6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dikshita Agarwal quic_dikshita@quicinc.com
commit 9cae3619e465dd1cdaa5a5ffbbaf4f41338b0022 upstream.
Currently, internal buffers are destroyed only if 'PENDING_RELEASE' flag is set when a release response is received from the firmware, which is incorrect. Internal buffers should always be destroyed when the firmware explicitly releases it, regardless of whether the 'PENDING_RELEASE' flag was set by the driver. This is specially important during force-stop scenarios, where the firmware may release buffers without driver marking them for release. Fix this by removing the incorrect check and ensuring all buffers are properly cleaned up.
Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia quic_vgarodia@quicinc.com Tested-by: Vikash Garodia quic_vgarodia@quicinc.com # X1E80100 Reviewed-by: Bryan O'Donoghue bryan.odonoghue@linaro.org Tested-by: Neil Armstrong neil.armstrong@linaro.org # on SM8550-HDK Tested-by: Neil Armstrong neil.armstrong@linaro.org # on SM8650-HDK Signed-off-by: Dikshita Agarwal quic_dikshita@quicinc.com Tested-by: Bryan O'Donoghue bryan.odonoghue@linaro.org # x1e80100-crd Signed-off-by: Bryan O'Donoghue bod@kernel.org Signed-off-by: Hans Verkuil hverkuil+cisco@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c index a8c30fc5c0d0..dda775d463e9 100644 --- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c +++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c @@ -424,7 +424,6 @@ static int iris_hfi_gen2_handle_release_internal_buffer(struct iris_inst *inst, struct iris_buffers *buffers = &inst->buffers[buf_type]; struct iris_buffer *buf, *iter; bool found = false; - int ret = 0;
list_for_each_entry(iter, &buffers->list, list) { if (iter->device_addr == buffer->base_address) { @@ -437,10 +436,8 @@ static int iris_hfi_gen2_handle_release_internal_buffer(struct iris_inst *inst, return -EINVAL;
buf->attr &= ~BUF_ATTR_QUEUED; - if (buf->attr & BUF_ATTR_PENDING_RELEASE) - ret = iris_destroy_internal_buffer(inst, buf);
- return ret; + return iris_destroy_internal_buffer(inst, buf); }
static int iris_hfi_gen2_handle_session_stop(struct iris_inst *inst,