linux-kernel - Re: [PATCH v6 05/10] media: mediatek: vcodec: refactor setup dst buffer metadata interface for VP9 decoder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d9a58ddf9b90d8320562ec54f2bd74fa77f0bc67.camel@collabora.com>
Date: Thu, 11 Dec 2025 15:29:24 -0500
From: Nicolas Dufresne <nicolas.dufresne@...labora.com>
To: Kyrie Wu <kyrie.wu@...iatek.com>, Tiffany Lin
 <tiffany.lin@...iatek.com>,  Andrew-CT Chen <andrew-ct.chen@...iatek.com>,
 Yunfei Dong <yunfei.dong@...iatek.com>, Mauro Carvalho Chehab	
 <mchehab@...nel.org>, Rob Herring <robh@...nel.org>, Krzysztof Kozlowski	
 <krzk+dt@...nel.org>, Conor Dooley <conor+dt@...nel.org>, Matthias Brugger	
 <matthias.bgg@...il.com>, AngeloGioacchino Del Regno	
 <angelogioacchino.delregno@...labora.com>, Hans Verkuil
 <hverkuil@...all.nl>,  Nathan Hebert <nhebert@...omium.org>, Arnd Bergmann
 <arnd@...db.de>, Irui Wang <irui.wang@...iatek.com>,  George Sun
 <george.sun@...iatek.com>, linux-media@...r.kernel.org,
 devicetree@...r.kernel.org, 	linux-kernel@...r.kernel.org,
 linux-arm-kernel@...ts.infradead.org, 	linux-mediatek@...ts.infradead.org
Cc: Neil Armstrong <neil.armstrong@...aro.org>, Andrzej Pietrasiewicz
	 <andrzejtp2010@...il.com>, Yilong Zhou <yilong.zhou@...iatek.com>
Subject: Re: [PATCH v6 05/10] media: mediatek: vcodec: refactor setup dst
 buffer metadata interface for VP9 decoder

Hi,

Le mardi 02 décembre 2025 à 15:40 +0800, Kyrie Wu a écrit :
> Previously, calling vdec_vp9_slice_setup_single_from_src_to_dst
> with v4l2_m2m_next_src_buf to obtain both buffers resulted in -EINVAL,
> interrupting the decoding process. To resolve this,
> the interface should be updated to set both src and dst buffers
> for metadata configuration.

I'm haven't figure-out why this happens, perhaps you can add more details ?

> 
> Signed-off-by: Kyrie Wu <kyrie.wu@...iatek.com>
> ---
>  .../vcodec/decoder/vdec/vdec_vp9_req_lat_if.c | 21 ++++++++++---------
>  1 file changed, 11 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c
> index fa0f406f7726..9513ddde7c7c 100644
> --- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c
> +++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c
> @@ -696,21 +696,22 @@ static int vdec_vp9_slice_tile_offset(int idx, int mi_num, int tile_log2)
>  	return min(offset, mi_num);
>  }
>  
> -static
> -int vdec_vp9_slice_setup_single_from_src_to_dst(struct vdec_vp9_slice_instance *instance)
> +static int vdec_vp9_slice_setup_single_from_src_to_dst(struct vdec_vp9_slice_instance *instance,
> +						       struct mtk_vcodec_mem *bs,
> +						       struct vdec_fb *fb)
>  {
> -	struct vb2_v4l2_buffer *src;
> -	struct vb2_v4l2_buffer *dst;
> +	struct mtk_video_dec_buf *src_buf_info;
> +	struct mtk_video_dec_buf *dst_buf_info;
>  
> -	src = v4l2_m2m_next_src_buf(instance->ctx->m2m_ctx);

My concern is that vdec_vp9_slice_setup_lat_from_src_buf() also depends on the
tip of the OUTPUT queue, why it this problem with limited to single core ?

Can you apply the manual completion fixes, and check if the problem still
appear? Is that something you reproduce every time ? Perhaps it should be kept
out of this serie ?


> -	if (!src)
> +	src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
> +	if (!src_buf_info)
>  		return -EINVAL;

Its a bit of a concern in term of memory lifetime / possible use after free.
Who's holding on the buffer if its not in the queue ?

Nicolas

>  
> -	dst = v4l2_m2m_next_dst_buf(instance->ctx->m2m_ctx);
> -	if (!dst)
> +	dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
> +	if (!dst_buf_info)
>  		return -EINVAL;
>  
> -	v4l2_m2m_buf_copy_metadata(src, dst, true);
> +	v4l2_m2m_buf_copy_metadata(&src_buf_info->m2m_buf.vb, &dst_buf_info->m2m_buf.vb, true);
>  
>  	return 0;
>  }
> @@ -1800,7 +1801,7 @@ static int vdec_vp9_slice_setup_single(struct vdec_vp9_slice_instance *instance,
>  	struct vdec_vp9_slice_vsi *vsi = &pfc->vsi;
>  	int ret;
>  
> -	ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance);
> +	ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance, bs, fb);
>  	if (ret)
>  		goto err;
>  

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)