{"id":13369,"url":"https://patchwork.libcamera.org/api/1.1/patches/13369/?format=json","web_url":"https://patchwork.libcamera.org/patch/13369/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/1.1/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20210816130337.120053-1-umang.jain@ideasonboard.com>","date":"2021-08-16T13:03:37","name":"[libcamera-devel] pipeline: vimc: Force complete of request on cancelled buffers","commit_ref":null,"pull_url":null,"state":"superseded","archived":false,"hash":"780211194450d217f464d0e40047f76b5013594d","submitter":{"id":86,"url":"https://patchwork.libcamera.org/api/1.1/people/86/?format=json","name":"Umang Jain","email":"umang.jain@ideasonboard.com"},"delegate":null,"mbox":"https://patchwork.libcamera.org/patch/13369/mbox/","series":[{"id":2360,"url":"https://patchwork.libcamera.org/api/1.1/series/2360/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=2360","date":"2021-08-16T13:03:37","name":"[libcamera-devel] pipeline: vimc: Force complete of request on cancelled buffers","version":1,"mbox":"https://patchwork.libcamera.org/series/2360/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/13369/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/13369/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 7F191BD87D\n\tfor ;\n\tMon, 16 Aug 2021 13:03:50 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id ECA6C68893;\n\tMon, 16 Aug 2021 15:03:49 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 8901F6025D\n\tfor ;\n\tMon, 16 Aug 2021 15:03:48 +0200 (CEST)","from perceval.ideasonboard.com (unknown [103.238.109.15])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 6C09A3F1;\n\tMon, 16 Aug 2021 15:03:47 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"MJ0MiEgV\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1629119028;\n\tbh=AdaGd0JjDBO+guUPOx6BwdH8zKpf+PUQjQk1wtaVvlQ=;\n\th=From:To:Cc:Subject:Date:From;\n\tb=MJ0MiEgVP80SUpy4qP2zFd/YRjn4H8oaqOFZzC+gs2ls281qapKXi2AhKYTNV+J8n\n\t2W2teUT3Njka2QZx2k1lwYtn0oN/+4pgZXWxn7vqdfVXAh72Y6KowY1PIP1T55bEHv\n\twWjVfDW5BOPjM7tQwSs+k1vNj9RpFLn8ZWUUj2rY=","From":"Umang Jain ","To":"libcamera-devel@lists.libcamera.org","Date":"Mon, 16 Aug 2021 18:33:37 +0530","Message-Id":"<20210816130337.120053-1-umang.jain@ideasonboard.com>","X-Mailer":"git-send-email 2.31.1","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Subject":"[libcamera-devel] [PATCH] pipeline: vimc: Force complete of request\n\ton cancelled buffers","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "},"content":"When the stream is stopped, the V4L2VideoDevice sends back all\nthe queued buffers with FrameMetadata::FrameCancelled status.\nIt is the responsibility of the pipeline handler to handle\nthese buffers with FrameMetadata::FrameCancelled. VIMC is\ncurrently missing this handling path.\n\nAs the FrameMetadata::FrameCancelled is set when the stream is\nstopped, we can be sure that no more queued and re-use of request\nshall happen. Hence, cancel all the requests' buffers force a\ncomplete with completeBuffer().\n\nThe issue is caught by the gstreamer_single_stream_test.cpp running\nwith vimc. During the check with meson built-in option\n\t'-Db_sanitize=address,undefined'\nit was observed:\n\n==118003==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000037108 at pc 0x7f225160c9ac bp 0x7f224a47b620 sp 0x7f224a47b618\nREAD of size 4 at 0x60e000037108 thread T1\n #0 0x7f225160c9ab in libcamera::Request::sequence() const ../include/libcamera/request.h:55\n #1 0x7f22518297aa in libcamera::VimcCameraData::bufferReady(libcamera::FrameBuffer*) ../src/libcamera/pipeline/vimc/vimc.cpp:577\n #2 0x7f225183b1ef in libcamera::BoundMethodMember::activate(libcamera::FrameBuffer*, bool) ../include/libcamera/base/bound_method.h:194\n #3 0x7f22515cc91f in libcamera::Signal::emit(libcamera::FrameBuffer*) ../include/libcamera/base/signal.h:126\n #4 0x7f22515c3305 in libcamera::V4L2VideoDevice::streamOff() ../src/libcamera/v4l2_videodevice.cpp:1605\n #5 0x7f225181f345 in libcamera::PipelineHandlerVimc::stop(libcamera::Camera*) ../src/libcamera/pipeline/vimc/vimc.cpp:365\n\nThe VimcCameraData::bufferReady seems to emit even after the stream\nis stopped. It's primarily due to vimc's lack of handling\nFrameMetadata::FrameCancelled in its pipeline handler.\n\nSigned-off-by: Umang Jain \n---\n src/libcamera/pipeline/vimc/vimc.cpp | 12 ++++++++++++\n 1 file changed, 12 insertions(+)","diff":"diff --git a/src/libcamera/pipeline/vimc/vimc.cpp b/src/libcamera/pipeline/vimc/vimc.cpp\nindex 92b30f2e..e98adab6 100644\n--- a/src/libcamera/pipeline/vimc/vimc.cpp\n+++ b/src/libcamera/pipeline/vimc/vimc.cpp\n@@ -571,6 +571,18 @@ void VimcCameraData::bufferReady(FrameBuffer *buffer)\n \trequest->metadata().set(controls::SensorTimestamp,\n \t\t\t\tbuffer->metadata().timestamp);\n \n+\t/* If the buffer is cancelled force a complete of the whole request. */\n+\tif (buffer->metadata().status == FrameMetadata::FrameCancelled) {\n+\t\tfor (auto it : request->buffers()) {\n+\t\t\tFrameBuffer *b = it.second;\n+\t\t\tb->cancel();\n+\t\t\tpipe_->completeBuffer(request, b);\n+\t\t}\n+\n+\t\tpipe_->completeRequest(request);\n+\t\treturn;\n+\t}\n+\n \tpipe_->completeBuffer(request, buffer);\n \tpipe_->completeRequest(request);\n \n","prefixes":["libcamera-devel"]}