Re: [PATCH v2 1/2] media: chips-media: wave5: Check decoder qbuf runtime resume

[Nicolas Dufresne <nicolas.dufresne@collabora.com>]

[-- Attachment #1: Type: text/plain, Size: 2127 bytes --]

Le samedi 18 juillet 2026 à 21:00 +0800, Guangshuo Li a écrit :
> wave5_vpu_dec_buf_queue_dst() resumes the VPU before it may clear a
> decoder display flag. This is needed because clearing the display flag
> accesses VPU registers.
> 
> However, the return value from pm_runtime_resume_and_get() is ignored.
> If the resume fails, pm_runtime_resume_and_get() returns without holding
> a runtime PM usage reference. The unconditional
> pm_runtime_put_autosuspend() at the end of the function then drops an
> unmatched reference.
> 
> The failed resume path can also continue into
> wave5_vpu_dec_clr_disp_flag() while the device is still suspended.
> 
> Check the return value. If the resume fails, complete the queued buffer
> with an error and return without touching the hardware or dropping an
> unmatched runtime PM reference.
> 
> Fixes: cbb9c0d50e47 ("media: chips-media: wave5: Fix SError of kernel panic when closed")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>

Picked, ty

> ---
>  drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
> index bb2ba9204a83..03d108b808ba 100644
> --- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
> +++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
> @@ -1290,8 +1290,14 @@ static void wave5_vpu_dec_buf_queue_dst(struct vb2_buffer *vb)
>  	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
>  	struct vpu_instance *inst = vb2_get_drv_priv(vb->vb2_queue);
>  	struct v4l2_m2m_ctx *m2m_ctx = inst->v4l2_fh.m2m_ctx;
> +	int ret;
> +
> +	ret = pm_runtime_resume_and_get(inst->dev->dev);
> +	if (ret < 0) {
> +		vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
> +		return;
> +	}
>  
> -	pm_runtime_resume_and_get(inst->dev->dev);
>  	vbuf->sequence = inst->queued_dst_buf_num++;
>  
>  	if (inst->state == VPU_INST_STATE_PIC_RUN) {

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]