Re: [PATCH v2] media: qcom: camss: vfe: Clear active buffer pointers after flushing

[Bryan O'Donoghue <bod.linux@nxsw.ie>]

On 30/10/2026 09:47, Loic Poulain wrote:
> vfe_flush_buffers() returns all active buffers to vb2 but it leaves
> output->buf[0] and output->buf[1] pointing to the completed buffers
> despite the lost of ownership.
> 
> This can lead to subsequent flush or completion paths operating on
> stale state and potentially completing the same buffer more than once.
> 
> Clear the buffer pointers explicitly.
> 
> Note: vfe_enable_output_v2 is supposed to overwrite those pointers with
> pending buffers when streaming is restarted, but nothing guarantees that
> enough pending buffers will be available to overwrite all entries.
> 
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/bug/linux-e617a776-3d96-47cb-8d60-a769340c25a7
> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> Fixes: 4c98a5f57f90 ("media: camss: Add VFE files")
> ---
> Changes in v2:
> - Remove unrelated changes/diff from this patch
> - Link to v1: https://lore.kernel.org/r/20261030-camss-fix-v1-1-ecc170342d0d@oss.qualcomm.com
> ---
>   drivers/media/platform/qcom/camss/camss-vfe.c | 8 ++++++--
>   1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
> index 2680a9914765fa2c8f3c2b38a5f4f0e0bcf4d873..8e297e2bcafcbf30b09fc2ad6e57f484a4e41898 100644
> --- a/drivers/media/platform/qcom/camss/camss-vfe.c
> +++ b/drivers/media/platform/qcom/camss/camss-vfe.c
> @@ -1187,11 +1187,15 @@ int vfe_flush_buffers(struct camss_video *vid,
> 
>   	vfe_buf_flush_pending(output, state);
> 
> -	if (output->buf[0])
> +	if (output->buf[0]) {
>   		vb2_buffer_done(&output->buf[0]->vb.vb2_buf, state);
> +		output->buf[0] = NULL;
> +	}
> 
> -	if (output->buf[1])
> +	if (output->buf[1]) {
>   		vb2_buffer_done(&output->buf[1]->vb.vb2_buf, state);
> +		output->buf[1] = NULL;
> +	}
> 
>   	if (output->last_buffer) {
>   		vb2_buffer_done(&output->last_buffer->vb.vb2_buf, state);
> 
> ---
> base-commit: f1ac44c32cba88ad65dcecd4a279661d14e93651
> change-id: 20261030-camss-fix-4972697ef90e
> 
> Best regards,
> --
> Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>