| Message ID | 20241025034629.660047-2-senozhatsky@chromium.org (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | media: venus: close() fixes | expand |
On 10/25/2024 9:16 AM, Sergey Senozhatsky wrote: > We destroy mutex-es too early as they are still taken in > v4l2_fh_exit()->v4l2_event_unsubscribe()->v4l2_ctrl_find(). > > We should destroy mutex-es right before kfree(). Also > do not vdec_ctrl_deinit() before v4l2_fh_exit(). > > Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") > Suggested-by: Tomasz Figa <tfiga@google.com> > Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org> > Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> > --- > drivers/media/platform/qcom/venus/vdec.c | 7 ++++--- > drivers/media/platform/qcom/venus/venc.c | 6 +++--- > 2 files changed, 7 insertions(+), 6 deletions(-) > > diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c > index 6252a6b3d4ba..0013c4704f03 100644 > --- a/drivers/media/platform/qcom/venus/vdec.c > +++ b/drivers/media/platform/qcom/venus/vdec.c > @@ -1752,13 +1752,14 @@ static int vdec_close(struct file *file) > cancel_work_sync(&inst->delayed_process_work); > v4l2_m2m_ctx_release(inst->m2m_ctx); > v4l2_m2m_release(inst->m2m_dev); > - vdec_ctrl_deinit(inst); > ida_destroy(&inst->dpb_ids); > hfi_session_destroy(inst); > - mutex_destroy(&inst->lock); > - mutex_destroy(&inst->ctx_q_lock); > v4l2_fh_del(&inst->fh); > v4l2_fh_exit(&inst->fh); > + vdec_ctrl_deinit(inst); Why vdec_ctrl_deinit ->v4l2_ctrl_handler_free(&inst->ctrl_handler) needs to be called after v4l2_fh_exit? Ideally it should be before v4l2_fh_exit. Thanks, Dikshita > + > + mutex_destroy(&inst->lock); > + mutex_destroy(&inst->ctx_q_lock); > > vdec_pm_put(inst, false); > > diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c > index 322a7737e2c7..6a26a6592424 100644 > --- a/drivers/media/platform/qcom/venus/venc.c > +++ b/drivers/media/platform/qcom/venus/venc.c > @@ -1519,14 +1519,14 @@ static int venc_close(struct file *file) > > v4l2_m2m_ctx_release(inst->m2m_ctx); > v4l2_m2m_release(inst->m2m_dev); > - venc_ctrl_deinit(inst); > hfi_session_destroy(inst); > - mutex_destroy(&inst->lock); > - mutex_destroy(&inst->ctx_q_lock); > v4l2_fh_del(&inst->fh); > v4l2_fh_exit(&inst->fh); > + venc_ctrl_deinit(inst); > > inst->enc_state = VENUS_ENC_STATE_DEINIT; > + mutex_destroy(&inst->lock); > + mutex_destroy(&inst->ctx_q_lock); > > venc_pm_put(inst, false); >
On (24/10/25 12:50), Dikshita Agarwal wrote: > > diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c > > index 6252a6b3d4ba..0013c4704f03 100644 > > --- a/drivers/media/platform/qcom/venus/vdec.c > > +++ b/drivers/media/platform/qcom/venus/vdec.c > > @@ -1752,13 +1752,14 @@ static int vdec_close(struct file *file) > > cancel_work_sync(&inst->delayed_process_work); > > v4l2_m2m_ctx_release(inst->m2m_ctx); > > v4l2_m2m_release(inst->m2m_dev); > > - vdec_ctrl_deinit(inst); > > ida_destroy(&inst->dpb_ids); > > hfi_session_destroy(inst); > > - mutex_destroy(&inst->lock); > > - mutex_destroy(&inst->ctx_q_lock); > > v4l2_fh_del(&inst->fh); > > v4l2_fh_exit(&inst->fh); > > + vdec_ctrl_deinit(inst); > Why vdec_ctrl_deinit ->v4l2_ctrl_handler_free(&inst->ctrl_handler) needs to > be called after v4l2_fh_exit? > Ideally it should be before v4l2_fh_exit. Because ->fh holds a pointer to ->ctrl_handler inst->fh.ctrl_handler = &inst->ctrl_handler so after vdec_ctrl_deinit() fh holds stale (released) data. In general destruction in reverse order of initialization is safer. init: init ctrl init fh // using ctrl de-init: release fh release ctrl
diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c index 6252a6b3d4ba..0013c4704f03 100644 --- a/drivers/media/platform/qcom/venus/vdec.c +++ b/drivers/media/platform/qcom/venus/vdec.c @@ -1752,13 +1752,14 @@ static int vdec_close(struct file *file) cancel_work_sync(&inst->delayed_process_work); v4l2_m2m_ctx_release(inst->m2m_ctx); v4l2_m2m_release(inst->m2m_dev); - vdec_ctrl_deinit(inst); ida_destroy(&inst->dpb_ids); hfi_session_destroy(inst); - mutex_destroy(&inst->lock); - mutex_destroy(&inst->ctx_q_lock); v4l2_fh_del(&inst->fh); v4l2_fh_exit(&inst->fh); + vdec_ctrl_deinit(inst); + + mutex_destroy(&inst->lock); + mutex_destroy(&inst->ctx_q_lock); vdec_pm_put(inst, false); diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c index 322a7737e2c7..6a26a6592424 100644 --- a/drivers/media/platform/qcom/venus/venc.c +++ b/drivers/media/platform/qcom/venus/venc.c @@ -1519,14 +1519,14 @@ static int venc_close(struct file *file) v4l2_m2m_ctx_release(inst->m2m_ctx); v4l2_m2m_release(inst->m2m_dev); - venc_ctrl_deinit(inst); hfi_session_destroy(inst); - mutex_destroy(&inst->lock); - mutex_destroy(&inst->ctx_q_lock); v4l2_fh_del(&inst->fh); v4l2_fh_exit(&inst->fh); + venc_ctrl_deinit(inst); inst->enc_state = VENUS_ENC_STATE_DEINIT; + mutex_destroy(&inst->lock); + mutex_destroy(&inst->ctx_q_lock); venc_pm_put(inst, false);
We destroy mutex-es too early as they are still taken in v4l2_fh_exit()->v4l2_event_unsubscribe()->v4l2_ctrl_find(). We should destroy mutex-es right before kfree(). Also do not vdec_ctrl_deinit() before v4l2_fh_exit(). Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") Suggested-by: Tomasz Figa <tfiga@google.com> Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> --- drivers/media/platform/qcom/venus/vdec.c | 7 ++++--- drivers/media/platform/qcom/venus/venc.c | 6 +++--- 2 files changed, 7 insertions(+), 6 deletions(-)