DCMIPP driver on STM32MP257 - stats buffer queue failure causing libcamera crash
Hello everyone,
When using libcamera on the STM32MP257 platform (ATK-DLMP257B development board with IMX335 sensor), the DCMIPP driver fails to queue stats buffers to /dev/video4, returning -EINVAL. This causes libcamera to crash with an assertion failure during stream shutdown.
Additionally, the DCMIPP post-processor (dcmipp_main_postproc) refuses all YUV format configurations (NV12, YU12, YUV420, etc.), returning Invalid argument (22) for each attempt. The hardware only accepts RGB888/RGB565 output formats.
When using libcamera on STM32MP257 platform with IMX335 sensor, the DCMIPP driver fails to queue stats buffers to `/dev/video4`, returning `-EINVAL`. This causes libcamera to crash with an assertion failure (`cache_->isEmpty()`) during stream shutdown.
Linux kernel version is 6.6.48.
libcamera version is v0.3.0+dirty.
Steps to Reproduce
Basic libcamera capture with fakesink
gst-launch-1.0 -v libcamerasrc ! \
video/x-raw,format=NV12,width=1920,height=1080,framerate=30/1 ! \
fakesinkLibcamera streaming with hardware encoder
gst-launch-1.0 -v libcamerasrc ! \
video/x-raw,format=NV12,width=1920,height=1080,framerate=30/1 ! \
queue max-size-buffers=2 leaky=downstream ! \
v4l2slh264enc bitrate=2000000 keyframe-interval=30 ! \
h264parse config-interval=1 ! \
rtph264pay mtu=1400 config-interval=1 pt=96 aggregate-mode=zero-latency ! \
udpsink host=192.168.137.1 port=5000 sync=false async=falseAttempt to configure YUV format on postproc
media-ctl -d platform:48030000.dcmipp --set-v4l2 '"dcmipp_main_postproc":1[fmt:YUV420_2X24/1920x1080]'Attempt to capture NV12 from /dev/video1
v4l2-ctl -d /dev/video1 --set-fmt-video=width=1920,height=1080,pixelformat=NV12
gst-launch-1.0 v4l2src device=/dev/video1 num-buffers=10 ! video/x-raw,format=NV12 ! fakesinkExpected Behavior
/dev/video4 stats buffers should be queued successfully
dcmipp_main_postproc should support YUV420/NV12 output formats as documented
/dev/video1 should be able to capture NV12 data
Actual Behavior
Stats buffer queue failure
[1:12:16.430008525] [2255] ERROR V4L2 v4l2_videodevice.cpp:1697 /dev/video4[26:out]: Failed to queue buffer 0: Invalid argument
[1:12:16.430109000] [2255] ERROR DCMIPP dcmipp.cpp:1284 Could not queue back stats buffer
[1:12:16.430172775] [2255] ERROR V4L2 v4l2_videodevice.cpp:1697 /dev/video4[26:out]: Failed to queue buffer 1: Invalid argument
[1:12:16.430211175] [2255] ERROR DCMIPP dcmipp.cpp:1284 Could not queue back stats buffer
[1:12:16.430271700] [2255] ERROR V4L2 v4l2_videodevice.cpp:1697 /dev/video4[26:out]: Failed to queue buffer 2: Invalid argument
[1:12:16.430308350] [2255] ERROR DCMIPP dcmipp.cpp:1284 Could not queue back stats buffer
[1:12:16.430368400] [2255] ERROR V4L2 v4l2_videodevice.cpp:1697 /dev/video4[26:out]: Failed to queue buffer 3: Invalid argument
[1:12:16.430405100] [2255] ERROR DCMIPP dcmipp.cpp:1284 Could not queue back stats buffer
[1:12:16.482410375] [2255] FATAL default v4l2_videodevice.cpp:1960 /dev/video4[26:out]: assertion "cache_->isEmpty()" failed in streamOff()
Backtrace:
/usr/lib/libcamera.so.0.3(_ZN9libcamera15V4L2VideoDevice9streamOffEv+0x188) [0xffffaad90ef8]
/usr/lib/libcamera.so.0.3(_ZN9libcamera21PipelineHandlerDcmipp10stopDeviceEPNS_6CameraE+0xa4) [0xffffaad9fdb4]
/usr/lib/libcamera.so.0.3(_ZN9libcamera15PipelineHandler4stopEPNS_6CameraE+0x30) [0xffffaad67960]
/usr/lib/libcamera-base.so.0.3(_ZN9libcamera6Object7messageEPNS_7MessageE+0x80) [0xffffaacb5840]
/usr/lib/libcamera-base.so.0.3(_ZN9libcamera6Thread16dispatchMessagesENS_7Message4TypeE+0x1b8) [0xffffaacb7ca8]
/usr/lib/libcamera-base.so.0.3(_ZN9libcamera19EventDispatcherPoll13processEventsEv+0x34) [0xffffaacaec74]
/usr/lib/libcamera-base.so.0.3(_ZN9libcamera6Thread4execEv+0x64) [0xffffaacb76d4]
/usr/lib/libcamera.so.0.3(_ZN9libcamera13CameraManager7Private3runEv+0x9c) [0xffffaad43bdc]
/usr/lib/libstdc++.so.6(+0xd74b0) [0xffffaa9674b0]
/usr/lib/libc.so.6(+0x80e24) [0xffffab350e24]
/usr/lib/libc.so.6(+0xe338c) [0xffffab3b338c]
Aborted (core dumped)YUV format configuration failures
#Below is a text block
# All attempts return "Invalid argument (22)"
Unable to setup formats: Invalid argument (22) # YUV420_2X24
Unable to setup formats: Invalid argument (22) # YU12
Unable to setup formats: Invalid argument (22) # YUV420
Unable to setup formats: Invalid argument (22) # NV12_1X24
Unable to setup formats: Invalid argument (22) # YUV420_1X24Current postproc format (only RGB works)
media-ctl -d platform:48030000.dcmipp --get-v4l2 '"dcmipp_main_postproc":1'Output:
[stream:0 fmt:RGB888_1X24/1920x1080@1/30 field:none colorspace:rec709]NV12 capture failure
[ 906.613630] dcmipp 48030000.dcmipp: Invalid format given
ERROR: from element /GstPipeline:pipeline0/GstV4l2Src:v4l2src0: Failed to allocate required memory.
Additional debug info:
/usr/src/debug/gstreamer1.0-plugins-good/1.22.12/sys/v4l2/gstv4l2src.c(950): gst_v4l2src_decide_allocation (): /GstPipeline:pipeline0/GstV4l2Src:v4l2src0:
Buffer pool activation failedAlthough /dev/video1 --list-formats-ext shows that NV12 is supported, actual capture fails with memory allocation errors.
Media Topology (partial)
media-ctl -d platform:48030000.dcmipp -p
Media controller API version 6.6.48
Media device information
------------------------
driver dcmipp
model DCMIPP MDEV
bus info platform:48030000.dcmipp
hw revision 0x30
driver version 6.6.48
Device topology
- entity 13: dcmipp_main_isp (4 pads, 5 links, 0 routes)
type V4L2 subdev subtype Unknown flags 0
device node name /dev/v4l-subdev2
pad0: Sink
[stream:0 fmt:SRGGB12_1X12/2592x1940 field:none colorspace:raw
crop.bounds:(0,0)/2592x1940
crop:(0,0)/2592x1940
compose.bounds:(0,0)/2592x1940
compose:(0,0)/2592x1940]
<- "dcmipp_input":2 [ENABLED]
pad1: Source
[stream:0 fmt:RGB888_1X24/2592x1940 field:none colorspace:raw]
-> "dcmipp_main_postproc":0 [ENABLED,IMMUTABLE]
pad2: Sink
[stream:0 fmt:unknown/0x0]
<- "dcmipp_main_isp_params_output":0 [ENABLED,IMMUTABLE]
pad3: Source
[stream:0 fmt:unknown/0x0]
-> "dcmipp_main_isp_stat_capture":0 [ENABLED,IMMUTABLE]
- entity 32: dcmipp_main_isp_stat_capture (1 pad, 1 link)
type Node subtype V4L flags 0
device node name /dev/video3
pad0: Sink
<- "dcmipp_main_isp":3 [ENABLED,IMMUTABLE]
- entity 36: dcmipp_main_isp_params_output (1 pad, 1 link)
type Node subtype V4L flags 0
device node name /dev/video4
pad0: Source
-> "dcmipp_main_isp":2 [ENABLED,IMMUTABLE]
Analysis
This appears to be the same issue tracked as CVE-2026-68211 in the Linux kernel, related to buffer management in the stm32-dcmipp driver. The stats buffer (/dev/video4) fails to queue during start_streaming(), causing a resource leak that later triggers the assertion failure during streamOff().
The YUV format rejection suggests the post-processor driver may not have fully implemented the format support documented in the STM32MP257 reference manual (which states Pipe1 supports YUV420-2/NV12).
Other Attempts
After disabling AEC and AWB in imx335.yaml, the process still crashes due to stats buffer queue failure.
What’s more
root@ATK-DLMP257:~# cam -c 1 --capture=1
[1:05:17.874874625] [3193] INFO Camera camera_manager.cpp:313 libcamera v0.3.0+dirty (2025-01-30T14:51:47+00:00)
[1:05:17.913723175] [3194] WARN CameraSensor camera_sensor.cpp:259 'imx335 1-001a': Recommended V4L2 control 0x009a0922 not supported
[1:05:17.913836325] [3194] WARN CameraSensor camera_sensor.cpp:331 'imx335 1-001a': The sensor kernel driver needs to be fixed
[1:05:17.913869300] [3194] WARN CameraSensor camera_sensor.cpp:333 'imx335 1-001a': See Documentation/sensor_driver_requirements.rst in the libcamera sources for more information
[1:05:17.915168750] [3194] WARN CameraSensor camera_sensor.cpp:479 'imx335 1-001a': Failed to retrieve the camera location
[1:05:17.915212125] [3194] WARN CameraSensor camera_sensor.cpp:501 'imx335 1-001a': Rotation control not available, default to 0 degrees
Using camera /base/soc@0/bus@42080000/i2c@40150000/imx335@1a as cam0
[1:05:17.928313075] [3193] INFO Camera camera.cpp:1183 configuring streams: (0) 1024x600-RGB888
cam0: Capture 1 frames
[1:05:18.012332850] [3194] ERROR V4L2 v4l2_videodevice.cpp:1697 /dev/video4[27:out]: Failed to queue buffer 0: Invalid argument
[1:05:18.012448775] [3194] ERROR DCMIPP dcmipp.cpp:1284 Could not queue back stats buffer
3918.065944 (0.00 fps) cam0-stream0 seq: 000000 bytesused: 1843200
[1:05:18.066511950] [3194] FATAL default v4l2_videodevice.cpp:1960 /dev/video4[27:out]: assertion "cache_->isEmpty()" failed in streamOff()
Backtrace:
/usr/lib/libcamera.so.0.3(_ZN9libcamera15V4L2VideoDevice9streamOffEv+0x188) [0xffffa6050ef8]
/usr/lib/libcamera.so.0.3(_ZN9libcamera21PipelineHandlerDcmipp10stopDeviceEPNS_6CameraE+0xa4) [0xffffa605fdb4]
/usr/lib/libcamera.so.0.3(_ZN9libcamera15PipelineHandler4stopEPNS_6CameraE+0x30) [0xffffa6027960]
/usr/lib/libcamera-base.so.0.3(_ZN9libcamera6Object7messageEPNS_7MessageE+0x80) [0xffffa5f75840]
/usr/lib/libcamera-base.so.0.3(_ZN9libcamera6Thread16dispatchMessagesENS_7Message4TypeE+0x1b8) [0xffffa5f77ca8]
/usr/lib/libcamera-base.so.0.3(_ZN9libcamera19EventDispatcherPoll13processEventsEv+0x34) [0xffffa5f6ec74]
/usr/lib/libcamera-base.so.0.3(_ZN9libcamera6Thread4execEv+0x64) [0xffffa5f776d4]
/usr/lib/libcamera.so.0.3(_ZN9libcamera13CameraManager7Private3runEv+0x9c) [0xffffa6003bdc]
/usr/lib/libstdc++.so.6(+0xd74b0) [0xffffa5ca74b0]
/usr/lib/libc.so.6(+0x80e24) [0xffffa5a60e24]
/usr/lib/libc.so.6(+0xe338c) [0xffffa5ac338c]
Aborted (core dumped)
This issue prevents:
Any use of libcamera on STM32MP257 with IMX335
Hardware 3A algorithms (AEC/AWB)
Hardware YUV/NV12 capture path
Zero-copy GPU rendering (DMA-BUF + EGL)
Stable 30fps 1080p streaming
Please let me know if any additional information, logs is needed.
Thank you for your attention to this issue.
