From patchwork Mon Mar 15 12:34:05 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ricardo Ribalda X-Patchwork-Id: 402124 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6704CC433DB for ; Mon, 15 Mar 2021 12:35:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2F6D264E10 for ; Mon, 15 Mar 2021 12:35:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229613AbhCOMee (ORCPT ); Mon, 15 Mar 2021 08:34:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54426 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229579AbhCOMeL (ORCPT ); Mon, 15 Mar 2021 08:34:11 -0400 Received: from mail-ej1-x636.google.com (mail-ej1-x636.google.com [IPv6:2a00:1450:4864:20::636]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ECB4EC061762 for ; Mon, 15 Mar 2021 05:34:10 -0700 (PDT) Received: by mail-ej1-x636.google.com with SMTP id si25so10171328ejb.1 for ; Mon, 15 Mar 2021 05:34:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=1xoa3G+ISwKSIeuqcwnTgZqAGyqpi/mTiJ1R03k5mAc=; b=LVWU4ordRDJ4NugmIqMqf+p5Llh9f5FzvOIzFM4b15JxtT3XC0042nqDEoZatqLSoV JpFGPD0n2tJdGQDzDOGYjPBtfpFxAy5DMUzmjQ0cwHJn8jt9UCmSad/tFTVrJT4PZXCz LIaFZxddaQr9VAgYrOqJleg4s94tHuhXJS3m4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=1xoa3G+ISwKSIeuqcwnTgZqAGyqpi/mTiJ1R03k5mAc=; b=R7xNYn7u/sLOuMfzH/Clj0QNqJOa1ISnNW1xvAn40hDG03uGFb+hvqm1wn0F2TQ1q5 h1CMYZesYQXVHkEa5Xa9Sz0Aso+bRdxVcx6mp6uZeLvnETNopRUEkWwCFCioKPkCgK5V VAygk0PeX/cyZvQ8EEh5la0weg+2boZiRqY/cnkFiMpoU7XGB8OFAISnLDLT9Hptk2Z7 bRxaSwX1hQxjYEHz8iRuGUWVazTlfUerlTONeBLdJR1xdjMi6Hia0snmd7cOLrH19ia3 l9zCMI2Ttc6dHo4kSUb04xA2qG5pPu86pssJep3MJzt6MDXW5b2o1T2hemRyvb0aB/ZM x0xA== X-Gm-Message-State: AOAM530H5hUv90vLA+TVaxp0MV6Xb2Zo3f+hyz5mTKtOCjgpSA/ni2jR i5S1FR/LmSgvw7FAJeIKHGZjsdyurRwxOF+0lEg= X-Google-Smtp-Source: ABdhPJxbz1uomQZnioarVABqV3L+IGQZFx3lXkxNbJZJrcgnEuUdljiCLjtxg/f6IbAHcTmWTaan+A== X-Received: by 2002:a17:906:380b:: with SMTP id v11mr23826856ejc.183.1615811649657; Mon, 15 Mar 2021 05:34:09 -0700 (PDT) Received: from alco.lan ([80.71.134.83]) by smtp.gmail.com with ESMTPSA id p3sm7155128ejd.7.2021.03.15.05.34.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Mar 2021 05:34:09 -0700 (PDT) From: Ricardo Ribalda To: Sakari Ailus , Bingbu Cao , Tianshu Qiu , Mauro Carvalho Chehab , Greg Kroah-Hartman , Arnd Bergmann , linux-media@vger.kernel.org, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Cc: Ricardo Ribalda , stable@vger.kernel.org Subject: [PATCH v2 1/2] media: staging/intel-ipu3: Fix memory leak in imu_fmt Date: Mon, 15 Mar 2021 13:34:05 +0100 Message-Id: <20210315123406.1523607-1-ribalda@chromium.org> X-Mailer: git-send-email 2.31.0.rc2.261.g7f71774620-goog MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org We are losing the reference to an allocated memory if try. Change the order of the check to avoid that. Cc: stable@vger.kernel.org Fixes: 6d5f26f2e045 ("media: staging/intel-ipu3-v4l: reduce kernel stack usage") Signed-off-by: Ricardo Ribalda --- drivers/staging/media/ipu3/ipu3-v4l2.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/staging/media/ipu3/ipu3-v4l2.c b/drivers/staging/media/ipu3/ipu3-v4l2.c index 60aa02eb7d2a..35a74d99322f 100644 --- a/drivers/staging/media/ipu3/ipu3-v4l2.c +++ b/drivers/staging/media/ipu3/ipu3-v4l2.c @@ -693,6 +693,13 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node, if (inode == IMGU_NODE_STAT_3A || inode == IMGU_NODE_PARAMS) continue; + /* CSS expects some format on OUT queue */ + if (i != IPU3_CSS_QUEUE_OUT && + !imgu_pipe->nodes[inode].enabled) { + fmts[i] = NULL; + continue; + } + if (try) { fmts[i] = kmemdup(&imgu_pipe->nodes[inode].vdev_fmt.fmt.pix_mp, sizeof(struct v4l2_pix_format_mplane), @@ -705,10 +712,6 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node, fmts[i] = &imgu_pipe->nodes[inode].vdev_fmt.fmt.pix_mp; } - /* CSS expects some format on OUT queue */ - if (i != IPU3_CSS_QUEUE_OUT && - !imgu_pipe->nodes[inode].enabled) - fmts[i] = NULL; } if (!try) { From patchwork Mon Mar 15 12:34:06 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ricardo Ribalda X-Patchwork-Id: 400829 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09847C43381 for ; Mon, 15 Mar 2021 12:35:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D675E64EE5 for ; Mon, 15 Mar 2021 12:35:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229614AbhCOMef (ORCPT ); Mon, 15 Mar 2021 08:34:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54432 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229623AbhCOMeL (ORCPT ); Mon, 15 Mar 2021 08:34:11 -0400 Received: from mail-ej1-x632.google.com (mail-ej1-x632.google.com [IPv6:2a00:1450:4864:20::632]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 64F82C061763 for ; Mon, 15 Mar 2021 05:34:11 -0700 (PDT) Received: by mail-ej1-x632.google.com with SMTP id e19so65968691ejt.3 for ; Mon, 15 Mar 2021 05:34:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=6fzzF2nTd+REl5qE5E9llLopvCzR8WvhV0GzxYvbKiQ=; b=hoyWYL6Ua5bHjZ5fFiNjWiTwgVHOeBMTl+C5u13Hz9ANPNeqiQqB5bdkXQOvPxa4JC TXZrjnLLJzAUkFsn3tNWaX8h3rYBk90pIGTe4hmFG7FsbEsYNyD8330Qq0UeAvATAY2r OAS+nnMyIWc8xYtIds8GqZY6O2L+O+c43FTIs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=6fzzF2nTd+REl5qE5E9llLopvCzR8WvhV0GzxYvbKiQ=; b=EVFTGTWoNBmYAfszn5UxRZQfZ6weIUDYIGLN/3h7iBFhZXpMQeMl713HwWEx1sRPmR iLiw0AOWjooZ0yw5f7ni+zCVrfXRyPdttIWz4X/8CS+QG63LMiHbQ+wJvMOz22aDkcWJ jMJLdHEmGctBKq+o7Pn5bRtG9lZz3c9cG4kBIbbzziCxii2s2zlm1pS/1uo+y5bFxIfE OHstbGeuT40OTNF1bPqyEAYp5bDcpx2KJLHAoQc3YhSGsrxESJrIZmYmeduzS8TV4Zq5 /fDgJRsAii+RtrOG9hgc24li4KKDlzXs9QKibpiA83B4D7fM0TN/PdPnDrC4MyJ6QMDt 18pQ== X-Gm-Message-State: AOAM530DadJ4kGugD1zJznZDH6XcYLdDYzpFGYDAqE54iisi5tce4wrd yrkL5ty44UaB/xmlp2e5VfrpAg== X-Google-Smtp-Source: ABdhPJyOPSGp9sA5eXQVAxbFL4UxF/O8joRa0JjAWd6X3k2uT1JpqKrHlwRtbH8Vpz2mWPC4OuSQOg== X-Received: by 2002:a17:906:b297:: with SMTP id q23mr23580704ejz.315.1615811650164; Mon, 15 Mar 2021 05:34:10 -0700 (PDT) Received: from alco.lan ([80.71.134.83]) by smtp.gmail.com with ESMTPSA id p3sm7155128ejd.7.2021.03.15.05.34.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Mar 2021 05:34:09 -0700 (PDT) From: Ricardo Ribalda To: Sakari Ailus , Bingbu Cao , Tianshu Qiu , Mauro Carvalho Chehab , Greg Kroah-Hartman , Arnd Bergmann , linux-media@vger.kernel.org, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Cc: Ricardo Ribalda , stable@vger.kernel.org Subject: [PATCH v2 2/2] media: staging/intel-ipu3: Fix set_fmt error handling Date: Mon, 15 Mar 2021 13:34:06 +0100 Message-Id: <20210315123406.1523607-2-ribalda@chromium.org> X-Mailer: git-send-email 2.31.0.rc2.261.g7f71774620-goog In-Reply-To: <20210315123406.1523607-1-ribalda@chromium.org> References: <20210315123406.1523607-1-ribalda@chromium.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org If there in an error during a set_fmt, do not overwrite the previous sizes with the invalid config. [ 38.662975] ipu3-imgu 0000:00:05.0: swiotlb buffer is full (sz: 4096 bytes) [ 38.662980] DMA: Out of SW-IOMMU space for 4096 bytes at device 0000:00:05.0 [ 38.663010] general protection fault: 0000 [#1] PREEMPT SMP Cc: stable@vger.kernel.org Fixes: 6d5f26f2e045 ("media: staging/intel-ipu3-v4l: reduce kernel stack usage") Signed-off-by: Ricardo Ribalda Reviewed-by: Tomasz Figa --- drivers/staging/media/ipu3/ipu3-v4l2.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/drivers/staging/media/ipu3/ipu3-v4l2.c b/drivers/staging/media/ipu3/ipu3-v4l2.c index 35a74d99322f..6d9c49b39531 100644 --- a/drivers/staging/media/ipu3/ipu3-v4l2.c +++ b/drivers/staging/media/ipu3/ipu3-v4l2.c @@ -686,6 +686,7 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node, dev_dbg(dev, "IPU3 pipe %u pipe_id = %u", pipe, css_pipe->pipe_id); + css_q = imgu_node_to_queue(node); for (i = 0; i < IPU3_CSS_QUEUES; i++) { unsigned int inode = imgu_map_node(imgu, i); @@ -700,6 +701,11 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node, continue; } + if (i == css_q) { + fmts[i] = &f->fmt.pix_mp; + continue; + } + if (try) { fmts[i] = kmemdup(&imgu_pipe->nodes[inode].vdev_fmt.fmt.pix_mp, sizeof(struct v4l2_pix_format_mplane), @@ -728,16 +734,10 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node, rects[IPU3_CSS_RECT_GDC]->height = pad_fmt.height; } - /* - * imgu doesn't set the node to the value given by user - * before we return success from this function, so set it here. - */ - css_q = imgu_node_to_queue(node); if (!fmts[css_q]) { ret = -EINVAL; goto out; } - *fmts[css_q] = f->fmt.pix_mp; if (try) ret = imgu_css_fmt_try(&imgu->css, fmts, rects, pipe); @@ -748,15 +748,18 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node, if (ret < 0) goto out; - if (try) - f->fmt.pix_mp = *fmts[css_q]; - else - f->fmt = imgu_pipe->nodes[node].vdev_fmt.fmt; + /* + * imgu doesn't set the node to the value given by user + * before we return success from this function, so set it here. + */ + if (!try) + imgu_pipe->nodes[node].vdev_fmt.fmt.pix_mp = f->fmt.pix_mp; out: if (try) { for (i = 0; i < IPU3_CSS_QUEUES; i++) - kfree(fmts[i]); + if (i != css_q) + kfree(fmts[i]); } return ret;