From: Dikshita Agarwal Date: Mon, 25 Aug 2025 07:00:30 +0000 (+0530) Subject: media: iris: Always destroy internal buffers on firmware release response X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9cae3619e465dd1cdaa5a5ffbbaf4f41338b0022;p=thirdparty%2Fkernel%2Fstable.git media: iris: Always destroy internal buffers on firmware release response Currently, internal buffers are destroyed only if 'PENDING_RELEASE' flag is set when a release response is received from the firmware, which is incorrect. Internal buffers should always be destroyed when the firmware explicitly releases it, regardless of whether the 'PENDING_RELEASE' flag was set by the driver. This is specially important during force-stop scenarios, where the firmware may release buffers without driver marking them for release. Fix this by removing the incorrect check and ensuring all buffers are properly cleaned up. Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") Cc: stable@vger.kernel.org Reviewed-by: Vikash Garodia Tested-by: Vikash Garodia # X1E80100 Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Bryan O'Donoghue # x1e80100-crd Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil --- diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c index a8c30fc5c0d06..dda775d463e91 100644 --- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c +++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c @@ -424,7 +424,6 @@ static int iris_hfi_gen2_handle_release_internal_buffer(struct iris_inst *inst, struct iris_buffers *buffers = &inst->buffers[buf_type]; struct iris_buffer *buf, *iter; bool found = false; - int ret = 0; list_for_each_entry(iter, &buffers->list, list) { if (iter->device_addr == buffer->base_address) { @@ -437,10 +436,8 @@ static int iris_hfi_gen2_handle_release_internal_buffer(struct iris_inst *inst, return -EINVAL; buf->attr &= ~BUF_ATTR_QUEUED; - if (buf->attr & BUF_ATTR_PENDING_RELEASE) - ret = iris_destroy_internal_buffer(inst, buf); - return ret; + return iris_destroy_internal_buffer(inst, buf); } static int iris_hfi_gen2_handle_session_stop(struct iris_inst *inst,