From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from esa.microchip.iphmx.com (esa.microchip.iphmx.com [68.232.153.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0BBC13F4111; Wed, 27 May 2026 11:07:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=68.232.153.233 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779880058; cv=none; b=b+VhCuGUIh8Zd0HXmAWx54IWnMecs5bmJrZ2laSK6sSKkI8q3zEESVYHZA0LdKky0Rla61BCTs7ImgmWEq/OjvoZODKsCn2cSUSLmp6A42hcRZFWNnipIxq0dMOkh4+bIyIWChZRt+aKyYrXS0+XDudYmxMk2V7bYNruLEhqleA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779880058; c=relaxed/simple; bh=aU0h4iGXClnIzKcybJRuKFUv+3+oLLIWDAVu+DcXYDk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=GpYt6IPIkCVpF97fW9aOM2MCjWa3GATQNRQcOshosGArhYY7HUyDsn398wBjhtGI0mdbIkR1cL/8AmFSIjjioHU3+raEzFkmZ8okOJXN67TY61hZ6JISa2kxAE9QhYr+bAPbIUME2q3musZc79ppIklgRRA7+g2qfZRQBurcwUs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=microchip.com; spf=pass smtp.mailfrom=microchip.com; dkim=pass (2048-bit key) header.d=microchip.com header.i=@microchip.com header.b=fT0osknP; arc=none smtp.client-ip=68.232.153.233 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=microchip.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=microchip.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=microchip.com header.i=@microchip.com header.b="fT0osknP" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=microchip.com; i=@microchip.com; q=dns/txt; s=mchp; t=1779880057; x=1811416057; h=from:date:subject:mime-version:content-transfer-encoding: message-id:references:in-reply-to:to:cc; bh=aU0h4iGXClnIzKcybJRuKFUv+3+oLLIWDAVu+DcXYDk=; b=fT0osknPYLdvV9Oko0XrFey7mz/czp7mTOu9mvHWiMLfKVHE/AhybzuO uWbZ9zN/9U7l0tNz189LCwI7j/GfUAHb7QUMKDYWmAgNvxslgXlHelfBg FsRRpsf8jPUIxeB312NEV8XkBaQcl41ehbYJE9FC2iBEH+w1iBLGJv+ar 8Hy7GcJi6XcNfYukePDXHqk9EMRMOx3mAVr2zQEAyYKNsoIe45gwW7ofb aV3tSDJmxsES4G0vlk6GwXyOIcg8oT8dOaZAe+fcGZnLd57vKEfdzB7BU FH64dQsWZcQXVOJPjXltK6rLoEZcJ1PTid8Zs9bhJPdoZI+Lw97Pf7Ie4 Q==; X-CSE-ConnectionGUID: +GzW8YAjRs6BAuMWdf9HmQ== X-CSE-MsgGUID: opLibaBLR92WJ3T96Y/opA== X-IronPort-AV: E=Sophos;i="6.24,171,1774335600"; d="scan'208";a="58112116" X-Amp-Result: SKIPPED(no attachment in message) Received: from unknown (HELO email.microchip.com) ([170.129.1.10]) by esa3.microchip.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 27 May 2026 04:07:36 -0700 Received: from chn-vm-ex02.mchp-main.com (10.10.85.144) by chn-vm-ex03.mchp-main.com (10.10.85.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.58; Wed, 27 May 2026 04:07:35 -0700 Received: from [127.0.0.1] (10.10.85.11) by chn-vm-ex02.mchp-main.com (10.10.85.144) with Microsoft SMTP Server id 15.1.2507.58 via Frontend Transport; Wed, 27 May 2026 04:07:32 -0700 From: Balakrishnan Sambath Date: Wed, 27 May 2026 16:37:19 +0530 Subject: [PATCH v5 03/12] media: microchip-isc: fix race condition on stream stop Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <20260527-microchip-isc-fixes-v5-3-b0ec1bb954be@microchip.com> References: <20260527-microchip-isc-fixes-v5-0-b0ec1bb954be@microchip.com> In-Reply-To: <20260527-microchip-isc-fixes-v5-0-b0ec1bb954be@microchip.com> To: Eugen Hristev , Mauro Carvalho Chehab , Hans Verkuil CC: Laurent Pinchart , Kieran Bingham , Sakari Ailus , Balamanikandan Gunasundar , , , , "Balakrishnan Sambath" X-Mailer: b4 0.14.3 Disable histogram and drain AWB work queue before releasing DMA buffers to prevent use-after-free if histogram IRQ fires during stream stop. Fixes: 91b4e487b0c6 ("media: microchip: add ISC driver as Microchip ISC") Cc: stable@vger.kernel.org Signed-off-by: Balakrishnan Sambath --- drivers/media/platform/microchip/microchip-isc-base.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c index 45b94f1e89d8..b19c5a63b4bd 100644 --- a/drivers/media/platform/microchip/microchip-isc-base.c +++ b/drivers/media/platform/microchip/microchip-isc-base.c @@ -427,6 +427,14 @@ static void isc_stop_streaming(struct vb2_queue *vq) mutex_unlock(&isc->awb_mutex); + /* + * Disable the histogram so the ISR stops firing HISREQ, then drain + * any work that was already queued before returning. This must happen + * after releasing awb_mutex because isc_awb_work also takes it. + */ + isc_set_histogram(isc, false); + cancel_work_sync(&isc->awb_work); + /* Disable DMA interrupt */ regmap_write(isc->regmap, ISC_INTDIS, ISC_INT_DDONE); @@ -1519,10 +1527,17 @@ static int isc_s_awb_ctrl(struct v4l2_ctrl *ctrl) } mutex_unlock(&isc->awb_mutex); - /* if we have autowhitebalance on, start histogram procedure */ + /* + * If AWB auto mode is requested and we are streaming RAW, + * start the histogram procedure, but only if it is not + * already running. Repeated enable requests would reset + * hist_id, preventing the 4-channel Bayer cycle from + * completing. + */ if (ctrls->awb == ISC_WB_AUTO && vb2_is_streaming(&isc->vb2_vidq) && - ISC_IS_FORMAT_RAW(isc->config.sd_format->mbus_code)) + ISC_IS_FORMAT_RAW(isc->config.sd_format->mbus_code) && + ctrls->hist_stat != HIST_ENABLED) isc_set_histogram(isc, true); /* -- 2.34.1