On Fri Jul 31 03:31:43 2026 +0300, Dmitry Baryshkov wrote:
> iris_add_session() silently skips adding the instance to core->instances
> once max_session_count is reached, but returns void, so iris_open()
> continues as if it succeeded and hands a file descriptor back to
> userspace. As the instance is not on core->instances, firmware responses
> for it are dropped and every subsequent ioctl times out.
>
> Make iris_add_session() return an error when the limit is reached and
> fail iris_open() accordingly, freeing the partially initialised instance.
>
> Fixes: 38fc8beaba55 ("media: iris: implement reqbuf ioctl with
> vb2_queue_setup")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dmitry Baryshkov <[email protected]>
> Reviewed-by: Konrad Dybcio <[email protected]>
> Signed-off-by: Bryan O'Donoghue <[email protected]>
Patch committed.
Thanks,
Bryan O'Donoghue
drivers/media/platform/qcom/iris/iris_vidc.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
---
diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c
b/drivers/media/platform/qcom/iris/iris_vidc.c
index 278028df1830..2ce73930017f 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -40,21 +40,23 @@ static void iris_v4l2_fh_deinit(struct iris_inst *inst,
struct file *filp)
v4l2_fh_exit(&inst->fh);
}
-static void iris_add_session(struct iris_inst *inst)
+static int iris_add_session(struct iris_inst *inst)
{
struct iris_core *core = inst->core;
struct iris_inst *iter;
u32 count = 0;
- mutex_lock(&core->lock);
+ guard(mutex)(&core->lock);
list_for_each_entry(iter, &core->instances, list)
count++;
- if (count < core->iris_platform_data->max_session_count)
- list_add_tail(&inst->list, &core->instances);
+ if (count >= core->iris_platform_data->max_session_count)
+ return -EBUSY;
- mutex_unlock(&core->lock);
+ list_add_tail(&inst->list, &core->instances);
+
+ return 0;
}
static void iris_remove_session(struct iris_inst *inst)
@@ -204,12 +206,17 @@ int iris_open(struct file *filp)
if (ret)
goto fail_m2m_ctx_release;
- iris_add_session(inst);
+ ret = iris_add_session(inst);
+ if (ret)
+ goto fail_inst_deinit;
inst->fh.m2m_ctx = inst->m2m_ctx;
return 0;
+fail_inst_deinit:
+ kfree(inst->fmt_src);
+ kfree(inst->fmt_dst);
fail_m2m_ctx_release:
v4l2_m2m_ctx_release(inst->m2m_ctx);
fail_m2m_release:
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
