mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-20 01:20:54 +00:00
89a0956683
On page unaligned frames, create_framevec forces get_vaddr_frames to
allocate an extra page at the end of the buffer. Under some
circumstances, this leads to -EINVAL on VIDIOC_QBUF.
E.g:
We have vm_a that vm_area that goes from 0x1000 to 0x3000. And a
frame that goes from 0x1800 to 0x2800, i.e. 2 pages.
frame_vector_create will be called with the following params:
get_vaddr_frames(0x1800, 2, write, 1, vec);
get_vaddr will allocate the first page after checking that the memory
0x1800-0x27ff is valid, but it will not allocate the second page because
the range 0x2800-0x37ff is out of the vm_a range. This results in
create_framevec returning -EFAULT
Error Trace:
[ 9083.793015] video0: VIDIOC_QBUF: 00:00:00.00000000 index=1,
type=vid-cap, flags=0x00002002, field=any, sequence=0,
memory=userptr, bytesused=0, offset/userptr=0x7ff2b023ca80, length=5765760
[ 9083.793028] timecode=00:00:00 type=0, flags=0x00000000,
frames=0, userbits=0x00000000
[ 9083.793117] video0: VIDIOC_QBUF: error -22: 00:00:00.00000000
index=2, type=vid-cap, flags=0x00000000, field=any, sequence=0,
memory=userptr, bytesused=0, offset/userptr=0x7ff2b07bc500, length=5765760
Also use true instead of 1 since that argument is a bool in the
get_vaddr_frames() prototype.
Fixes: 21fb0cb7ec ("[media] vb2: Provide helpers for mapping virtual addresses")
Reported-by: Albert Antony <albert@newtec.dk>
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
[hans.verkuil@cisco.com: merged the 'bool' change into this patch]
Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org> # for v4.3 and up
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
131 lines
3.7 KiB
C
131 lines
3.7 KiB
C
/*
|
|
* videobuf2-memops.c - generic memory handling routines for videobuf2
|
|
*
|
|
* Copyright (C) 2010 Samsung Electronics
|
|
*
|
|
* Author: Pawel Osciak <pawel@osciak.com>
|
|
* Marek Szyprowski <m.szyprowski@samsung.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation.
|
|
*/
|
|
|
|
#include <linux/slab.h>
|
|
#include <linux/module.h>
|
|
#include <linux/dma-mapping.h>
|
|
#include <linux/vmalloc.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/file.h>
|
|
|
|
#include <media/videobuf2-v4l2.h>
|
|
#include <media/videobuf2-memops.h>
|
|
|
|
/**
|
|
* vb2_create_framevec() - map virtual addresses to pfns
|
|
* @start: Virtual user address where we start mapping
|
|
* @length: Length of a range to map
|
|
* @write: Should we map for writing into the area
|
|
*
|
|
* This function allocates and fills in a vector with pfns corresponding to
|
|
* virtual address range passed in arguments. If pfns have corresponding pages,
|
|
* page references are also grabbed to pin pages in memory. The function
|
|
* returns pointer to the vector on success and error pointer in case of
|
|
* failure. Returned vector needs to be freed via vb2_destroy_pfnvec().
|
|
*/
|
|
struct frame_vector *vb2_create_framevec(unsigned long start,
|
|
unsigned long length,
|
|
bool write)
|
|
{
|
|
int ret;
|
|
unsigned long first, last;
|
|
unsigned long nr;
|
|
struct frame_vector *vec;
|
|
|
|
first = start >> PAGE_SHIFT;
|
|
last = (start + length - 1) >> PAGE_SHIFT;
|
|
nr = last - first + 1;
|
|
vec = frame_vector_create(nr);
|
|
if (!vec)
|
|
return ERR_PTR(-ENOMEM);
|
|
ret = get_vaddr_frames(start & PAGE_MASK, nr, write, true, vec);
|
|
if (ret < 0)
|
|
goto out_destroy;
|
|
/* We accept only complete set of PFNs */
|
|
if (ret != nr) {
|
|
ret = -EFAULT;
|
|
goto out_release;
|
|
}
|
|
return vec;
|
|
out_release:
|
|
put_vaddr_frames(vec);
|
|
out_destroy:
|
|
frame_vector_destroy(vec);
|
|
return ERR_PTR(ret);
|
|
}
|
|
EXPORT_SYMBOL(vb2_create_framevec);
|
|
|
|
/**
|
|
* vb2_destroy_framevec() - release vector of mapped pfns
|
|
* @vec: vector of pfns / pages to release
|
|
*
|
|
* This releases references to all pages in the vector @vec (if corresponding
|
|
* pfns are backed by pages) and frees the passed vector.
|
|
*/
|
|
void vb2_destroy_framevec(struct frame_vector *vec)
|
|
{
|
|
put_vaddr_frames(vec);
|
|
frame_vector_destroy(vec);
|
|
}
|
|
EXPORT_SYMBOL(vb2_destroy_framevec);
|
|
|
|
/**
|
|
* vb2_common_vm_open() - increase refcount of the vma
|
|
* @vma: virtual memory region for the mapping
|
|
*
|
|
* This function adds another user to the provided vma. It expects
|
|
* struct vb2_vmarea_handler pointer in vma->vm_private_data.
|
|
*/
|
|
static void vb2_common_vm_open(struct vm_area_struct *vma)
|
|
{
|
|
struct vb2_vmarea_handler *h = vma->vm_private_data;
|
|
|
|
pr_debug("%s: %p, refcount: %d, vma: %08lx-%08lx\n",
|
|
__func__, h, atomic_read(h->refcount), vma->vm_start,
|
|
vma->vm_end);
|
|
|
|
atomic_inc(h->refcount);
|
|
}
|
|
|
|
/**
|
|
* vb2_common_vm_close() - decrease refcount of the vma
|
|
* @vma: virtual memory region for the mapping
|
|
*
|
|
* This function releases the user from the provided vma. It expects
|
|
* struct vb2_vmarea_handler pointer in vma->vm_private_data.
|
|
*/
|
|
static void vb2_common_vm_close(struct vm_area_struct *vma)
|
|
{
|
|
struct vb2_vmarea_handler *h = vma->vm_private_data;
|
|
|
|
pr_debug("%s: %p, refcount: %d, vma: %08lx-%08lx\n",
|
|
__func__, h, atomic_read(h->refcount), vma->vm_start,
|
|
vma->vm_end);
|
|
|
|
h->put(h->arg);
|
|
}
|
|
|
|
/**
|
|
* vb2_common_vm_ops - common vm_ops used for tracking refcount of mmaped
|
|
* video buffers
|
|
*/
|
|
const struct vm_operations_struct vb2_common_vm_ops = {
|
|
.open = vb2_common_vm_open,
|
|
.close = vb2_common_vm_close,
|
|
};
|
|
EXPORT_SYMBOL_GPL(vb2_common_vm_ops);
|
|
|
|
MODULE_DESCRIPTION("common memory handling routines for videobuf2");
|
|
MODULE_AUTHOR("Pawel Osciak <pawel@osciak.com>");
|
|
MODULE_LICENSE("GPL");
|