linux-kernel - Re: [PATCH v2 1/2] media: vsp1: vsp1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250616163842.GK10542@pendragon.ideasonboard.com>
Date: Mon, 16 Jun 2025 19:38:42 +0300
From: Laurent Pinchart <laurent.pinchart@...asonboard.com>
To: Jacopo Mondi <jacopo.mondi+renesas@...asonboard.com>
Cc: Kieran Bingham <kieran.bingham+renesas@...asonboard.com>,
	Mauro Carvalho Chehab <mchehab@...nel.org>,
	linux-media@...r.kernel.org, linux-renesas-soc@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 1/2] media: vsp1: vsp1_dl: Detect double list release

Hi Jacopo,

On Mon, Jun 16, 2025 at 06:30:37PM +0200, Jacopo Mondi wrote:
> In order to detect invalid usage pattern such as double list_put()
> calls, add an 'allocated' flag to each display list. Set the flag
> whenever a list is get() and clear it when the list is put(). Warn if a
> list not marked as allocated is returned to the pool of available
> display lists.
> 
> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@...asonboard.com>

Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@...asonboard.com>

> ---
>  drivers/media/platform/renesas/vsp1/vsp1_dl.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/media/platform/renesas/vsp1/vsp1_dl.c b/drivers/media/platform/renesas/vsp1/vsp1_dl.c
> index bb8228b198249943399719b5f37c337fc43eed5b..18617cbb168703b851a9b437fa62f18425934c68 100644
> --- a/drivers/media/platform/renesas/vsp1/vsp1_dl.c
> +++ b/drivers/media/platform/renesas/vsp1/vsp1_dl.c
> @@ -176,6 +176,7 @@ struct vsp1_dl_cmd_pool {
>   * @bodies: list of extra display list bodies
>   * @pre_cmd: pre command to be issued through extended dl header
>   * @post_cmd: post command to be issued through extended dl header
> + * @allocated: flag to detect double list release
>   * @has_chain: if true, indicates that there's a partition chain
>   * @chain: entry in the display list partition chain
>   * @flags: display list flags, a combination of VSP1_DL_FRAME_END_*
> @@ -194,6 +195,8 @@ struct vsp1_dl_list {
>  	struct vsp1_dl_ext_cmd *pre_cmd;
>  	struct vsp1_dl_ext_cmd *post_cmd;
>  
> +	bool allocated;
> +
>  	bool has_chain;
>  	struct list_head chain;
>  
> @@ -617,6 +620,7 @@ struct vsp1_dl_list *vsp1_dl_list_get(struct vsp1_dl_manager *dlm)
>  		 * display list can assert list_empty() if it is not in a chain.
>  		 */
>  		INIT_LIST_HEAD(&dl->chain);
> +		dl->allocated = true;
>  	}
>  
>  	spin_unlock_irqrestore(&dlm->lock, flags);
> @@ -657,6 +661,13 @@ static void __vsp1_dl_list_put(struct vsp1_dl_list *dl)
>  	 */
>  	dl->body0->num_entries = 0;
>  
> +	/*
> +	 * Return the display list to the 'free' pool. If the list had already
> +	 * been returned be loud about it.
> +	 */
> +	WARN_ON_ONCE(!dl->allocated);
> +	dl->allocated = false;
> +
>  	list_add_tail(&dl->list, &dl->dlm->free);
>  }
>  

-- 
Regards,

Laurent Pinchart