ca>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-mediatek@...ts.infradead.org" <linux-mediatek@...ts.infradead.org>,
	"linux-media@...r.kernel.org" <linux-media@...r.kernel.org>,
	"devicetree@...r.kernel.org" <devicetree@...r.kernel.org>,
	"mchehab@...nel.org" <mchehab@...nel.org>,
	Kyrie Wu (吴晗) <Kyrie.Wu@...iatek.com>,
	"conor+dt@...nel.org" <conor+dt@...nel.org>, "robh@...nel.org"
	<robh@...nel.org>, "hverkuil-cisco@...all.nl" <hverkuil-cisco@...all.nl>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "matthias.bgg@...il.com"
	<matthias.bgg@...il.com>, "krzk+dt@...nel.org" <krzk+dt@...nel.org>,
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
Subject: Re: [PATCH v11 08/12] media: mediatek: jpeg: fix remove buffer
 operation for multi-core

On Tue, 2025-12-16 at 16:43 -0500, Nicolas Dufresne wrote:
> Hi,
> 
> Le mardi 02 décembre 2025 à 17:47 +0800, Kyrie Wu a écrit :
> > move remove buffer code to spinlock protect area for multi-core
> 
> Perhaps:
> 
> Move calls to v4l2_m2m_src/dst_buf_remove() outside of the spinlock
> protected
> scope.
> 
> And perhaps extend in why this is needed. Deadlock, bad lock
> ordering?

Dear Nicolas,

move them to protected scope to avoid buffer lost if the worker
scheduled
but it hasn't enable jpeg hw succussed yet.

I will refine the commit message.

Thanks.

Regards,
Kyrie.
> 
> > 
> > Fixes: 86379bd9d399 ("media: mtk-jpeg: Fixes jpeg enc&dec worker sw
> > flow")
> > 
> 
> No blank.
> 
> > Signed-off-by: Kyrie Wu <kyrie.wu@...iatek.com>
> 
> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@...labora.com>
> 
> Nicolas
> 
> > ---
> >  drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 10 ++++--
> > ----
> >  1 file changed, 4 insertions(+), 6 deletions(-)
> > 
> > diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> > b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> > index 9233bbfe2d97..da1ca494ed4b 100644
> > --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> > +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> > @@ -1665,9 +1665,6 @@ static void mtk_jpegenc_worker(struct
> > work_struct *work)
> >  		goto enc_end;
> >  	}
> >  
> > -	v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
> > -	v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
> > -
> >  	schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work,
> >  			     
> > msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
> >  
> > @@ -1685,6 +1682,8 @@ static void mtk_jpegenc_worker(struct
> > work_struct *work)
> >  			     &src_buf->vb2_buf);
> >  	mtk_jpeg_set_enc_params(ctx, comp_jpeg[hw_id]->reg_base);
> >  	mtk_jpeg_enc_start(comp_jpeg[hw_id]->reg_base);
> > +	v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
> > +	v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
> >  	jpeg_buf_queue_inc(ctx);
> >  	v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
> >  	spin_unlock_irqrestore(&comp_jpeg[hw_id]->hw_lock, flags);
> > @@ -1767,9 +1766,6 @@ static void mtk_jpegdec_worker(struct
> > work_struct *work)
> >  		goto dec_end;
> >  	}
> >  
> > -	v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
> > -	v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
> > -
> >  	mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);
> >  	if (mtk_jpeg_set_dec_dst(ctx,
> >  				 &jpeg_src_buf->dec_param,
> > @@ -1794,6 +1790,8 @@ static void mtk_jpegdec_worker(struct
> > work_struct *work)
> >  				jpeg_src_buf->bs_size,
> >  				&bs,
> >  				&fb);
> > +	v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
> > +	v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
> >  	mtk_jpeg_dec_start(comp_jpeg[hw_id]->reg_base);
> >  	jpeg_buf_queue_inc(ctx);
> >  	v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);