linux-kernel - Re: [PATCHv3 7/8] videobuf2: handle V4L2_MEMORY_FLAG_NON

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 26 Jul 2021 13:20:05 +0900
From:   Sergey Senozhatsky <senozhatsky@...omium.org>
To:     Dafna Hirschfeld <dafna.hirschfeld@...labora.com>
Cc:     Tomasz Figa <tfiga@...omium.org>,
        Hans Verkuil <hverkuil-cisco@...all.nl>,
        Ricardo Ribalda <ribalda@...omium.org>,
        Christoph Hellwig <hch@....de>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        Collabora Kernel ML <kernel@...labora.com>,
        Sergey Senozhatsky <senozhatsky@...omium.org>
Subject: Re: [PATCHv3 7/8] videobuf2: handle V4L2_MEMORY_FLAG_NON_COHERENT
 flag

On (21/07/26 13:05), Sergey Senozhatsky wrote:
> On (21/07/26 10:40), Sergey Senozhatsky wrote:
> > On (21/07/22 19:33), Dafna Hirschfeld wrote:
> > [..]
> > > >   int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
> > > >   {
> > > >   	int ret = vb2_verify_memory_type(q, req->memory, req->type);
> > > > +	u32 flags = req->flags;
> > > >   	fill_buf_caps(q, &req->capabilities);
> > > > -	return ret ? ret : vb2_core_reqbufs(q, req->memory, 0, &req->count);
> > > > +	validate_memory_flags(q, req->memory, &flags);
> > > > +	req->flags = flags;
> > > 
> > > you can do instead
> > > 
> > > validate_memory_flags(q, req->memory, &req->flags);
> > 
> > ->flags are u32 for create-bufs and u8 for reqi-bufs. So `*flags = <value>`
> > can write to ->reserved[] for req-bufs (if the value is huge enough).
> 
> I guess ->flags can become u8 for both create-bufs and req-bufs.
> We had ->flags in both structs as u32, but then decided to leave
> some reserved[] space in req-bufs and switched to u8 there.

Something like this

---

diff --git a/Documentation/userspace-api/media/v4l/vidioc-create-bufs.rst b/Documentation/userspace-api/media/v4l/vidioc-create-bufs.rst
index a048a9f6b7b6..cf633b5a4919 100644
--- a/Documentation/userspace-api/media/v4l/vidioc-create-bufs.rst
+++ b/Documentation/userspace-api/media/v4l/vidioc-create-bufs.rst
@@ -112,13 +112,13 @@ than the number requested.
 	other changes, then set ``count`` to 0, ``memory`` to
 	``V4L2_MEMORY_MMAP`` and ``format.type`` to the buffer type.
 
-    * - __u32
+    * - __u8
       - ``flags``
       - Specifies additional buffer management attributes.
 	See :ref:`memory-flags`.
 
-    * - __u32
-      - ``reserved``\ [6]
+    * - __u8
+      - ``reserved``\ [27]
       - A place holder for future extensions. Drivers and applications
 	must set the array to zero.
 
diff --git a/drivers/media/common/videobuf2/videobuf2-v4l2.c b/drivers/media/common/videobuf2/videobuf2-v4l2.c
index 6edf4508c636..2ae949ec0afa 100644
--- a/drivers/media/common/videobuf2/videobuf2-v4l2.c
+++ b/drivers/media/common/videobuf2/videobuf2-v4l2.c
@@ -694,7 +694,7 @@ static void fill_buf_caps(struct vb2_queue *q, u32 *caps)
 
 static void validate_memory_flags(struct vb2_queue *q,
 				  int memory,
-				  u32 *flags)
+				  u8 *flags)
 {
 	if (!q->allow_cache_hints || memory != V4L2_MEMORY_MMAP) {
 		/*
@@ -711,11 +711,9 @@ static void validate_memory_flags(struct vb2_queue *q,
 int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
 {
 	int ret = vb2_verify_memory_type(q, req->memory, req->type);
-	u32 flags = req->flags;
 
 	fill_buf_caps(q, &req->capabilities);
-	validate_memory_flags(q, req->memory, &flags);
-	req->flags = flags;
+	validate_memory_flags(q, req->memory, &req->flags);
 	return ret ? ret : vb2_core_reqbufs(q, req->memory,
 					    req->flags, &req->count);
 }
@@ -990,11 +988,9 @@ int vb2_ioctl_reqbufs(struct file *file, void *priv,
 {
 	struct video_device *vdev = video_devdata(file);
 	int res = vb2_verify_memory_type(vdev->queue, p->memory, p->type);
-	u32 flags = p->flags;
 
 	fill_buf_caps(vdev->queue, &p->capabilities);
-	validate_memory_flags(vdev->queue, p->memory, &flags);
-	p->flags = flags;
+	validate_memory_flags(vdev->queue, p->memory, &p->flags);
 	if (res)
 		return res;
 	if (vb2_queue_is_busy(vdev, file))
diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
index 7973aa0465d2..ad4f7cee53f2 100644
--- a/include/uapi/linux/videodev2.h
+++ b/include/uapi/linux/videodev2.h
@@ -2513,8 +2513,8 @@ struct v4l2_create_buffers {
 	__u32			memory;
 	struct v4l2_format	format;
 	__u32			capabilities;
-	__u32			flags;
-	__u32			reserved[6];
+	__u8			flags;
+	__u8			reserved[27];
 };
 
 /*