linux-kernel - Re: [PATCH v6 05/10] media: mediatek: vcodec: refactor setup dst buffer metadata interface for VP9 decoder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <72cae8fffc3ccd2a6f31fc777a5441c9a15c82fa.camel@mediatek.com>
Date: Thu, 25 Dec 2025 09:55:20 +0000
From: Kyrie Wu (吴晗) <Kyrie.Wu@...iatek.com>
To: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-mediatek@...ts.infradead.org" <linux-mediatek@...ts.infradead.org>,
	George Sun (孙林) <George.Sun@...iatek.com>,
	Tiffany Lin (林慧珊) <tiffany.lin@...iatek.com>,
	"nhebert@...omium.org" <nhebert@...omium.org>, "linux-media@...r.kernel.org"
	<linux-media@...r.kernel.org>, "devicetree@...r.kernel.org"
	<devicetree@...r.kernel.org>, "mchehab@...nel.org" <mchehab@...nel.org>,
	"nicolas.dufresne@...labora.com" <nicolas.dufresne@...labora.com>,
	"hverkuil@...all.nl" <hverkuil@...all.nl>,
	Kyrie Wu (吴晗) <Kyrie.Wu@...iatek.com>,
	Yunfei Dong (董云飞) <Yunfei.Dong@...iatek.com>,
	"conor+dt@...nel.org" <conor+dt@...nel.org>,
	Irui Wang (王瑞) <Irui.Wang@...iatek.com>,
	"robh@...nel.org" <robh@...nel.org>, "linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "matthias.bgg@...il.com"
	<matthias.bgg@...il.com>, "krzk+dt@...nel.org" <krzk+dt@...nel.org>,
	"arnd@...db.de" <arnd@...db.de>,
	Andrew-CT Chen (陳智迪)
	<Andrew-CT.Chen@...iatek.com>, AngeloGioacchino Del Regno
	<angelogioacchino.delregno@...labora.com>
CC: "andrzejtp2010@...il.com" <andrzejtp2010@...il.com>,
	"neil.armstrong@...aro.org" <neil.armstrong@...aro.org>,
	Yilong Zhou (周易龙) <Yilong.Zhou@...iatek.com>
Subject: Re: [PATCH v6 05/10] media: mediatek: vcodec: refactor setup dst
 buffer metadata interface for VP9 decoder

On Thu, 2025-12-11 at 15:29 -0500, Nicolas Dufresne wrote:
> Hi,
> 
> Le mardi 02 décembre 2025 à 15:40 +0800, Kyrie Wu a écrit :
> > Previously, calling vdec_vp9_slice_setup_single_from_src_to_dst
> > with v4l2_m2m_next_src_buf to obtain both buffers resulted in
> > -EINVAL,
> > interrupting the decoding process. To resolve this,
> > the interface should be updated to set both src and dst buffers
> > for metadata configuration.
> 
> I'm haven't figure-out why this happens, perhaps you can add more
> details ?
> 
> > 
> > Signed-off-by: Kyrie Wu <kyrie.wu@...iatek.com>
> > ---
> >  .../vcodec/decoder/vdec/vdec_vp9_req_lat_if.c | 21 ++++++++++-----
> > ----
> >  1 file changed, 11 insertions(+), 10 deletions(-)
> > 
> > diff --git
> > a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
> > lat_if.c
> > b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
> > lat_if.c
> > index fa0f406f7726..9513ddde7c7c 100644
> > ---
> > a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
> > lat_if.c
> > +++
> > b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
> > lat_if.c
> > @@ -696,21 +696,22 @@ static int vdec_vp9_slice_tile_offset(int
> > idx, int mi_num, int tile_log2)
> >  	return min(offset, mi_num);
> >  }
> >  
> > -static
> > -int vdec_vp9_slice_setup_single_from_src_to_dst(struct
> > vdec_vp9_slice_instance *instance)
> > +static int vdec_vp9_slice_setup_single_from_src_to_dst(struct
> > vdec_vp9_slice_instance *instance,
> > +						       struct
> > mtk_vcodec_mem *bs,
> > +						       struct vdec_fb
> > *fb)
> >  {
> > -	struct vb2_v4l2_buffer *src;
> > -	struct vb2_v4l2_buffer *dst;
> > +	struct mtk_video_dec_buf *src_buf_info;
> > +	struct mtk_video_dec_buf *dst_buf_info;
> >  
> > -	src = v4l2_m2m_next_src_buf(instance->ctx->m2m_ctx);
> 
> My concern is that vdec_vp9_slice_setup_lat_from_src_buf() also
> depends on the
> tip of the OUTPUT queue, why it this problem with limited to single
> core ?
> 
> Can you apply the manual completion fixes, and check if the problem
> still
> appear? Is that something you reproduce every time ? Perhaps it
> should be kept
> out of this serie ?
> 
> 
> > -	if (!src)
> > +	src_buf_info = container_of(bs, struct mtk_video_dec_buf,
> > bs_buffer);
> > +	if (!src_buf_info)
> >  		return -EINVAL;
> 
> Its a bit of a concern in term of memory lifetime / possible use
> after free.
> Who's holding on the buffer if its not in the queue ?
> 
> Nicolas

Dear Nicolas,

Thanks for your reminding, I think this patch could abandon.
I will update the patch set in the next version.

Thanks.

Kyrie.
> 
> >  
> > -	dst = v4l2_m2m_next_dst_buf(instance->ctx->m2m_ctx);
> > -	if (!dst)
> > +	dst_buf_info = container_of(fb, struct mtk_video_dec_buf,
> > frame_buffer);
> > +	if (!dst_buf_info)
> >  		return -EINVAL;
> >  
> > -	v4l2_m2m_buf_copy_metadata(src, dst, true);
> > +	v4l2_m2m_buf_copy_metadata(&src_buf_info->m2m_buf.vb,
> > &dst_buf_info->m2m_buf.vb, true);
> >  
> >  	return 0;
> >  }
> > @@ -1800,7 +1801,7 @@ static int vdec_vp9_slice_setup_single(struct
> > vdec_vp9_slice_instance *instance,
> >  	struct vdec_vp9_slice_vsi *vsi = &pfc->vsi;
> >  	int ret;
> >  
> > -	ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance);
> > +	ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance, bs,
> > fb);
> >  	if (ret)
> >  		goto err;
> >