Re: [PATCH] media: mc: Remove spurious WARN_ON in __media_pipeline_start

[Niharika Khare <niharikakhare2101@gmail.com>]

On Mon, Aug 31, 2026 at 01:50:22PM +0530, Niharika Khare wrote:
> On Sat, Aug 22, 2026 at 09:53:46AM +0530, Niharika Khare wrote:
> > On Fri, Aug 21, 2026 at 09:33:26PM +0200, Laurent Pinchart wrote:
> > > On Fri, Aug 21, 2026 at 10:28:07PM +0530, Niharika Khare wrote:
> > > > Vimc driver's entity topology has three capture nodes and two of
> > > > those (Raw Capture 0 and RGB/YUV Capture) are reachable from each
> > > > other via enabled links. The crash report and the C repro show that
> > > > the two capture nodes attempt to invoke a STREAMON session one after
> > > > the other, which resulted in the WARNING getting triggered by the
> > > > media controller.
> > > > 
> > > >   vimc link validate: Sensor A:src:640x480 (0x42474752, 0, 0, 0, 0) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0)
> > > >   vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0)
> > > >   origin->pipe && origin->pipe != pipe
> > > >   WARNING: drivers/media/mc/mc-entity.c:785 at __media_pipeline_start+0x1add/0x22b0, CPU#1: syz.0.17/5912
> > > > 
> > > > The graph walk originating from Raw Capture 0 (first STREAMON in C
> > > > repro on /dev/video0) reaches RGB/YUV Capture and marks its origin
> > > > pad's pipe with its own pipe. When RGB/YUV Capture's graph walk starts
> > > > (second STREAMON in C repro on /dev/video4), the pad is already
> > > > claimed. This is a legitimate userspace request but not something that
> > > 
> > > No, that's not supposed to be a legitimate use case. The WARN_ON
> > > indicates a driver bug.
> > 
> > Thanks for the direction Laurent, I'll look into vimc's architecture to
> > check on how the two capture nodes ended up starting the pipeline back
> > to back.
> 
> Hi Laurent,
> 
> The WARN reproduces without the syzkaller reproducer by configuring
> formats with
media-ctl, then concurrently running VIDIOC_STREAMON on
> /dev/video0 and /dev/video2. Both sit in the same connected component
> via Sensor A.
> 
> I tried checking the pad in vimc before video_device_pipeline_start()
> and returning
-EBUSY, and this removes the WARN.
> 
> However, a couple of other drivers are structured differently:
> 
> 1. rkisp1 embeds a single media_pipeline in struct rkisp1_device; both
>    capture
nodes pass it to video_device_pipeline_start(), serialized
>    by stream_lock.
vimc embeds one per vimc_capture_device, so the
>    second STREAMON sees a
different pipe pointer.
> 
> 2. imx8-isi acquires the pipeline with media_entity_pipeline(), falling
>    back to
the node's own pipe, under graph_mutex.
> 
> I also tried the imx8-isi approach in vimc. Both nodes stream, but
> teardown
NULL-derefs in kthread_stop() as the core refcounts one
> pipeline while vimc
keeps a kthread per capture node.
> 
> Before working on the teardown: should vimc share a pipeline across a
> connected component like these drivers, or refuse the second STREAMON?
> 
> Regards,
> 
> Niharika

Adding the vimc maintainers as well, since the open question is about
vimc's design rather than the core.

Short restatement: should vimc share a single media_pipeline across a
connected component (as rkisp1 does at rkisp1-capture.c:1152), or
refuse the second STREAMON with -EBUSY?

Details and the rkisp1/imx8-isi comparison are upstream in this thread.
  

Best Regards,

Niharika Khare