[PATCH] media: ti: j721e-csi2rx: Stop DMA on failure in sd_enable_streams()

[PATCH] media: ti: j721e-csi2rx: Stop DMA on failure in sd_enable_streams()

[Mattijs Korpershoek]

ti_csi2rx_sd_enable_streams() configures some hardware
resources (PIX_RST and shim). It also marks the DMA as active.

When v4l2_subdev_enable_streams() fails in that function, an early
return is done without cleaning up these resources.
This crashes the kernel when the buffer gets unmapped later:

Unable to start streaming: Link has been severed (67).
[ 4492.749621] Unable to handle kernel paging request at virtual address fffffdffd829c388
[ 4492.762081] Mem abort info:
[ 4492.764862]   ESR = 0x0000000096000006
[ 4492.768606]   EC = 0x25: DABT (current EL), IL = 32 bits
[ 4492.773913]   SET = 0, FnV = 0
[ 4492.776956]   EA = 0, S1PTW = 0
[ 4492.780090]   FSC = 0x06: level 2 translation fault
[ 4492.784959] Data abort info:
[ 4492.787835]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
[ 4492.793311]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 4492.798359]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 4492.803663] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000c58227000
[ 4492.810358] [fffffdffd829c388] pgd=0000000000000000, p4d=1000000ffbf4f403, pud=1000000ffbf4e403, pmd=0000000000000000
[ 4492.820959] Internal error: Oops: 0000000096000006 [#1]  SMP
[ 4492.826602] Modules linked in: imx219 v4l2_cci ds90ub953 mux_gpio j721e_csi2rx ds90ub960 cdns_csi2rx wave5 videobuf2_dma_contig videobuf2_memops v4l2_fwnode v4l2_mem2mem videobuf2_v4l2 videobuf2_common v4l2_async at24 m_can_platform videodev k3_j72xx_bandgap ti_k3_dsp_remoteproc mc m_can can_dev mc_evbase i2c_atr
onboard_usb_dev fuse zram zsmalloc rpmsg_ctrl rpmsg_char cdns display_connector omap_hwspinlock ti_k3_r5_remoteproc phy_can_transceiver tidss ti_k3_common omap_mailbox drm_client_lib drm_dma_helper cdns_mhdp8546 ti_tfp410 drm_display_helper drm_kms_helper cec sa2ul cdns_dphy_rx drm cdns3_ti rti_wdt drm_panel_orientat
ion_quirks backlight dm_mirror dm_region_hash dm_log dm_mod
[ 4492.887132] CPU: 3 UID: 0 PID: 1457 Comm: yavta Not tainted 7.2.0-rc1-00371-g40ef2669cb4a #86 PREEMPT
[ 4492.896417] Hardware name: ti Texas Instruments AM69 SK/Texas Instruments AM69 SK, BIOS 2027.01-rc1-00132-gee9fc27f2a2a 01/01/2027
[ 4492.908128] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 4492.915071] pc : __zap_vma_range+0x5c8/0x1500
[ 4492.919427] lr : __zap_vma_range+0x5bc/0x1500
[ 4492.923770] sp : ffff800087c438e0
[ 4492.927070] x29: ffff800087c439e0 x28: ffff800087c43aa8 x27: 0000ffffb720c000
[ 4492.934189] x26: ffff00080dfd2060 x25: fffffdffd829c380 x24: ffff00080dfd2060
[ 4492.941307] x23: 000000068a70efc3 x22: 0000ffffb720c000 x21: 0000000000000000
[ 4492.948427] x20: ffff800087c43a58 x19: 0000ffffb72f9000 x18: 0000000000000000
[ 4492.955545] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffb72f9000
[ 4492.962663] x14: 0000000000000000 x13: 0000ffffb7eacfff x12: 0000ffffb70fe000
[ 4492.969781] x11: 0000ffffb7ea1fff x10: 0000ffffb7e9ffff x9 : 0000ffffb7ed9fff
[ 4492.976899] x8 : ffff800087c43b28 x7 : 0000000000000000 x6 : ffff00080a621dc8
[ 4492.984018] x5 : 0000ffffb720c000 x4 : 0000000000ffffff x3 : 00000000000000ed
[ 4492.991137] x2 : 000000068a70efc3 x1 : ffffc1ffc0000000 x0 : fffffdffd829c380
[ 4492.998255] Call trace:
[ 4493.000690]  __zap_vma_range+0x5c8/0x1500 (P)
[ 4493.005035]  unmap_vmas+0x54/0x11c
[ 4493.008426]  unmap_region+0x84/0xe0
[ 4493.011903]  vms_complete_munmap_vmas+0xec/0x1e0
[ 4493.016506]  do_vmi_align_munmap+0x164/0x1a0
[ 4493.020761]  do_vmi_munmap+0xa8/0x160
[ 4493.024411]  __vm_munmap+0xa8/0x130
[ 4493.027887]  __arm64_sys_munmap+0x20/0x3c
[ 4493.031883]  invoke_syscall.constprop.0+0x40/0x108
[ 4493.036662]  el0_svc_common.constprop.0+0x38/0xd8
[ 4493.041351]  do_el0_svc+0x1c/0x28
[ 4493.044653]  el0_svc+0x20/0x78
[ 4493.047700]  el0t_64_sync_handler+0xa0/0xe4
[ 4493.051870]  el0t_64_sync+0x198/0x19c
[ 4493.055522] Code: 97fffe63 b94013e3 aa0003f9 b4002d40 (f9400400)
[ 4493.061597] ---[ end trace 0000000000000000 ]---
[ 4493.066226] note: yavta[1457] exited with preempt_count 1
[ 4493.071790] ------------[ cut here ]------------

Implement proper clean-up on error handling to avoid this crash.
Also fix the error handling for media_entity_remote_source_pad_unique().

Fixes: 3ed9c0a1fdba ("media: ti: j721e-csi2rx: add multistream support")
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
---
This can be reproduced on TI AM69-SK with the Arducam FPD V3Link using
2 cameras:

- Configure routing/pixel formats
- Disconnect one camera sensor
- Start a stream using yavta
---
 drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
index 022ea3d616c9..865562fa5ec8 100644
--- a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
+++ b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
@@ -1208,8 +1208,10 @@ static int ti_csi2rx_sd_enable_streams(struct v4l2_subdev *sd,
 	spin_unlock_irqrestore(&dma->lock, flags);
 
 	remote_pad = media_entity_remote_source_pad_unique(&csi->subdev.entity);
-	if (IS_ERR(remote_pad))
-		return PTR_ERR(remote_pad);
+	if (IS_ERR(remote_pad)) {
+		ret = PTR_ERR(remote_pad);
+		goto err_dma;
+	}
 	sink_streams = v4l2_subdev_state_xlate_streams(state, pad,
 						       TI_CSI2RX_PAD_SINK,
 						       &streams_mask);
@@ -1217,11 +1219,19 @@ static int ti_csi2rx_sd_enable_streams(struct v4l2_subdev *sd,
 	ret = v4l2_subdev_enable_streams(csi->source, remote_pad->index,
 					 sink_streams);
 	if (ret)
-		return ret;
+		goto err_dma;
 
 	csi->enable_count++;
 
 	return 0;
+
+err_dma:
+	ti_csi2rx_stop_dma(ctx);
+	writel(0, csi->shim + SHIM_DMACNTX(ctx->idx));
+	if (!csi->enable_count)
+		writel(0, csi->shim + SHIM_CNTL);
+
+	return ret;
 }
 
 static int ti_csi2rx_sd_disable_streams(struct v4l2_subdev *sd,

---
base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
change-id: 20261104-j721e-csi2rx-crash-sd-enable-streams-ad8a2aed4c1b

Best regards,
--  
Mattijs Korpershoek <mkorpershoek@kernel.org>