Re: [PATCH v1 1/2] Input: sur40 - don't wait for buffers nothing will complete

[Hans Verkuil]

On 20/09/2026 13:39, Nguyen Ngoc Thang wrote:
> sur40_stop_streaming() calls vb2_wait_for_all_buffers() before handing
> the queued buffers back. Those buffers are only completed from the input
> poll callback, which is gone once the device is unplugged. Closing a
> video node that is still streaming after a disconnect then sleeps
> forever in vb2_wait_for_all_buffers():
> 
>   vb2_wait_for_all_buffers+0x20f/0x330
>   sur40_stop_streaming+0x45/0x310
>   __vb2_queue_cancel+0xc5/0xf70
>   vb2_core_streamoff+0x5d/0x180
>   __vb2_cleanup_fileio+0x6e/0x190
>   vb2_core_queue_release+0x1f/0x190
>   _vb2_fop_release+0xe8/0x280
>   v4l2_release+0x280/0x430
> 
> It has not been noticed so far because sur40_disconnect() frees the
> device state under the open file, and the close then crashes earlier.
> 
> Return the queued buffers first. A buffer that sur40_process_video()
> has already taken off the list still completes by itself, so the wait
> afterwards only covers that one.
> 
> Fixes: 6a8588156657 ("[media] sur40: fix occasional oopses on device close")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@xxxxxxxxx>
> ---
>  drivers/input/touchscreen/sur40.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
> index 09d8c5f8d09f..7020bcf9b81a 100644
> --- a/drivers/input/touchscreen/sur40.c
> +++ b/drivers/input/touchscreen/sur40.c
> @@ -929,11 +929,11 @@ static int sur40_start_streaming(struct vb2_queue *vq, unsigned int count)
>  static void sur40_stop_streaming(struct vb2_queue *vq)
>  {
>  	struct sur40_state *sur40 = vb2_get_drv_priv(vq);
> -	vb2_wait_for_all_buffers(vq);
> -	sur40->sequence = -1;
>  
> -	/* Release all active buffers */
> +	/* Release queued buffers first: nothing completes them after unplug */
>  	return_all_buffers(sur40, VB2_BUF_STATE_ERROR);
> +	vb2_wait_for_all_buffers(vq);
> +	sur40->sequence = -1;
>  }
>  
>  /* V4L ioctl */

I think you should make one more change: replace the video_unregister_device calls by
vb2_video_unregister_device(). This ensures that at unregister time all streaming is
canceled and stop_streaming is called.

Having streaming continue after unregistering a device is in general not a good idea,
which is why we added that vb2_video_unregister_device call.

I think you still need to have that change in stop_streaming for this specific driver,
but it might be worth testing without it.

Regards,

	Hans