linux-kernel - Re: [PATCH v3 3/4] media: dw100: Fix kernel oops with PREEMPT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4d5ee7e6-3e75-48f4-a142-8bbdf3a3184b@oss.nxp.com>
Date: Fri, 6 Feb 2026 08:55:01 +0100
From: "Xavier Roumegue (OSS)" <xavier.roumegue@....nxp.com>
To: Stefan Klug <stefan.klug@...asonboard.com>,
 Mauro Carvalho Chehab <mchehab@...nel.org>,
 Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
 Clark Williams <clrkwllms@...nel.org>, Steven Rostedt <rostedt@...dmis.org>,
 Laurent Pinchart <laurent.pinchart@...asonboard.com>
Cc: linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-rt-devel@...ts.linux.dev, Nicolas Dufresne <nicolas@...fresne.ca>
Subject: Re: [PATCH v3 3/4] media: dw100: Fix kernel oops with PREEMPT_RT
 enabled

Hi Stefan,

On 1/29/26 12:43 PM, Stefan Klug wrote:
> On kernels with PREEMPT_RT enabled, a "BUG: scheduling while atomic"
> kernel oops occurs inside dw100_irq_handler -> vb2_buffer_done. This is
> because vb2_buffer_done takes a spinlock which is not allowed within
> interrupt context on PREEMPT_RT.
>
> The first attempt to fix this was to just drop the IRQF_ONESHOT so that
> the interrupt is handled threaded on PREEMPT_RT systems. This introduced
> a new issue. The dw100 has an internal timeout counter that is gated by
> the DW100_BUS_CTRL_AXI_MASTER_ENABLE bit. Depending on the time it takes
> for the threaded handler to run and the geometry of the data being
> processed it is possible to reach the timeout resulting in
> DW100_INTERRUPT_STATUS_INT_ERR_TIME_OUT being set and "dw100
> 32e30000.dwe: Interrupt error: 0x1" errors in dmesg.
>
> To properly fix that, split the interrupt into two halves, reset the
> DW100_BUS_CTRL_AXI_MASTER_ENABLE bit in the hard interrupt handler and
> do the v4l2 buffer handling in the threaded half. The IRQF_ONESHOT can
> still be dropped as the interrupt gets disabled in the hard handler and
> will only be reenabled on the next dw100_device_run which will not be
> called before the current job has finished.
>
> Signed-off-by: Stefan Klug <stefan.klug@...asonboard.com>

Reviewed-by: Xavier Roumegue <xavier.roumegue@....nxp.com>


> ---
>
> Thank you Xavier for the technical support and further details on the
> interrupt bit.
Welcome :)

Regards,

  Xavier

>
> Changes in v3:
> - Split interrupt in two halves to prevent timeout error
> - Dropped rby tags, as the patch changed substantially
>
> Changes in v2:
> - Dropped the IRQF_ONESHOT instead of making the interrupt handler
>    threaded to fix the issue.
> - I didn't keep the r-by tag from Nicolas as the solution is now a
>    different one.
> ---
>   drivers/media/platform/nxp/dw100/dw100.c | 21 ++++++++++++++++-----
>   1 file changed, 16 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/media/platform/nxp/dw100/dw100.c b/drivers/media/platform/nxp/dw100/dw100.c
> index d2b1c62b52db47ea1d2242caaf334fff30c6f366..46e3a7b74fb777aa479110a52229f36b8632db44 100644
> --- a/drivers/media/platform/nxp/dw100/dw100.c
> +++ b/drivers/media/platform/nxp/dw100/dw100.c
> @@ -10,6 +10,7 @@
>   #include <linux/clk.h>
>   #include <linux/debugfs.h>
>   #include <linux/interrupt.h>
> +#include <linux/irqreturn.h>
>   #include <linux/io.h>
>   #include <linux/minmax.h>
>   #include <linux/module.h>
> @@ -74,6 +75,7 @@ struct dw100_device {
>   	struct clk_bulk_data		*clks;
>   	int				num_clks;
>   	struct dentry			*debugfs_root;
> +	bool				frame_failed;
>   };
>   
>   struct dw100_q_data {
> @@ -1406,7 +1408,8 @@ static irqreturn_t dw100_irq_handler(int irq, void *dev_id)
>   {
>   	struct dw100_device *dw_dev = dev_id;
>   	u32 pending_irqs, err_irqs, frame_done_irq;
> -	bool with_error = true;
> +
> +	dw_dev->frame_failed = true;
>   
>   	pending_irqs = dw_hw_get_pending_irqs(dw_dev);
>   	frame_done_irq = pending_irqs & DW100_INTERRUPT_STATUS_INT_FRAME_DONE;
> @@ -1414,7 +1417,7 @@ static irqreturn_t dw100_irq_handler(int irq, void *dev_id)
>   
>   	if (frame_done_irq) {
>   		dev_dbg(&dw_dev->pdev->dev, "Frame done interrupt\n");
> -		with_error = false;
> +		dw_dev->frame_failed = false;
>   		err_irqs &= ~DW100_INTERRUPT_STATUS_INT_ERR_STATUS
>   			(DW100_INTERRUPT_STATUS_INT_ERR_FRAME_DONE);
>   	}
> @@ -1427,7 +1430,14 @@ static irqreturn_t dw100_irq_handler(int irq, void *dev_id)
>   	dw100_hw_clear_irq(dw_dev, pending_irqs |
>   			   DW100_INTERRUPT_STATUS_INT_ERR_TIME_OUT);
>   
> -	dw100_job_finish(dw_dev, with_error);
> +	return IRQ_WAKE_THREAD;
> +}
> +
> +static irqreturn_t dw100_irq_thread_fn(int irq, void *dev_id)
> +{
> +	struct dw100_device *dw_dev = dev_id;
> +
> +	dw100_job_finish(dw_dev, dw_dev->frame_failed);
>   
>   	return IRQ_HANDLED;
>   }
> @@ -1593,8 +1603,9 @@ static int dw100_probe(struct platform_device *pdev)
>   
>   	pm_runtime_put_sync(&pdev->dev);
>   
> -	ret = devm_request_irq(&pdev->dev, irq, dw100_irq_handler, IRQF_ONESHOT,
> -			       dev_name(&pdev->dev), dw_dev);
> +	ret = devm_request_threaded_irq(&pdev->dev, irq, dw100_irq_handler,
> +					dw100_irq_thread_fn, 0,
> +					dev_name(&pdev->dev), dw_dev);
>   	if (ret < 0) {
>   		dev_err(&pdev->dev, "Failed to request irq: %d\n", ret);
>   		goto err_pm;
>