* [PATCHv2 0/3] Fix .buf_prepare
[not found] <58791717-b7a9-d057-a998-a4440fcbe783@collabora.com>
@ 2021-05-05 12:23 ` Andrzej Pietrasiewicz
2021-05-05 12:23 ` [PATCHv2 1/3] media: rkvdec: " Andrzej Pietrasiewicz
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Andrzej Pietrasiewicz @ 2021-05-05 12:23 UTC (permalink / raw)
To: linux-media
Cc: linux-rockchip, linux-arm-kernel, devel, Mauro Carvalho Chehab,
Hans Verkuil, Ezequiel Garcia, Philipp Zabel, Maxime Ripard,
Paul Kocialkowski, Chen-Yu Tsai, Jernej Skrabec,
Greg Kroah-Hartman, Andrzej Pietrasiewicz, kernel
Drivers should only set the payload on .buf_prepare if the
buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused
set by userspace then v4l2-core will set it to buffer length.
If we overwrite bytesused for OUTPUT buffers, too, then
vb2_get_plane_payload() will return incorrect value which might be then
written to hw registers by the driver.
Andrzej Pietrasiewicz (2):
media: hantro: Fix .buf_prepare
media: cedrus: Fix .buf_prepare
Ezequiel Garcia (1):
media: rkvdec: Fix .buf_prepare
drivers/staging/media/hantro/hantro_v4l2.c | 9 ++++++++-
drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++-
drivers/staging/media/sunxi/cedrus/cedrus_video.c | 8 +++++++-
3 files changed, 24 insertions(+), 3 deletions(-)
base-commit: 0b276e470a4d43e1365d3eb53c608a3d208cabd4
--
2.17.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCHv2 1/3] media: rkvdec: Fix .buf_prepare
2021-05-05 12:23 ` [PATCHv2 0/3] Fix .buf_prepare Andrzej Pietrasiewicz
@ 2021-05-05 12:23 ` Andrzej Pietrasiewicz
2021-05-05 12:23 ` [PATCHv2 2/3] media: hantro: " Andrzej Pietrasiewicz
2021-05-05 12:23 ` [PATCHv2 3/3] media: cedrus: " Andrzej Pietrasiewicz
2 siblings, 0 replies; 4+ messages in thread
From: Andrzej Pietrasiewicz @ 2021-05-05 12:23 UTC (permalink / raw)
To: linux-media
Cc: linux-rockchip, linux-arm-kernel, devel, Mauro Carvalho Chehab,
Hans Verkuil, Ezequiel Garcia, Philipp Zabel, Maxime Ripard,
Paul Kocialkowski, Chen-Yu Tsai, Jernej Skrabec,
Greg Kroah-Hartman, Andrzej Pietrasiewicz, kernel, Adrian Ratiu
From: Ezequiel Garcia <ezequiel@collabora.com>
The driver should only set the payload on .buf_prepare if the
buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused
set by userspace then v4l2-core will set it to buffer length.
If we overwrite bytesused for OUTPUT buffers, too, then
vb2_get_plane_payload() will return incorrect value which might be then
written to hw registers by the driver in rkvdec-h264.c.
Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver")
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com>
[Changed the comment and used V4L2_TYPE_IS_CAPTURE macro]
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
---
drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
index d821661d30f3..cd65ad2af8d4 100644
--- a/drivers/staging/media/rkvdec/rkvdec.c
+++ b/drivers/staging/media/rkvdec/rkvdec.c
@@ -481,7 +481,15 @@ static int rkvdec_buf_prepare(struct vb2_buffer *vb)
if (vb2_plane_size(vb, i) < sizeimage)
return -EINVAL;
}
- vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage);
+
+ /*
+ * Buffer's bytesused must be written by driver for CAPTURE buffers.
+ * (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets
+ * it to buffer length).
+ */
+ if (V4L2_TYPE_IS_CAPTURE(vq->type))
+ vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage);
+
return 0;
}
--
2.17.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCHv2 2/3] media: hantro: Fix .buf_prepare
2021-05-05 12:23 ` [PATCHv2 0/3] Fix .buf_prepare Andrzej Pietrasiewicz
2021-05-05 12:23 ` [PATCHv2 1/3] media: rkvdec: " Andrzej Pietrasiewicz
@ 2021-05-05 12:23 ` Andrzej Pietrasiewicz
2021-05-05 12:23 ` [PATCHv2 3/3] media: cedrus: " Andrzej Pietrasiewicz
2 siblings, 0 replies; 4+ messages in thread
From: Andrzej Pietrasiewicz @ 2021-05-05 12:23 UTC (permalink / raw)
To: linux-media
Cc: linux-rockchip, linux-arm-kernel, devel, Mauro Carvalho Chehab,
Hans Verkuil, Ezequiel Garcia, Philipp Zabel, Maxime Ripard,
Paul Kocialkowski, Chen-Yu Tsai, Jernej Skrabec,
Greg Kroah-Hartman, Andrzej Pietrasiewicz, kernel
The driver should only set the payload on .buf_prepare if the
buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused
set by userspace then v4l2-core will set it to buffer length.
If we overwrite bytesused for OUTPUT buffers, too, then
vb2_get_plane_payload() will return incorrect value which might be then
written to hw registers by the driver in hantro_g1_h264_dec.c.
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
---
drivers/staging/media/hantro/hantro_v4l2.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/hantro/hantro_v4l2.c b/drivers/staging/media/hantro/hantro_v4l2.c
index 1bc118e375a1..7ccc6405036a 100644
--- a/drivers/staging/media/hantro/hantro_v4l2.c
+++ b/drivers/staging/media/hantro/hantro_v4l2.c
@@ -639,7 +639,14 @@ static int hantro_buf_prepare(struct vb2_buffer *vb)
ret = hantro_buf_plane_check(vb, pix_fmt);
if (ret)
return ret;
- vb2_set_plane_payload(vb, 0, pix_fmt->plane_fmt[0].sizeimage);
+ /*
+ * Buffer's bytesused must be written by driver for CAPTURE buffers.
+ * (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets
+ * it to buffer length).
+ */
+ if (V4L2_TYPE_IS_CAPTURE(vq->type))
+ vb2_set_plane_payload(vb, 0, pix_fmt->plane_fmt[0].sizeimage);
+
return 0;
}
--
2.17.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCHv2 3/3] media: cedrus: Fix .buf_prepare
2021-05-05 12:23 ` [PATCHv2 0/3] Fix .buf_prepare Andrzej Pietrasiewicz
2021-05-05 12:23 ` [PATCHv2 1/3] media: rkvdec: " Andrzej Pietrasiewicz
2021-05-05 12:23 ` [PATCHv2 2/3] media: hantro: " Andrzej Pietrasiewicz
@ 2021-05-05 12:23 ` Andrzej Pietrasiewicz
2 siblings, 0 replies; 4+ messages in thread
From: Andrzej Pietrasiewicz @ 2021-05-05 12:23 UTC (permalink / raw)
To: linux-media
Cc: linux-rockchip, linux-arm-kernel, devel, Mauro Carvalho Chehab,
Hans Verkuil, Ezequiel Garcia, Philipp Zabel, Maxime Ripard,
Paul Kocialkowski, Chen-Yu Tsai, Jernej Skrabec,
Greg Kroah-Hartman, Andrzej Pietrasiewicz, kernel
The driver should only set the payload on .buf_prepare if the
buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused
set by userspace then v4l2-core will set it to buffer length.
If we overwrite bytesused for OUTPUT buffers, too, then
vb2_get_plane_payload() will return incorrect value which might be then
written to hw registers by the driver in cedrus_h264.c or cedrus_vp8.c.
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
---
drivers/staging/media/sunxi/cedrus/cedrus_video.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_video.c b/drivers/staging/media/sunxi/cedrus/cedrus_video.c
index b62eb8e84057..bf731caf2ed5 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus_video.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus_video.c
@@ -457,7 +457,13 @@ static int cedrus_buf_prepare(struct vb2_buffer *vb)
if (vb2_plane_size(vb, 0) < pix_fmt->sizeimage)
return -EINVAL;
- vb2_set_plane_payload(vb, 0, pix_fmt->sizeimage);
+ /*
+ * Buffer's bytesused must be written by driver for CAPTURE buffers.
+ * (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets
+ * it to buffer length).
+ */
+ if (V4L2_TYPE_IS_CAPTURE(vq->type))
+ vb2_set_plane_payload(vb, 0, pix_fmt->sizeimage);
return 0;
}
--
2.17.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-05-05 12:26 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <58791717-b7a9-d057-a998-a4440fcbe783@collabora.com>
2021-05-05 12:23 ` [PATCHv2 0/3] Fix .buf_prepare Andrzej Pietrasiewicz
2021-05-05 12:23 ` [PATCHv2 1/3] media: rkvdec: " Andrzej Pietrasiewicz
2021-05-05 12:23 ` [PATCHv2 2/3] media: hantro: " Andrzej Pietrasiewicz
2021-05-05 12:23 ` [PATCHv2 3/3] media: cedrus: " Andrzej Pietrasiewicz
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).