| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <d4b6ad10-1889-0a63-5a14-cb1320e2dc09@xs4all.nl>
Date: Fri, 24 Mar 2023 09:52:13 +0100
From: Hans Verkuil <hverkuil-cisco@...all.nl>
To: Laurent Pinchart <laurent.pinchart@...asonboard.com>
Cc: Benjamin Gaignard <benjamin.gaignard@...labora.com>,
Dan Carpenter <error27@...il.com>, oe-kbuild@...ts.linux.dev,
tfiga@...omium.org, m.szyprowski@...sung.com, mchehab@...nel.org,
ming.qian@....com, shijie.qin@....com, eagle.zhou@....com,
bin.liu@...iatek.com, matthias.bgg@...il.com,
angelogioacchino.delregno@...labora.com, tiffany.lin@...iatek.com,
andrew-ct.chen@...iatek.com, yunfei.dong@...iatek.com,
stanimir.k.varbanov@...il.com, quic_vgarodia@...cinc.com,
agross@...nel.org, andersson@...nel.org, konrad.dybcio@...aro.org,
ezequiel@...guardiasur.com.ar, p.zabel@...gutronix.de,
daniel.almeida@...labora.com, lkp@...el.com,
oe-kbuild-all@...ts.linux.dev, linux-media@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
linux-mediatek@...ts.infradead.org, linux-arm-msm@...r.kernel.org,
linux-rockchip@...ts.infradead.org, kernel@...labora.com
Subject: Re: [PATCH v2 2/8] media: videobuf2: Make bufs array dynamic
allocated
On 24/03/2023 09:48, Laurent Pinchart wrote:
> On Fri, Mar 24, 2023 at 09:31:35AM +0100, Hans Verkuil wrote:
>> On 24/03/2023 09:11, Benjamin Gaignard wrote:
>>>
>>> Le 24/03/2023 à 06:01, Dan Carpenter a écrit :
>>>> Hi Benjamin,
>>>>
>>>> https://git-scm.com/docs/git-format-patch#_base_tree_information]
>>>>
>>>> url: https://github.com/intel-lab-lkp/linux/commits/Benjamin-Gaignard/media-videobuf2-Access-vb2_queue-bufs-array-through-helper-functions/20230321-183154
>>>> base: git://linuxtv.org/media_tree.git master
>>>> patch link: https://lore.kernel.org/r/20230321102855.346732-3-benjamin.gaignard%40collabora.com
>>>> patch subject: [PATCH v2 2/8] media: videobuf2: Make bufs array dynamic allocated
>>>> config: arm64-randconfig-m041-20230319 (https://download.01.org/0day-ci/archive/20230324/202303240148.lKRnUqW9-lkp@intel.com/config)
>>>> compiler: aarch64-linux-gcc (GCC) 12.1.0
>>>>
>>>> If you fix the issue, kindly add following tag where applicable
>>>> | Reported-by: kernel test robot <lkp@...el.com>
>>>> | Reported-by: Dan Carpenter <error27@...il.com>
>>>> | Link: https://lore.kernel.org/r/202303240148.lKRnUqW9-lkp@intel.com/
>>>>
>>>> smatch warnings:
>>>> include/media/videobuf2-core.h:1272 vb2_queue_add_buffer() warn: sleeping in atomic context
>>>> drivers/media/common/videobuf2/videobuf2-core.c:2456 vb2_core_queue_init() warn: Please consider using kcalloc instead of kmalloc_array
>>>>
>>>> vim +1272 include/media/videobuf2-core.h
>>>>
>>>> 625d46c1c1fe8e Benjamin Gaignard 2023-03-21 1263 static inline bool vb2_queue_add_buffer(struct vb2_queue *q, struct vb2_buffer *vb)
>>>> 625d46c1c1fe8e Benjamin Gaignard 2023-03-21 1264 {
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1265 bool ret = false;
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1266
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1267 spin_lock(&q->bufs_lock);
>>>> ^^^^^^^^^^^^^^^^^^^^^^^
>>>> Holding a spin lock.
>>>>
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1268
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1269 if (vb->index >= q->max_num_bufs) {
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1270 struct vb2_buffer **tmp;
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1271
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 @1272 tmp = krealloc_array(q->bufs, q->max_num_bufs * 2, sizeof(*q->bufs), GFP_KERNEL);
>>>> ^^^^^^^^^^
>>>> Sleeping allocation. GFP_ATOMIC? Or is there a way to move the
>>>> allocation outside the lock?
>>>
>>> I will add GFP_ATOMIC flag in next version.
>>
>> No need. Instead, don't use realloc here, just allocate a new array, copy over all
>> the data from the old, and then switch q->bufs with the spinlock held. Then you
>> can free the old one.
>>
>> It's only when you update q->bufs that you need the lock.
>
> The copy also needs to be protected by the lock.
I suspect that that is not needed, since you shouldn't be able to add buffers here
since a mutex should be held at this time.
That said, it's something that Benjamin needs to analyze.
Regards,
Hans
>
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1273 if (!tmp)
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1274 goto realloc_failed;
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1275
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1276 q->max_num_bufs *= 2;
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1277 q->bufs = tmp;
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1278 }
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1279
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1280 if (vb->index < q->max_num_bufs) {
>>>> 625d46c1c1fe8e Benjamin Gaignard 2023-03-21 1281 q->bufs[vb->index] = vb;
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1282 ret = true;
>>>> 625d46c1c1fe8e Benjamin Gaignard 2023-03-21 1283 }
>>>> 625d46c1c1fe8e Benjamin Gaignard 2023-03-21 1284
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1285 realloc_failed:
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1286 spin_unlock(&q->bufs_lock);
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1287
>>>> 487d3f14d12ecf Benjamin Gaignard 2023-03-21 1288 return ret;
>>>> 625d46c1c1fe8e Benjamin Gaignard 2023-03-21 1289 }
>
Powered by blists - more mailing lists