linux-kernel - Re: [PATCH v4 3/5] media: uvcvideo: Split uvc_stop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d541ee58-2fa5-4c1e-b744-2e080065fe39@kernel.org>
Date: Mon, 30 Jun 2025 17:12:29 +0200
From: Hans de Goede <hansg@...nel.org>
To: Laurent Pinchart <laurent.pinchart@...asonboard.com>,
 Ricardo Ribalda <ribalda@...omium.org>
Cc: Hans de Goede <hdegoede@...hat.com>, Hans Verkuil <hans@...erkuil.nl>,
 Mauro Carvalho Chehab <mchehab@...nel.org>, linux-media@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4 3/5] media: uvcvideo: Split uvc_stop_streaming()

Hi Laurent

On 30-Jun-25 4:17 PM, Laurent Pinchart wrote:
> On Mon, Jun 16, 2025 at 03:24:40PM +0000, Ricardo Ribalda wrote:
>> uvc_stop_streaming() is used for meta and video nodes. Split the function
>> in two to avoid confusion.
>>
>> Use this opportunity to rename uvc_start_streaming() to
>> uvc_start_streaming_video(), as it is only called by the video nodes.
>>
>> Reviewed-by: Hans de Goede <hansg@...nel.org>
>> Signed-off-by: Ricardo Ribalda <ribalda@...omium.org>
>> ---
>>  drivers/media/usb/uvc/uvc_queue.c | 22 +++++++++++++++-------
>>  1 file changed, 15 insertions(+), 7 deletions(-)
>>
>> diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c
>> index 8f9737ac729546683ca48f5e71ce3dfacbae2926..3f357c2d48cfd258c26f0342007d1d12f1e01007 100644
>> --- a/drivers/media/usb/uvc/uvc_queue.c
>> +++ b/drivers/media/usb/uvc/uvc_queue.c
>> @@ -167,7 +167,7 @@ static void uvc_buffer_finish(struct vb2_buffer *vb)
>>  		uvc_video_clock_update(stream, vbuf, buf);
>>  }
>>  
>> -static int uvc_start_streaming(struct vb2_queue *vq, unsigned int count)
>> +static int uvc_start_streaming_video(struct vb2_queue *vq, unsigned int count)
>>  {
>>  	struct uvc_video_queue *queue = vb2_get_drv_priv(vq);
>>  	struct uvc_streaming *stream = uvc_queue_to_stream(queue);
>> @@ -186,14 +186,22 @@ static int uvc_start_streaming(struct vb2_queue *vq, unsigned int count)
>>  	return ret;
>>  }
>>  
>> -static void uvc_stop_streaming(struct vb2_queue *vq)
>> +static void uvc_stop_streaming_video(struct vb2_queue *vq)
>>  {
>>  	struct uvc_video_queue *queue = vb2_get_drv_priv(vq);
>>  
>>  	lockdep_assert_irqs_enabled();
>>  
>> -	if (vq->type != V4L2_BUF_TYPE_META_CAPTURE)
>> -		uvc_video_stop_streaming(uvc_queue_to_stream(queue));
>> +	uvc_video_stop_streaming(uvc_queue_to_stream(queue));
>> +
>> +	uvc_queue_return_buffers(queue, UVC_BUF_STATE_ERROR);
>> +}
>> +
>> +static void uvc_stop_streaming_meta(struct vb2_queue *vq)
>> +{
>> +	struct uvc_video_queue *queue = vb2_get_drv_priv(vq);
>> +
>> +	lockdep_assert_irqs_enabled();
>>  
>>  	uvc_queue_return_buffers(queue, UVC_BUF_STATE_ERROR);
> 
> I haven't checked where it was introduced, but I think you have a race
> here. uvc_queue_return_buffers() will return all buffers currently
> sitting in the queue->irqqueue. This can race with a bunch of places in
> uvc_video.c that call uvc_queue_get_current_buffer() or
> uvc_queue_get_next_buffer(), as those functions return a buffer without
> removing it from the list.

This change just splits uvc_stop_streaming() into 2 separate
functions for uvc_queue_qops + uvc_meta_queue_qops to remove
the weird looking "if (vq->type != V4L2_BUF_TYPE_META_CAPTURE)"
check done in the shared uvc_stop_streaming().

This patch does not make any functional changes. So if such
a race exists then that is a pre-existing problem and not
caused by this patch.

Regards,

Hans



> 
>>  }
>> @@ -203,15 +211,15 @@ static const struct vb2_ops uvc_queue_qops = {
>>  	.buf_prepare = uvc_buffer_prepare,
>>  	.buf_queue = uvc_buffer_queue,
>>  	.buf_finish = uvc_buffer_finish,
>> -	.start_streaming = uvc_start_streaming,
>> -	.stop_streaming = uvc_stop_streaming,
>> +	.start_streaming = uvc_start_streaming_video,
>> +	.stop_streaming = uvc_stop_streaming_video,
>>  };
>>  
>>  static const struct vb2_ops uvc_meta_queue_qops = {
>>  	.queue_setup = uvc_queue_setup,
>>  	.buf_prepare = uvc_buffer_prepare,
>>  	.buf_queue = uvc_buffer_queue,
>> -	.stop_streaming = uvc_stop_streaming,
>> +	.stop_streaming = uvc_stop_streaming_meta,
>>  };
>>  
>>  int uvc_queue_init(struct uvc_video_queue *queue, enum v4l2_buf_type type)
>