From: Michael Tretter <m.tretter@pengutronix.de> To: Benjamin Gaignard <benjamin.gaignard@collabora.com> Cc: ezequiel@vanguardiasur.com.ar, p.zabel@pengutronix.de, mchehab@kernel.org, m.szyprowski@samsung.com, linux-media@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-kernel@vger.kernel.org, kernel@collabora.com, kernel@pengutronix.de, nicolas.dufresne@collabora.com, didi.debian@cknow.org, hverkuil-cisco@xs4all.nl Subject: Re: [PATCH v2] media: verisilicon: Fix crash when probing encoder Date: Thu, 1 Jun 2023 15:27:49 +0200 [thread overview] Message-ID: <20230601132749.GA31313@pengutronix.de> (raw) In-Reply-To: <20230413104756.356695-1-benjamin.gaignard@collabora.com> Hi Benjamin, On Thu, 13 Apr 2023 12:47:56 +0200, Benjamin Gaignard wrote: > ctx->vpu_dst_fmt is no more initialized before calling hantro_try_fmt() > so assigne it to vpu_fmt led to crash the kernel. > Like for decoder case use 'fmt' as format for encoder and clean up > the code. > > Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> > Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> > Fixes: db6f68b51e5c ("media: verisilicon: Do not set context src/dst formats in reset functions") > --- > version 2: > - Remove useless vpu_fmt. > > drivers/media/platform/verisilicon/hantro_v4l2.c | 10 +++------- > 1 file changed, 3 insertions(+), 7 deletions(-) > > diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c > index 8f1414085f47..d71f79471396 100644 > --- a/drivers/media/platform/verisilicon/hantro_v4l2.c > +++ b/drivers/media/platform/verisilicon/hantro_v4l2.c > @@ -275,7 +275,7 @@ static int hantro_try_fmt(const struct hantro_ctx *ctx, > struct v4l2_pix_format_mplane *pix_mp, > enum v4l2_buf_type type) > { > - const struct hantro_fmt *fmt, *vpu_fmt; > + const struct hantro_fmt *fmt; > bool capture = V4L2_TYPE_IS_CAPTURE(type); > bool coded; > > @@ -295,11 +295,7 @@ static int hantro_try_fmt(const struct hantro_ctx *ctx, > > if (coded) { > pix_mp->num_planes = 1; > - vpu_fmt = fmt; > - } else if (ctx->is_encoder) { > - vpu_fmt = ctx->vpu_dst_fmt; > - } else { > - vpu_fmt = fmt; > + } else if (!ctx->is_encoder) { > /* > * Width/height on the CAPTURE end of a decoder are ignored and > * replaced by the OUTPUT ones. > @@ -311,7 +307,7 @@ static int hantro_try_fmt(const struct hantro_ctx *ctx, > pix_mp->field = V4L2_FIELD_NONE; > > v4l2_apply_frmsize_constraints(&pix_mp->width, &pix_mp->height, > - &vpu_fmt->frmsize); > + &fmt->frmsize); This causes a regression on the OUTPUT device of the encoder. fmt->frmsize is only valid for coded ("bitstream") formats, but fmt on the OUTPUT of an encoder will be a raw format. This results in width and height to be clamped to 0. I think the correct fix would be to apply the frmsize constraints of the currently configured coded format, but as ctx->vpu_dst_fmt is not initialized before calling this code, I don't know how to get the coded format. Michael > > if (!coded) { > /* Fill remaining fields */ > -- > 2.34.1 >
WARNING: multiple messages have this Message-ID (diff)
From: Michael Tretter <m.tretter@pengutronix.de> To: Benjamin Gaignard <benjamin.gaignard@collabora.com> Cc: ezequiel@vanguardiasur.com.ar, p.zabel@pengutronix.de, mchehab@kernel.org, m.szyprowski@samsung.com, linux-media@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-kernel@vger.kernel.org, kernel@collabora.com, kernel@pengutronix.de, nicolas.dufresne@collabora.com, didi.debian@cknow.org, hverkuil-cisco@xs4all.nl Subject: Re: [PATCH v2] media: verisilicon: Fix crash when probing encoder Date: Thu, 1 Jun 2023 15:27:49 +0200 [thread overview] Message-ID: <20230601132749.GA31313@pengutronix.de> (raw) In-Reply-To: <20230413104756.356695-1-benjamin.gaignard@collabora.com> Hi Benjamin, On Thu, 13 Apr 2023 12:47:56 +0200, Benjamin Gaignard wrote: > ctx->vpu_dst_fmt is no more initialized before calling hantro_try_fmt() > so assigne it to vpu_fmt led to crash the kernel. > Like for decoder case use 'fmt' as format for encoder and clean up > the code. > > Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> > Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> > Fixes: db6f68b51e5c ("media: verisilicon: Do not set context src/dst formats in reset functions") > --- > version 2: > - Remove useless vpu_fmt. > > drivers/media/platform/verisilicon/hantro_v4l2.c | 10 +++------- > 1 file changed, 3 insertions(+), 7 deletions(-) > > diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c > index 8f1414085f47..d71f79471396 100644 > --- a/drivers/media/platform/verisilicon/hantro_v4l2.c > +++ b/drivers/media/platform/verisilicon/hantro_v4l2.c > @@ -275,7 +275,7 @@ static int hantro_try_fmt(const struct hantro_ctx *ctx, > struct v4l2_pix_format_mplane *pix_mp, > enum v4l2_buf_type type) > { > - const struct hantro_fmt *fmt, *vpu_fmt; > + const struct hantro_fmt *fmt; > bool capture = V4L2_TYPE_IS_CAPTURE(type); > bool coded; > > @@ -295,11 +295,7 @@ static int hantro_try_fmt(const struct hantro_ctx *ctx, > > if (coded) { > pix_mp->num_planes = 1; > - vpu_fmt = fmt; > - } else if (ctx->is_encoder) { > - vpu_fmt = ctx->vpu_dst_fmt; > - } else { > - vpu_fmt = fmt; > + } else if (!ctx->is_encoder) { > /* > * Width/height on the CAPTURE end of a decoder are ignored and > * replaced by the OUTPUT ones. > @@ -311,7 +307,7 @@ static int hantro_try_fmt(const struct hantro_ctx *ctx, > pix_mp->field = V4L2_FIELD_NONE; > > v4l2_apply_frmsize_constraints(&pix_mp->width, &pix_mp->height, > - &vpu_fmt->frmsize); > + &fmt->frmsize); This causes a regression on the OUTPUT device of the encoder. fmt->frmsize is only valid for coded ("bitstream") formats, but fmt on the OUTPUT of an encoder will be a raw format. This results in width and height to be clamped to 0. I think the correct fix would be to apply the frmsize constraints of the currently configured coded format, but as ctx->vpu_dst_fmt is not initialized before calling this code, I don't know how to get the coded format. Michael > > if (!coded) { > /* Fill remaining fields */ > -- > 2.34.1 > _______________________________________________ Linux-rockchip mailing list Linux-rockchip@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-rockchip
next prev parent reply other threads:[~2023-06-01 13:28 UTC|newest] Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-04-13 10:47 [PATCH v2] media: verisilicon: Fix crash when probing encoder Benjamin Gaignard 2023-04-13 10:47 ` Benjamin Gaignard 2023-04-13 19:49 ` Nicolas Dufresne 2023-04-13 19:49 ` Nicolas Dufresne [not found] ` <CAAEAJfBHOMpWT2E4w+Zu=f8QCg+YiDU_9gY4bpJSGBLMnC8B9A@mail.gmail.com> 2023-04-13 19:52 ` Nicolas Dufresne 2023-04-13 19:52 ` Nicolas Dufresne 2023-05-19 22:34 ` Diederik de Haas 2023-05-19 22:34 ` Diederik de Haas 2023-05-22 16:17 ` Benjamin Gaignard 2023-05-22 16:17 ` Benjamin Gaignard 2023-05-22 22:38 ` Diederik de Haas 2023-05-22 22:38 ` Diederik de Haas 2023-05-23 10:50 ` Linux regression tracking (Thorsten Leemhuis) 2023-05-23 10:50 ` Linux regression tracking (Thorsten Leemhuis) 2023-05-23 14:54 ` Michael Tretter 2023-05-23 14:54 ` Michael Tretter 2023-05-23 16:32 ` Marek Szyprowski 2023-05-23 16:32 ` Marek Szyprowski 2023-05-25 14:32 ` Nicolas Dufresne 2023-05-25 14:32 ` Nicolas Dufresne 2023-05-23 10:35 ` Linux regression tracking #adding (Thorsten Leemhuis) 2023-05-23 10:35 ` Linux regression tracking #adding (Thorsten Leemhuis) 2023-04-14 10:37 ` AngeloGioacchino Del Regno 2023-04-14 10:37 ` AngeloGioacchino Del Regno 2023-06-01 13:27 ` Michael Tretter [this message] 2023-06-01 13:27 ` Michael Tretter 2023-06-01 14:08 ` Benjamin Gaignard 2023-06-01 14:08 ` Benjamin Gaignard 2023-07-06 7:37 ` Michael Tretter 2023-07-06 7:37 ` Michael Tretter
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20230601132749.GA31313@pengutronix.de \ --to=m.tretter@pengutronix.de \ --cc=benjamin.gaignard@collabora.com \ --cc=didi.debian@cknow.org \ --cc=ezequiel@vanguardiasur.com.ar \ --cc=hverkuil-cisco@xs4all.nl \ --cc=kernel@collabora.com \ --cc=kernel@pengutronix.de \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-media@vger.kernel.org \ --cc=linux-rockchip@lists.infradead.org \ --cc=m.szyprowski@samsung.com \ --cc=mchehab@kernel.org \ --cc=nicolas.dufresne@collabora.com \ --cc=p.zabel@pengutronix.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.