Re: [PATCH] media: qcom: camss: vfe: Clear active buffer pointers after flushing

[Loic Poulain]

On Fri, Oct 30, 2026 at 10:39 AM Loic Poulain
<loic.poulain@xxxxxxxxxxxxxxxx> wrote:
>
> vfe_flush_buffers() returns all active buffers to vb2 but it leaves
> output->buf[0] and output->buf[1] pointing to the completed buffers
> despite the lost of ownership.
>
> This can lead to subsequent flush or completion paths operating on
> stale state and potentially completing the same buffer more than once.
>
> Clear the buffer pointers explicitly.
>
> Note: vfe_enable_output_v2 is supposed to overwrite those pointers with
> pending buffers when streaming is restarted, but nothing guarantees that
> enough pending buffers will be available to overwrite all entries.
>
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/bug/linux-e617a776-3d96-47cb-8d60-a769340c25a7
> Signed-off-by: Loic Poulain <loic.poulain@xxxxxxxxxxxxxxxx>
> Fixes: 4c98a5f57f90 ("media: camss: Add VFE files")

Please ignore this patch, wrong commit command....

> ---
>  arch/arm64/boot/dts/qcom/monaco-pmics.dtsi    | 2 ++
>  drivers/media/platform/qcom/camss/camss-vfe.c | 8 ++++++--
>  2 files changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/boot/dts/qcom/monaco-pmics.dtsi b/arch/arm64/boot/dts/qcom/monaco-pmics.dtsi
> index 361f5163b6d91eef794d3bf86b374d4dcbc6d60f..1ed4de00b1a3e23e1ef0f1c412a2e29bf840c870 100644
> --- a/arch/arm64/boot/dts/qcom/monaco-pmics.dtsi
> +++ b/arch/arm64/boot/dts/qcom/monaco-pmics.dtsi
> @@ -58,6 +58,7 @@ pmm8620au_0_adc: adc@8000 {
>                         #address-cells = <1>;
>                         #size-cells = <0>;
>                         #io-channel-cells = <1>;
> +                       #thermal-sensor-cells = <1>;
>
>                         channel@3 {
>                                 reg = <ADC5_GEN3_DIE_TEMP(0)>;
> @@ -112,6 +113,7 @@ pmm8650au_1_adc: adc@8000 {
>                         #address-cells = <1>;
>                         #size-cells = <0>;
>                         #io-channel-cells = <1>;
> +                       #thermal-sensor-cells = <1>;
>
>                         channel@203 {
>                                 reg = <ADC5_GEN3_DIE_TEMP(2)>;
> diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
> index 2680a9914765fa2c8f3c2b38a5f4f0e0bcf4d873..8e297e2bcafcbf30b09fc2ad6e57f484a4e41898 100644
> --- a/drivers/media/platform/qcom/camss/camss-vfe.c
> +++ b/drivers/media/platform/qcom/camss/camss-vfe.c
> @@ -1187,11 +1187,15 @@ int vfe_flush_buffers(struct camss_video *vid,
>
>         vfe_buf_flush_pending(output, state);
>
> -       if (output->buf[0])
> +       if (output->buf[0]) {
>                 vb2_buffer_done(&output->buf[0]->vb.vb2_buf, state);
> +               output->buf[0] = NULL;
> +       }
>
> -       if (output->buf[1])
> +       if (output->buf[1]) {
>                 vb2_buffer_done(&output->buf[1]->vb.vb2_buf, state);
> +               output->buf[1] = NULL;
> +       }
>
>         if (output->last_buffer) {
>                 vb2_buffer_done(&output->last_buffer->vb.vb2_buf, state);
>
> ---
> base-commit: f1ac44c32cba88ad65dcecd4a279661d14e93651
> change-id: 20261030-camss-fix-4972697ef90e
>
> Best regards,
> --
> Loic Poulain <loic.poulain@xxxxxxxxxxxxxxxx>
>