All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
To: linux-media@vger.kernel.org, linux-mediatek@lists.infradead.org,
	linux-kernel@vger.kernel.org
Cc: dafna.hirschfeld@collabora.com, hverkuil@xs4all.nl,
	kernel@collabora.com, dafna3@gmail.com, mchehab@kernel.org,
	tfiga@chromium.org, tiffany.lin@mediatek.com,
	andrew-ct.chen@mediatek.com, matthias.bgg@gmail.com,
	hsinyi@chromium.org, maoguang.meng@mediatek.com,
	irui.wang@mediatek.com, acourbot@chromium.org,
	Yunfei.Dong@mediatek.com, yong.wu@mediatek.com,
	eizan@chromium.org
Subject: [PATCH 2/5] media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
Date: Wed,  4 Aug 2021 16:27:26 +0200	[thread overview]
Message-ID: <20210804142729.7231-3-dafna.hirschfeld@collabora.com> (raw)
In-Reply-To: <20210804142729.7231-1-dafna.hirschfeld@collabora.com>

The func v4l2_m2m_ctx_release waits for currently running jobs
to finish and then stop streaming both queues and frees the buffers.
All this should be done before the call to mtk_vcodec_enc_release
which frees the encoder handler. This fixes use-after-free bug.

Fixes: 4e855a6efa547 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
---
 drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
index 45d1870c83dd..4ced20ca647b 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
@@ -218,11 +218,11 @@ static int fops_vcodec_release(struct file *file)
 	mtk_v4l2_debug(1, "[%d] encoder", ctx->id);
 	mutex_lock(&dev->dev_mutex);
 
+	v4l2_m2m_ctx_release(ctx->m2m_ctx);
 	mtk_vcodec_enc_release(ctx);
 	v4l2_fh_del(&ctx->fh);
 	v4l2_fh_exit(&ctx->fh);
 	v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
-	v4l2_m2m_ctx_release(ctx->m2m_ctx);
 
 	list_del_init(&ctx->list);
 	kfree(ctx);
-- 
2.17.1


WARNING: multiple messages have this Message-ID (diff)
From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
To: linux-media@vger.kernel.org, linux-mediatek@lists.infradead.org,
	linux-kernel@vger.kernel.org
Cc: dafna.hirschfeld@collabora.com, hverkuil@xs4all.nl,
	kernel@collabora.com, dafna3@gmail.com, mchehab@kernel.org,
	tfiga@chromium.org, tiffany.lin@mediatek.com,
	andrew-ct.chen@mediatek.com, matthias.bgg@gmail.com,
	hsinyi@chromium.org, maoguang.meng@mediatek.com,
	irui.wang@mediatek.com, acourbot@chromium.org,
	Yunfei.Dong@mediatek.com, yong.wu@mediatek.com,
	eizan@chromium.org
Subject: [PATCH 2/5] media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
Date: Wed,  4 Aug 2021 16:27:26 +0200	[thread overview]
Message-ID: <20210804142729.7231-3-dafna.hirschfeld@collabora.com> (raw)
In-Reply-To: <20210804142729.7231-1-dafna.hirschfeld@collabora.com>

The func v4l2_m2m_ctx_release waits for currently running jobs
to finish and then stop streaming both queues and frees the buffers.
All this should be done before the call to mtk_vcodec_enc_release
which frees the encoder handler. This fixes use-after-free bug.

Fixes: 4e855a6efa547 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
---
 drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
index 45d1870c83dd..4ced20ca647b 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
@@ -218,11 +218,11 @@ static int fops_vcodec_release(struct file *file)
 	mtk_v4l2_debug(1, "[%d] encoder", ctx->id);
 	mutex_lock(&dev->dev_mutex);
 
+	v4l2_m2m_ctx_release(ctx->m2m_ctx);
 	mtk_vcodec_enc_release(ctx);
 	v4l2_fh_del(&ctx->fh);
 	v4l2_fh_exit(&ctx->fh);
 	v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
-	v4l2_m2m_ctx_release(ctx->m2m_ctx);
 
 	list_del_init(&ctx->list);
 	kfree(ctx);
-- 
2.17.1


_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

  parent reply	other threads:[~2021-08-04 14:32 UTC|newest]

Thread overview: 45+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-04 14:27 [PATCH 0/5] media: mtk-vcodec: venc: variouse bug fixes Dafna Hirschfeld
2021-08-04 14:27 ` Dafna Hirschfeld
2021-08-04 14:27 ` [PATCH 1/5] media: mtk-vcodec: enter ABORT state if encoding failed Dafna Hirschfeld
2021-08-04 14:27   ` Dafna Hirschfeld
2021-08-04 14:27 ` Dafna Hirschfeld [this message]
2021-08-04 14:27   ` [PATCH 2/5] media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released Dafna Hirschfeld
2021-08-04 14:27 ` [PATCH 3/5] media: mtk-vcodec: change the venc handler funcs to return int Dafna Hirschfeld
2021-08-04 14:27   ` Dafna Hirschfeld
2021-08-04 14:27 ` [PATCH 4/5] media: mtk-vcodec: Add two error cases upon vpu irq handling Dafna Hirschfeld
2021-08-04 14:27   ` Dafna Hirschfeld
2021-08-06  6:58   ` Irui Wang (王瑞)
2021-08-06  7:48     ` Dafna Hirschfeld
2021-08-06  7:48       ` Dafna Hirschfeld
     [not found]       ` <HK0PR03MB302713CFF1F1E79AD99737679DF69@HK0PR03MB3027.apcprd03.prod.outlook.com>
2021-08-09  8:26         ` 答复: " Dafna Hirschfeld
2021-08-09  8:26           ` Dafna Hirschfeld
2021-08-09  9:12           ` 答复: " Irui Wang (王瑞)
2021-08-11 10:14             ` Dafna Hirschfeld
2021-08-11 10:14               ` Dafna Hirschfeld
2021-11-03 20:50             ` Dafna Hirschfeld
2021-11-03 20:50               ` Dafna Hirschfeld
2021-11-04  1:38               ` Irui Wang
2021-11-04  1:38                 ` Irui Wang
2021-11-04  6:50                 ` Dafna Hirschfeld
2021-11-04  6:50                   ` Dafna Hirschfeld
2021-11-04  9:16                   ` Irui Wang
2021-11-04  9:16                     ` Irui Wang
2021-11-04  9:23                     ` Dafna Hirschfeld
2021-11-04  9:23                       ` Dafna Hirschfeld
2021-11-04  9:51                       ` Irui Wang
2021-11-04  9:51                         ` Irui Wang
2021-11-04 10:26                         ` Dafna Hirschfeld
2021-11-04 10:26                           ` Dafna Hirschfeld
2021-11-04 12:21                           ` Irui Wang
2021-11-04 12:21                             ` Irui Wang
2021-11-05  8:16                             ` Dafna Hirschfeld
2021-11-05  8:16                               ` Dafna Hirschfeld
2021-11-06  7:02                               ` Irui Wang
2021-11-06  7:02                                 ` Irui Wang
2021-11-09 13:12                                 ` Dafna Hirschfeld
2021-11-09 13:12                                   ` Dafna Hirschfeld
2021-08-04 14:27 ` [PATCH 5/5] media: mtk-vcodec: venc: Fail if a msg sent to VPU was not signaled Dafna Hirschfeld
2021-08-04 14:27   ` Dafna Hirschfeld
2021-08-06  6:50   ` Irui Wang (王瑞)
2021-10-18 11:43     ` Dafna Hirschfeld
2021-10-18 11:43       ` Dafna Hirschfeld

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210804142729.7231-3-dafna.hirschfeld@collabora.com \
    --to=dafna.hirschfeld@collabora.com \
    --cc=Yunfei.Dong@mediatek.com \
    --cc=acourbot@chromium.org \
    --cc=andrew-ct.chen@mediatek.com \
    --cc=dafna3@gmail.com \
    --cc=eizan@chromium.org \
    --cc=hsinyi@chromium.org \
    --cc=hverkuil@xs4all.nl \
    --cc=irui.wang@mediatek.com \
    --cc=kernel@collabora.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=linux-mediatek@lists.infradead.org \
    --cc=maoguang.meng@mediatek.com \
    --cc=matthias.bgg@gmail.com \
    --cc=mchehab@kernel.org \
    --cc=tfiga@chromium.org \
    --cc=tiffany.lin@mediatek.com \
    --cc=yong.wu@mediatek.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.