[BUG] WARN mc-request.c:528 -- vicodec request objects are never completed

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/126-media-vicodec-request-never-completed/

  req->num_incomplete_objects
  WARNING: drivers/media/mc/mc-request.c:528 at
media_request_manual_complete+0x173/0x230
drivers/media/mc/mc-request.c:528, CPU#1: syz.9.775/21126
  RIP: 0010:media_request_manual_complete+0x173/0x230
drivers/media/mc/mc-request.c:528
  Call Trace:
   vicodec_return_bufs+0x246/0x300
drivers/media/test-drivers/vicodec/vicodec-core.c:1527
   vicodec_stop_streaming+0x48/0x750
drivers/media/test-drivers/vicodec/vicodec-core.c:1646
   __vb2_queue_cancel+0xba/0xdb0
drivers/media/common/videobuf2/videobuf2-core.c:2199
   vb2_core_queue_release+0x2f/0x150
drivers/media/common/videobuf2/videobuf2-core.c:2677
   v4l2_m2m_ctx_release+0x2a/0x40 drivers/media/v4l2-core/v4l2-mem2mem.c:1286
   vicodec_release+0x94/0x110
drivers/media/test-drivers/vicodec/vicodec-core.c:1947
   v4l2_release+0x1ad/0x370 drivers/media/v4l2-core/v4l2-dev.c:468
   __fput+0x435/0xa40 fs/file_table.c:510

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,