{"id":11482,"url":"https://patchwork.libcamera.org/api/patches/11482/?format=json","web_url":"https://patchwork.libcamera.org/patch/11482/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20210303170426.189648-3-kieran.bingham@ideasonboard.com>","date":"2021-03-03T17:04:25","name":"[libcamera-devel,2/3] libcamera: pipeline: ipu3: Ensure that IPU3Frames::info is not used after delete","commit_ref":null,"pull_url":null,"state":"accepted","archived":false,"hash":"1e30889a12d810cf82d93c1af5f2fada000877be","submitter":{"id":4,"url":"https://patchwork.libcamera.org/api/people/4/?format=json","name":"Kieran Bingham","email":"kieran.bingham@ideasonboard.com"},"delegate":null,"mbox":"https://patchwork.libcamera.org/patch/11482/mbox/","series":[{"id":1754,"url":"https://patchwork.libcamera.org/api/series/1754/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=1754","date":"2021-03-03T17:04:23","name":"IPU3 Stability","version":1,"mbox":"https://patchwork.libcamera.org/series/1754/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/11482/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/11482/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 4022CBD1F1\n\tfor ;\n\tWed, 3 Mar 2021 17:04:33 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id C626868AA7;\n\tWed, 3 Mar 2021 18:04:31 +0100 (CET)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 450DA68A91\n\tfor ;\n\tWed, 3 Mar 2021 18:04:30 +0100 (CET)","from Q.local (cpc89244-aztw30-2-0-cust3082.18-1.cable.virginm.net\n\t[86.31.172.11])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id D67D68DE;\n\tWed, 3 Mar 2021 18:04:29 +0100 (CET)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"HIpaSri8\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1614791070;\n\tbh=uO27BIlzWeSyMUE85FWKqTxyU+/kPwFYPDJQo+Bl5Vk=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=HIpaSri8Bv9VyzNbC77Q37SymmR5yhetS1Z+t9aR4hg7I/EkQVf/nFyX8C/yDDUFY\n\tbeZcr2BIW5nETyrI1jkZe9ooOpbNFC4QekLI78rOjhgtCNjAkehtQ8U2QYUCEcVenP\n\tnfwFe0URc0D6W7Q29WhztgkSPEmW4twJSRj7WeXQ=","From":"Kieran Bingham ","To":"libcamera devel ","Date":"Wed, 3 Mar 2021 17:04:25 +0000","Message-Id":"<20210303170426.189648-3-kieran.bingham@ideasonboard.com>","X-Mailer":"git-send-email 2.25.1","In-Reply-To":"<20210303170426.189648-1-kieran.bingham@ideasonboard.com>","References":"<20210303170426.189648-1-kieran.bingham@ideasonboard.com>","MIME-Version":"1.0","Subject":"[libcamera-devel] [PATCH 2/3] libcamera: pipeline: ipu3: Ensure\n\tthat IPU3Frames::info is not used after delete","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "},"content":"When the IPU3Frames completes, it deletes the internal info storage.\n\nThis storage contains the pointer to the Request, but in some cases the\npointer was being accessed after the info structure was removed.\n\nEnsure that the Request is obtained before attempting to complete to\nobtain a valid pointer.\n\nSigned-off-by: Kieran Bingham \n\n---\nThis may be a further sign that we should rework how this is allocated,\nbut for now - this patch fixes the crash which can occur when shutting\ndown streams.\n\n\n The blank line addition in the first hunk is intentional.\n\n\n src/libcamera/pipeline/ipu3/ipu3.cpp | 20 ++++++++++++++++++--\n 1 file changed, 18 insertions(+), 2 deletions(-)","diff":"diff --git a/src/libcamera/pipeline/ipu3/ipu3.cpp b/src/libcamera/pipeline/ipu3/ipu3.cpp\nindex 2b4d31500533..9539393e5d84 100644\n--- a/src/libcamera/pipeline/ipu3/ipu3.cpp\n+++ b/src/libcamera/pipeline/ipu3/ipu3.cpp\n@@ -1164,6 +1164,7 @@ void IPU3CameraData::queueFrameAction(unsigned int id,\n \t\t * in action.controls to register additional metadata.\n \t\t */\n \t\tRequest *request = info->request;\n+\n \t\tinfo->metadataProcessed = true;\n \t\tif (frameInfos_.tryComplete(info))\n \t\t\tpipe_->completeRequest(request);\n@@ -1253,8 +1254,15 @@ void IPU3CameraData::paramBufferReady(FrameBuffer *buffer)\n \t\treturn;\n \n \tinfo->paramDequeued = true;\n+\n+\t/*\n+\t * tryComplete() will delete info if it completes the IPU3Frame.\n+\t * In that event, we must have obtained the Request before hand.\n+\t */\n+\tRequest *request = info->request;\n+\n \tif (frameInfos_.tryComplete(info))\n-\t\tpipe_->completeRequest(info->request);\n+\t\tpipe_->completeRequest(request);\n }\n \n void IPU3CameraData::statBufferReady(FrameBuffer *buffer)\n@@ -1265,8 +1273,16 @@ void IPU3CameraData::statBufferReady(FrameBuffer *buffer)\n \n \tif (buffer->metadata().status == FrameMetadata::FrameCancelled) {\n \t\tinfo->metadataProcessed = true;\n+\n+\t\t/*\n+\t\t* tryComplete() will delete info if it completes the IPU3Frame.\n+\t\t* In that event, we must have obtained the Request before hand.\n+\t\t*/\n+\t\tRequest *request = info->request;\n+\n \t\tif (frameInfos_.tryComplete(info))\n-\t\t\tpipe_->completeRequest(info->request);\n+\t\t\tpipe_->completeRequest(request);\n+\n \t\treturn;\n \t}\n \n","prefixes":["libcamera-devel","2/3"]}