On Sat Jul 18 21:00:36 2026 +0800, Guangshuo Li wrote:
> wave5_vpu_dec_buf_queue_dst() resumes the VPU before it may clear a
> decoder display flag. This is needed because clearing the display flag
> accesses VPU registers.
>
> However, the return value from pm_runtime_resume_and_get() is ignored.
> If the resume fails, pm_runtime_resume_and_get() returns without holding
> a runtime PM usage reference. The unconditional
> pm_runtime_put_autosuspend() at the end of the function then drops an
> unmatched reference.
>
> The failed resume path can also continue into
> wave5_vpu_dec_clr_disp_flag() while the device is still suspended.
>
> Check the return value. If the resume fails, complete the queued buffer
> with an error and return without touching the hardware or dropping an
> unmatched runtime PM reference.
>
> Fixes: cbb9c0d50e47 ("media: chips-media: wave5: Fix SError of kernel panic
> when closed")
> Cc: [email protected]
> Signed-off-by: Guangshuo Li <[email protected]>
> Reviewed-by: Nicolas Dufresne <[email protected]>
> Signed-off-by: Nicolas Dufresne <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
---
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
index 6564cf3ec739..86bc36ee17fd 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
@@ -1302,8 +1302,14 @@ static void wave5_vpu_dec_buf_queue_dst(struct
vb2_buffer *vb)
struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
struct vpu_instance *inst = vb2_get_drv_priv(vb->vb2_queue);
struct v4l2_m2m_ctx *m2m_ctx = inst->v4l2_fh.m2m_ctx;
+ int ret;
+
+ ret = pm_runtime_resume_and_get(inst->dev->dev);
+ if (ret < 0) {
+ vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
+ return;
+ }
- pm_runtime_resume_and_get(inst->dev->dev);
vbuf->sequence = inst->queued_dst_buf_num++;
if (inst->state == VPU_INST_STATE_PIC_RUN) {
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
