• Ricardo Ribalda's avatar
    [media] vb2-memops: Fix over allocation of frame vectors · 89a09566
    Ricardo Ribalda authored
    On page unaligned frames, create_framevec forces get_vaddr_frames to
    allocate an extra page at the end of the buffer. Under some
    circumstances, this leads to -EINVAL on VIDIOC_QBUF.
    
    E.g:
    We have vm_a that vm_area that goes from 0x1000 to 0x3000. And a
    frame that goes from 0x1800 to 0x2800, i.e. 2 pages.
    
    frame_vector_create will be called with the following params:
    
    get_vaddr_frames(0x1800, 2, write, 1, vec);
    
    get_vaddr will allocate the first page after checking that the memory
    0x1800-0x27ff is valid, but it will not allocate the second page because
    the range 0x2800-0x37ff is out of the vm_a range. This results in
    create_framevec returning -EFAULT
    
    Error Trace:
    [ 9083.793015] video0: VIDIOC_QBUF: 00:00:00.00000000 index=1,
    type=vid-cap, flags=0x00002002, field=any, sequence=0,
    memory=userptr, bytesused=0, offset/userptr=0x7ff2b023ca80, length=5765760
    [ 9083.793028] timecode=00:00:00 type=0, flags=0x00000000,
    frames=0, userbits=0x00000000
    [ 9083.793117] video0: VIDIOC_QBUF: error -22: 00:00:00.00000000
    index=2, type=vid-cap, flags=0x00000000, field=any, sequence=0,
    memory=userptr, bytesused=0, offset/userptr=0x7ff2b07bc500, length=5765760
    
    Also use true instead of 1 since that argument is a bool in the
    get_vaddr_frames() prototype.
    
    Fixes: 21fb0cb7 ("[media] vb2: Provide helpers for mapping virtual addresses")
    Reported-by: default avatarAlbert Antony <albert@newtec.dk>
    Signed-off-by: default avatarRicardo Ribalda Delgado <ricardo.ribalda@gmail.com>
    [hans.verkuil@cisco.com: merged the 'bool' change into this patch]
    Acked-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
    Reviewed-by: default avatarJan Kara <jack@suse.cz>
    Cc: <stable@vger.kernel.org>      # for v4.3 and up
    Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
    89a09566
videobuf2-memops.c 3.7 KB