| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20230530173839.GH22516@pendragon.ideasonboard.com>
Date: Tue, 30 May 2023 20:38:39 +0300
From: Laurent Pinchart <laurent.pinchart@...asonboard.com>
To: Tomasz Figa <tfiga@...omium.org>
Cc: Benjamin Gaignard <benjamin.gaignard@...labora.com>,
m.szyprowski@...sung.com, mchehab@...nel.org, ming.qian@....com,
shijie.qin@....com, eagle.zhou@....com, bin.liu@...iatek.com,
matthias.bgg@...il.com, angelogioacchino.delregno@...labora.com,
tiffany.lin@...iatek.com, andrew-ct.chen@...iatek.com,
yunfei.dong@...iatek.com, stanimir.k.varbanov@...il.com,
quic_vgarodia@...cinc.com, agross@...nel.org, andersson@...nel.org,
konrad.dybcio@...aro.org, ezequiel@...guardiasur.com.ar,
p.zabel@...gutronix.de, daniel.almeida@...labora.com,
hverkuil-cisco@...all.nl, jernel@...nel.org,
linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org,
linux-mediatek@...ts.infradead.org, linux-arm-msm@...r.kernel.org,
linux-rockchip@...ts.infradead.org, kernel@...labora.com
Subject: Re: [PATCH v2 3/8] media: videobuf2: Add a module param to limit vb2
queue buffer storage
On Fri, May 19, 2023 at 10:19:16AM +0000, Tomasz Figa wrote:
> On Tue, Mar 21, 2023 at 11:28:50AM +0100, Benjamin Gaignard wrote:
> > Add module parameter "max_vb_buffer_per_queue" to be able to limit
> > the number of vb2 buffers store in queue.
> >
> > Signed-off-by: Benjamin Gaignard <benjamin.gaignard@...labora.com>
> > ---
> > drivers/media/common/videobuf2/videobuf2-core.c | 15 +++------------
> > include/media/videobuf2-core.h | 11 +++++++++--
> > 2 files changed, 12 insertions(+), 14 deletions(-)
> >
> > diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
> > index ae9d72f4d181..f4da917ccf3f 100644
> > --- a/drivers/media/common/videobuf2/videobuf2-core.c
> > +++ b/drivers/media/common/videobuf2/videobuf2-core.c
> > @@ -34,6 +34,8 @@
> > static int debug;
> > module_param(debug, int, 0644);
> >
> > +module_param(max_vb_buffer_per_queue, ulong, 0644);
> > +
> > #define dprintk(q, level, fmt, arg...) \
> > do { \
> > if (debug >= level) \
> > @@ -412,10 +414,6 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory,
> > struct vb2_buffer *vb;
> > int ret;
> >
> > - /* Ensure that q->num_buffers+num_buffers is below VB2_MAX_FRAME */
> > - num_buffers = min_t(unsigned int, num_buffers,
> > - VB2_MAX_FRAME - q->num_buffers);
> > -
>
> We should keep the validation here, just using the new module parameter
> instead of VB2_MAX_FRAME. Otherwise we let the userspace pass
> UINT_MAX to REQBUFS and have the array below exhaust the system memory.
>
> > for (buffer = 0; buffer < num_buffers; ++buffer) {
> > /* Allocate vb2 buffer structures */
> > vb = kzalloc(q->buf_struct_size, GFP_KERNEL);
> > @@ -801,9 +799,7 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
> > /*
> > * Make sure the requested values and current defaults are sane.
> > */
> > - WARN_ON(q->min_buffers_needed > VB2_MAX_FRAME);
> > num_buffers = max_t(unsigned int, *count, q->min_buffers_needed);
> > - num_buffers = min_t(unsigned int, num_buffers, VB2_MAX_FRAME);
>
> Similar concern here.
>
> > memset(q->alloc_devs, 0, sizeof(q->alloc_devs));
> > /*
> > * Set this now to ensure that drivers see the correct q->memory value
> > @@ -919,11 +915,6 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
> > bool no_previous_buffers = !q->num_buffers;
> > int ret;
> >
> > - if (q->num_buffers == VB2_MAX_FRAME) {
> > - dprintk(q, 1, "maximum number of buffers already allocated\n");
> > - return -ENOBUFS;
> > - }
> > -
>
> Ditto.
>
> > if (no_previous_buffers) {
> > if (q->waiting_in_dqbuf && *count) {
> > dprintk(q, 1, "another dup()ped fd is waiting for a buffer\n");
> > @@ -948,7 +939,7 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
> > return -EINVAL;
> > }
> >
> > - num_buffers = min(*count, VB2_MAX_FRAME - q->num_buffers);
> > + num_buffers = *count;
>
> Ditto.
>
> >
> > if (requested_planes && requested_sizes) {
> > num_planes = requested_planes;
> > diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h
> > index 397dbf6e61e1..b8b34a993e04 100644
> > --- a/include/media/videobuf2-core.h
> > +++ b/include/media/videobuf2-core.h
> > @@ -12,6 +12,7 @@
> > #ifndef _MEDIA_VIDEOBUF2_CORE_H
> > #define _MEDIA_VIDEOBUF2_CORE_H
> >
> > +#include <linux/minmax.h>
> > #include <linux/mm_types.h>
> > #include <linux/mutex.h>
> > #include <linux/poll.h>
> > @@ -48,6 +49,8 @@ struct vb2_fileio_data;
> > struct vb2_threadio_data;
> > struct vb2_buffer;
> >
> > +static size_t max_vb_buffer_per_queue = 1024;
> > +
> > /**
> > * struct vb2_mem_ops - memory handling/memory allocator operations.
> > * @alloc: allocate video memory and, optionally, allocator private data,
> > @@ -1268,12 +1271,16 @@ static inline bool vb2_queue_add_buffer(struct vb2_queue *q, struct vb2_buffer *
> >
> > if (vb->index >= q->max_num_bufs) {
> > struct vb2_buffer **tmp;
> > + int cnt = min(max_vb_buffer_per_queue, q->max_num_bufs * 2);
>
> Should cnt also be size_t to match max_vb_buffer_per_queue?
> This could also overflow given q->max_num_bufs big enough, so maybe it
> would just be better to rewrite to?
>
> size_t cnt = (q->max_num_bufs > max_vb_buffer_per_queue / 2) ?
> max_vb_buffer_per_queue : q->max_num_bufs * 2;
>
> Or we could just switch to XArray and it would solve this for us. :)
I like using existing libraries instead of reinventing the wheel :-)
> > +
> > + if (cnt >= q->max_num_bufs)
> > + goto realloc_failed;
> >
> > - tmp = krealloc_array(q->bufs, q->max_num_bufs * 2, sizeof(*q->bufs), GFP_KERNEL);
> > + tmp = krealloc_array(q->bufs, cnt, sizeof(*q->bufs), GFP_KERNEL);
> > if (!tmp)
> > goto realloc_failed;
> >
> > - q->max_num_bufs *= 2;
> > + q->max_num_bufs = cnt;
> > q->bufs = tmp;
> > }
> >
--
Regards,
Laurent Pinchart
Powered by blists - more mailing lists