vdec_start_streaming() launches a recycle thread when required by the codec. If kthread_run() fails, the previous error path only powered off the hardware, leaving sess->priv and codec state allocated. This caused a permanent leak of the codec context and associated DMA buffers.
Fix this by introducing a dedicated err_cleanup path: - Call codec_ops->stop() to release the codec context and clear sess->priv. - Power off the hardware before freeing buffers to avoid DMA faults. - Free canvas IDs explicitly and set sess->vififo_vaddr = NULL after dma_free_coherent() to guard against double‑free in fallback stop paths. - Reset core->cur_sess and sess->status to prevent stale references. Following change closes the memory leak on kthread_run() failure and ensures robust cleanup of codec resources in both error and stop paths. Cc: Nicolas Dufresne <[email protected]> Reported-by: Sashiko <[email protected]> Closes: https://lore.kernel.org/all/[email protected]/ Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") Signed-off-by: Anand Moon <[email protected]> --- drivers/staging/media/meson/vdec/vdec.c | 26 ++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c index 7233000e2232..8a5bf1a96830 100644 --- a/drivers/staging/media/meson/vdec/vdec.c +++ b/drivers/staging/media/meson/vdec/vdec.c @@ -32,6 +32,8 @@ struct dummy_buf { /* 16 MiB for parsed bitstream swap exchange */ #define SIZE_VIFIFO SZ_16M +static void vdec_free_canvas(struct amvdec_session *sess); + static u32 get_output_size(u32 width, u32 height) { return ALIGN(width * height, SZ_64K); @@ -352,16 +354,31 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count) sess->sequence_cap = 0; sess->sequence_out = 0; - if (vdec_codec_needs_recycle(sess)) + if (vdec_codec_needs_recycle(sess)) { sess->recycle_thread = kthread_run(vdec_recycle_thread, sess, "vdec_recycle"); + if (IS_ERR(sess->recycle_thread)) { + ret = PTR_ERR(sess->recycle_thread); + sess->recycle_thread = NULL; + goto err_cleanup; + } + } schedule_work(&sess->esparser_queue_work); return 0; +err_cleanup: + vdec_free_canvas(sess); + vdec_poweroff(sess); + if (codec_ops && codec_ops->stop && sess->priv) { + codec_ops->stop(sess); + kfree(sess->priv); + sess->priv = NULL; + } vififo_free: dma_free_coherent(sess->core->dev, sess->vififo_size, sess->vififo_vaddr, sess->vififo_paddr); + sess->vififo_vaddr = NULL; bufs_done: mutex_lock(&core->lock); if (core->cur_sess == sess) @@ -441,8 +458,11 @@ static void vdec_stop_streaming(struct vb2_queue *q) vdec_poweroff(sess); vdec_free_canvas(sess); - dma_free_coherent(sess->core->dev, sess->vififo_size, - sess->vififo_vaddr, sess->vififo_paddr); + if (sess->vififo_vaddr) { + dma_free_coherent(sess->core->dev, sess->vififo_size, + sess->vififo_vaddr, + sess->vififo_paddr); + } vdec_reset_timestamps(sess); vdec_reset_bufs_recycle(sess); kfree(sess->priv); -- 2.50.1
