From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
To: Vikash Garodia <vikash.garodia@oss.qualcomm.com>,
Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>,
Abhinav Kumar <abhinav.kumar@linux.dev>,
Bryan O'Donoghue <bod@kernel.org>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Hans Verkuil <hverkuil@kernel.org>,
Stefan Schmidt <stefan.schmidt@linaro.org>,
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>,
Vishnu Reddy <busanna.reddy@oss.qualcomm.com>,
Hungyu Lin <dennylin0707@gmail.com>
Cc: linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org,
linux-kernel@vger.kernel.org,
Bryan O'Donoghue <bryan.odonoghue@linaro.org>,
stable@vger.kernel.org
Subject: [PATCH v2 4/5] media: iris: Wake up blocked clients when the driver is removed
Date: Tue, 10 Nov 2026 19:39:52 +0530 [thread overview]
Message-ID: <20261110-iris-handle-unbind-v2-4-86d5f6f1dea8@oss.qualcomm.com> (raw)
In-Reply-To: <20261110-iris-handle-unbind-v2-0-86d5f6f1dea8@oss.qualcomm.com>
iris_remove() does not wake up a client that is blocked in
VIDIOC_DQBUF or poll() on an open session. The client stays blocked and
keeps its file descriptor open.
Flag the vb2 queues of all open instances as errored after the core is
shut down. This wakes up the blocked clients, which fail with an error
and can close the file descriptor. Skip the instances that are already
closing, as iris_close() releases their queues.
Fixes: 38506cb7e8d2 ("media: iris: add platform driver for iris video device")
Cc: stable@vger.kernel.org
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
drivers/media/platform/qcom/iris/iris_instance.h | 2 ++
drivers/media/platform/qcom/iris/iris_probe.c | 16 ++++++++++++++++
drivers/media/platform/qcom/iris/iris_vidc.c | 5 +++++
3 files changed, 23 insertions(+)
diff --git a/drivers/media/platform/qcom/iris/iris_instance.h b/drivers/media/platform/qcom/iris/iris_instance.h
index 771269e705d9..cb84753e4f91 100644
--- a/drivers/media/platform/qcom/iris/iris_instance.h
+++ b/drivers/media/platform/qcom/iris/iris_instance.h
@@ -50,6 +50,7 @@ struct iris_hfi_session_ops;
* @icc_data: structure of interconnect data
* @m2m_dev: a reference to m2m device structure
* @m2m_ctx: a reference to m2m context structure
+ * @closing: set on close, skips the queue error during removal
* @sequence_cap: a sequence counter for capture queue
* @sequence_out: a sequence counter for output queue
* @tss: timestamp metadata
@@ -98,6 +99,7 @@ struct iris_inst {
struct icc_vote_data icc_data;
struct v4l2_m2m_dev *m2m_dev;
struct v4l2_m2m_ctx *m2m_ctx;
+ bool closing;
u32 sequence_cap;
u32 sequence_out;
struct iris_ts_metadata tss[VIDEO_MAX_FRAME];
diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
index dc83daccea5f..51054862bc64 100644
--- a/drivers/media/platform/qcom/iris/iris_probe.c
+++ b/drivers/media/platform/qcom/iris/iris_probe.c
@@ -12,8 +12,10 @@
#include <linux/reset.h>
#include <linux/soc/qcom/ubwc.h>
+#include "iris_buffer.h"
#include "iris_core.h"
#include "iris_ctrls.h"
+#include "iris_instance.h"
#include "iris_vidc.h"
static int iris_init_icc(struct iris_core *core)
@@ -259,6 +261,18 @@ static void iris_core_put(void *data)
v4l2_device_put(&core->v4l2_dev);
}
+static void iris_instances_vb2_queue_error(struct iris_core *core)
+{
+ struct iris_inst *inst;
+
+ mutex_lock(&core->lock);
+ list_for_each_entry(inst, &core->instances, list) {
+ if (!inst->closing)
+ iris_vb2_queue_error(inst);
+ }
+ mutex_unlock(&core->lock);
+}
+
static void iris_remove(struct platform_device *pdev)
{
struct iris_core *core;
@@ -278,6 +292,8 @@ static void iris_remove(struct platform_device *pdev)
iris_core_deinit(core);
+ iris_instances_vb2_queue_error(core);
+
pm_runtime_dont_use_autosuspend(core->dev);
pm_runtime_disable(core->dev);
diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
index 04bd37b93445..bb3519eff3b1 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -312,6 +312,11 @@ static void iris_check_num_queued_internal_buffers(struct iris_inst *inst, u32 p
int iris_close(struct file *filp)
{
struct iris_inst *inst = iris_get_inst(filp);
+ struct iris_core *core = inst->core;
+
+ mutex_lock(&core->lock);
+ inst->closing = true;
+ mutex_unlock(&core->lock);
v4l2_ctrl_handler_free(&inst->ctrl_handler);
v4l2_m2m_ctx_release(inst->m2m_ctx);
--
2.34.1
next prev parent reply other threads:[~2026-11-10 14:11 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-10 14:09 [PATCH v2 0/5] media: iris: Fix issues in the driver unbind path Vishnu Reddy
2026-11-10 14:09 ` [PATCH v2 1/5] media: iris: Fix runtime PM reference imbalance on failed resume Vishnu Reddy
2026-11-10 14:09 ` [PATCH v2 2/5] media: iris: Disable the system error work on removal Vishnu Reddy
2026-11-10 14:09 ` [PATCH v2 3/5] media: iris: Fix use-after-free on unbind with open sessions Vishnu Reddy
2026-11-10 14:42 ` Bryan O'Donoghue
2026-11-10 14:09 ` Vishnu Reddy [this message]
2026-11-10 14:09 ` [PATCH v2 5/5] media: iris: Free the interrupt in iris_remove() Vishnu Reddy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261110-iris-handle-unbind-v2-4-86d5f6f1dea8@oss.qualcomm.com \
--to=busanna.reddy@oss.qualcomm.com \
--cc=abhinav.kumar@linux.dev \
--cc=bod@kernel.org \
--cc=bryan.odonoghue@linaro.org \
--cc=dennylin0707@gmail.com \
--cc=dikshita.agarwal@oss.qualcomm.com \
--cc=dmitry.baryshkov@oss.qualcomm.com \
--cc=hverkuil@kernel.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=stable@vger.kernel.org \
--cc=stefan.schmidt@linaro.org \
--cc=vikash.garodia@oss.qualcomm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®