linux-kernel - Re: [PATCH 1/2] media: vsp1: vsp1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250616132049.GA10542@pendragon.ideasonboard.com>
Date: Mon, 16 Jun 2025 16:20:49 +0300
From: Laurent Pinchart <laurent.pinchart@...asonboard.com>
To: Jacopo Mondi <jacopo.mondi+renesas@...asonboard.com>
Cc: Kieran Bingham <kieran.bingham+renesas@...asonboard.com>,
	Mauro Carvalho Chehab <mchehab@...nel.org>,
	linux-media@...r.kernel.org, linux-renesas-soc@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] media: vsp1: vsp1_dl: Add usage counter

Hi Jacopo,

Thank you for the patch.

On Thu, May 29, 2025 at 06:36:30PM +0200, Jacopo Mondi wrote:
> In order to detect invalid usage pattern such as double list_put()
> calls, add a usage counter to each display list. Increment it whenever
> a list is get() and decrement it when the list is put(). Warn if the
> usage counter goes below 0.
> 
> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@...asonboard.com>
> ---
>  drivers/media/platform/renesas/vsp1/vsp1_dl.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/media/platform/renesas/vsp1/vsp1_dl.c b/drivers/media/platform/renesas/vsp1/vsp1_dl.c
> index bb8228b19824..8a3c0274a163 100644
> --- a/drivers/media/platform/renesas/vsp1/vsp1_dl.c
> +++ b/drivers/media/platform/renesas/vsp1/vsp1_dl.c
> @@ -179,6 +179,7 @@ struct vsp1_dl_cmd_pool {
>   * @has_chain: if true, indicates that there's a partition chain
>   * @chain: entry in the display list partition chain
>   * @flags: display list flags, a combination of VSP1_DL_FRAME_END_*
> + * @usage: usage counter to detect double list free
>   */
>  struct vsp1_dl_list {
>  	struct list_head list;
> @@ -198,6 +199,7 @@ struct vsp1_dl_list {
>  	struct list_head chain;
>  
>  	unsigned int flags;
> +	int usage;

If you have no objection, I'd like to include "count" in the name. This
could be usage_count, ref_count or refcount.

>  };
>  
>  /**
> @@ -617,6 +619,7 @@ struct vsp1_dl_list *vsp1_dl_list_get(struct vsp1_dl_manager *dlm)
>  		 * display list can assert list_empty() if it is not in a chain.
>  		 */
>  		INIT_LIST_HEAD(&dl->chain);
> +		dl->usage++;

The usage count will never go above 1, as there's not real reference
counting for display lists. Better than including "count" in the field
name, we could replace

	int usage;

with

	bool allocated;

(right after has_chain to avoid increasing the structure size).

>  	}
>  
>  	spin_unlock_irqrestore(&dlm->lock, flags);
> @@ -657,6 +660,10 @@ static void __vsp1_dl_list_put(struct vsp1_dl_list *dl)
>  	 */
>  	dl->body0->num_entries = 0;
>  
> +	/* decrement usage count to detect invalid usage pattern. */

s/decrement/Decrement/

> +	if (WARN_ON_ONCE(--dl->usage < 0))
> +		dl->usage = 0;
> +
>  	list_add_tail(&dl->list, &dl->dlm->free);
>  }
>  

-- 
Regards,

Laurent Pinchart