usb: gadget: uvc: giveback vb2 buffer on req complete

On uvc_video_encode_isoc_sg the mapped vb2 buffer is returned
to early. Only after the last usb_request worked with the buffer
it is allowed to give it back to vb2. This patch fixes that.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20220402232744.3622565-3-m.grzeschik@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/function/uvc.h b/drivers/usb/gadget/function/uvc.h
index c3607a32b986247ff56a22191eab5f0382d9bb39..9eec104b3666addb6bfd2602666235c513c4e146 100644 (file)
--- a/drivers/usb/gadget/function/uvc.h
+++ b/drivers/usb/gadget/function/uvc.h
@@ -79,6 +79,7 @@ struct uvc_request {
        struct uvc_video *video;
        struct sg_table sgt;
        u8 header[UVCG_REQUEST_HEADER_LEN];
+       struct uvc_buffer *last_buf;
 };
 
 struct uvc_video {

diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c
index 43acc071f0ade7890e74905bfcf1058d33597ee3..f835006149546c13ca4d230171425e5297be0dbe 100644 (file)
--- a/drivers/usb/gadget/function/uvc_queue.c
+++ b/drivers/usb/gadget/function/uvc_queue.c
@@ -325,8 +325,6 @@ void uvcg_complete_buffer(struct uvc_video_queue *queue,
                return;
        }
 
-       list_del(&buf->queue);
-
        buf->buf.field = V4L2_FIELD_NONE;
        buf->buf.sequence = queue->sequence++;
        buf->buf.vb2_buf.timestamp = ktime_get_ns();

diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index 0c8d146b8403214f4c502b098e4678166f96eb26..ceeabc4ba3b16785d982942391d9ecfae6c12254 100644 (file)
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -112,6 +112,7 @@ uvc_video_encode_bulk(struct usb_request *req, struct uvc_video *video,
        if (buf->bytesused == video->queue.buf_used) {
                video->queue.buf_used = 0;
                buf->state = UVC_BUF_STATE_DONE;
+               list_del(&buf->queue);
                uvcg_complete_buffer(&video->queue, buf);
                video->fid ^= UVC_STREAM_FID;
 
@@ -183,8 +184,9 @@ uvc_video_encode_isoc_sg(struct usb_request *req, struct uvc_video *video,
                video->queue.buf_used = 0;
                buf->state = UVC_BUF_STATE_DONE;
                buf->offset = 0;
-               uvcg_complete_buffer(&video->queue, buf);
+               list_del(&buf->queue);
                video->fid ^= UVC_STREAM_FID;
+               ureq->last_buf = buf;
        }
 }
 
@@ -210,6 +212,7 @@ uvc_video_encode_isoc(struct usb_request *req, struct uvc_video *video,
        if (buf->bytesused == video->queue.buf_used) {
                video->queue.buf_used = 0;
                buf->state = UVC_BUF_STATE_DONE;
+               list_del(&buf->queue);
                uvcg_complete_buffer(&video->queue, buf);
                video->fid ^= UVC_STREAM_FID;
        }
@@ -264,6 +267,11 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
                uvcg_queue_cancel(queue, 0);
        }
 
+       if (ureq->last_buf) {
+               uvcg_complete_buffer(&video->queue, ureq->last_buf);
+               ureq->last_buf = NULL;
+       }
+
        spin_lock_irqsave(&video->req_lock, flags);
        list_add_tail(&req->list, &video->req_free);
        spin_unlock_irqrestore(&video->req_lock, flags);
@@ -332,6 +340,7 @@ uvc_video_alloc_requests(struct uvc_video *video)
                video->ureq[i].req->complete = uvc_video_complete;
                video->ureq[i].req->context = &video->ureq[i];
                video->ureq[i].video = video;
+               video->ureq[i].last_buf = NULL;
 
                list_add_tail(&video->ureq[i].req->list, &video->req_free);
                /* req_size/PAGE_SIZE + 1 for overruns and + 1 for header */