[{"id":18836,"web_url":"https://patchwork.libcamera.org/comment/18836/","msgid":"<YRpk1QAJudppOzTB@pendragon.ideasonboard.com>","date":"2021-08-16T13:15:01","subject":"Re: [libcamera-devel] [PATCH] pipeline: vimc: Force complete of\n\trequest on cancelled buffers","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"Hi Umang,\n\nThank you for the patch.\n\nOn Mon, Aug 16, 2021 at 06:33:37PM +0530, Umang Jain wrote:\n> When the stream is stopped, the V4L2VideoDevice sends back all\n> the queued buffers with FrameMetadata::FrameCancelled status.\n> It is the responsibility of the pipeline handler to handle\n> these buffers with FrameMetadata::FrameCancelled. VIMC is\n> currently missing this handling path.\n> \n> As the FrameMetadata::FrameCancelled is set when the stream is\n> stopped, we can be sure that no more queued and re-use of request\n> shall happen.  Hence, cancel all the requests' buffers force a\n> complete with completeBuffer().\n> \n> The issue is caught by the gstreamer_single_stream_test.cpp running\n> with vimc. During the check with meson built-in option\n> \t'-Db_sanitize=address,undefined'\n> it was observed:\n> \n> ==118003==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000037108 at pc 0x7f225160c9ac bp 0x7f224a47b620 sp 0x7f224a47b618\n> READ of size 4 at 0x60e000037108 thread T1\n>     #0 0x7f225160c9ab in libcamera::Request::sequence() const ../include/libcamera/request.h:55\n>     #1 0x7f22518297aa in libcamera::VimcCameraData::bufferReady(libcamera::FrameBuffer*) ../src/libcamera/pipeline/vimc/vimc.cpp:577\n>     #2 0x7f225183b1ef in libcamera::BoundMethodMember<libcamera::VimcCameraData, void, libcamera::FrameBuffer*>::activate(libcamera::FrameBuffer*, bool) ../include/libcamera/base/bound_method.h:194\n>     #3 0x7f22515cc91f in libcamera::Signal<libcamera::FrameBuffer*>::emit(libcamera::FrameBuffer*) ../include/libcamera/base/signal.h:126\n>     #4 0x7f22515c3305 in libcamera::V4L2VideoDevice::streamOff() ../src/libcamera/v4l2_videodevice.cpp:1605\n>     #5 0x7f225181f345 in libcamera::PipelineHandlerVimc::stop(libcamera::Camera*) ../src/libcamera/pipeline/vimc/vimc.cpp:365\n> \n> The VimcCameraData::bufferReady seems to emit even after the stream\n> is stopped. It's primarily due to vimc's lack of handling\n> FrameMetadata::FrameCancelled in its pipeline handler.\n> \n> Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>\n> ---\n>  src/libcamera/pipeline/vimc/vimc.cpp | 12 ++++++++++++\n>  1 file changed, 12 insertions(+)\n> \n> diff --git a/src/libcamera/pipeline/vimc/vimc.cpp b/src/libcamera/pipeline/vimc/vimc.cpp\n> index 92b30f2e..e98adab6 100644\n> --- a/src/libcamera/pipeline/vimc/vimc.cpp\n> +++ b/src/libcamera/pipeline/vimc/vimc.cpp\n> @@ -571,6 +571,18 @@ void VimcCameraData::bufferReady(FrameBuffer *buffer)\n>  \trequest->metadata().set(controls::SensorTimestamp,\n>  \t\t\t\tbuffer->metadata().timestamp);\n>  \n> +\t/* If the buffer is cancelled force a complete of the whole request. */\n> +\tif (buffer->metadata().status == FrameMetadata::FrameCancelled) {\n> +\t\tfor (auto it : request->buffers()) {\n> +\t\t\tFrameBuffer *b = it.second;\n> +\t\t\tb->cancel();\n> +\t\t\tpipe_->completeBuffer(request, b);\n> +\t\t}\n> +\n> +\t\tpipe_->completeRequest(request);\n> +\t\treturn;\n> +\t}\n> +\n\nI'd move this before setting the SensorTimestamp, as timestamps are not\nrelevant for cancelled requests. Apart from this,\n\nReviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\n\n>  \tpipe_->completeBuffer(request, buffer);\n>  \tpipe_->completeRequest(request);\n>","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id B7E3FBD87C\n\tfor <parsemail@patchwork.libcamera.org>;\n\tMon, 16 Aug 2021 13:15:09 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 340F368893;\n\tMon, 16 Aug 2021 15:15:09 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id BFE346025D\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tMon, 16 Aug 2021 15:15:07 +0200 (CEST)","from pendragon.ideasonboard.com (62-78-145-57.bb.dnainternet.fi\n\t[62.78.145.57])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 4BE353E5;\n\tMon, 16 Aug 2021 15:15:07 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"U1zYmKFo\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1629119707;\n\tbh=8hZaCKZ8d3E8QbhErdXKK/DuVBbfyzRI00yBzc5go28=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=U1zYmKFoMzRggnGG0KZGcnswy2chYK6IRL7NAmmEzdvdGxMqWbz+sbDgQ55vg5d+L\n\tBMgoSxVOaBkBLXvZoSsS1vt7kHqv0OJfgnIPitZWTXKEsLLd0g2xmGG84pRRy+IWi7\n\t58Vj17jVsG7Mcrx8YOIgU03JfFsELtN7AbJHq9wA=","Date":"Mon, 16 Aug 2021 16:15:01 +0300","From":"Laurent Pinchart <laurent.pinchart@ideasonboard.com>","To":"Umang Jain <umang.jain@ideasonboard.com>","Message-ID":"<YRpk1QAJudppOzTB@pendragon.ideasonboard.com>","References":"<20210816130337.120053-1-umang.jain@ideasonboard.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20210816130337.120053-1-umang.jain@ideasonboard.com>","Subject":"Re: [libcamera-devel] [PATCH] pipeline: vimc: Force complete of\n\trequest on cancelled buffers","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","Cc":"libcamera-devel@lists.libcamera.org","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}},{"id":18838,"web_url":"https://patchwork.libcamera.org/comment/18838/","msgid":"<YRpuQR9n0BRH8xFI@pendragon.ideasonboard.com>","date":"2021-08-16T13:55:13","subject":"Re: [libcamera-devel] [PATCH] pipeline: vimc: Force complete of\n\trequest on cancelled buffers","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"On Mon, Aug 16, 2021 at 04:15:02PM +0300, Laurent Pinchart wrote:\n> Hi Umang,\n> \n> Thank you for the patch.\n> \n> On Mon, Aug 16, 2021 at 06:33:37PM +0530, Umang Jain wrote:\n> > When the stream is stopped, the V4L2VideoDevice sends back all\n> > the queued buffers with FrameMetadata::FrameCancelled status.\n> > It is the responsibility of the pipeline handler to handle\n> > these buffers with FrameMetadata::FrameCancelled. VIMC is\n> > currently missing this handling path.\n> > \n> > As the FrameMetadata::FrameCancelled is set when the stream is\n> > stopped, we can be sure that no more queued and re-use of request\n> > shall happen.  Hence, cancel all the requests' buffers force a\n> > complete with completeBuffer().\n> > \n> > The issue is caught by the gstreamer_single_stream_test.cpp running\n> > with vimc. During the check with meson built-in option\n> > \t'-Db_sanitize=address,undefined'\n> > it was observed:\n> > \n> > ==118003==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000037108 at pc 0x7f225160c9ac bp 0x7f224a47b620 sp 0x7f224a47b618\n> > READ of size 4 at 0x60e000037108 thread T1\n> >     #0 0x7f225160c9ab in libcamera::Request::sequence() const ../include/libcamera/request.h:55\n> >     #1 0x7f22518297aa in libcamera::VimcCameraData::bufferReady(libcamera::FrameBuffer*) ../src/libcamera/pipeline/vimc/vimc.cpp:577\n> >     #2 0x7f225183b1ef in libcamera::BoundMethodMember<libcamera::VimcCameraData, void, libcamera::FrameBuffer*>::activate(libcamera::FrameBuffer*, bool) ../include/libcamera/base/bound_method.h:194\n> >     #3 0x7f22515cc91f in libcamera::Signal<libcamera::FrameBuffer*>::emit(libcamera::FrameBuffer*) ../include/libcamera/base/signal.h:126\n> >     #4 0x7f22515c3305 in libcamera::V4L2VideoDevice::streamOff() ../src/libcamera/v4l2_videodevice.cpp:1605\n> >     #5 0x7f225181f345 in libcamera::PipelineHandlerVimc::stop(libcamera::Camera*) ../src/libcamera/pipeline/vimc/vimc.cpp:365\n> > \n> > The VimcCameraData::bufferReady seems to emit even after the stream\n> > is stopped. It's primarily due to vimc's lack of handling\n> > FrameMetadata::FrameCancelled in its pipeline handler.\n> > \n> > Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>\n> > ---\n> >  src/libcamera/pipeline/vimc/vimc.cpp | 12 ++++++++++++\n> >  1 file changed, 12 insertions(+)\n> > \n> > diff --git a/src/libcamera/pipeline/vimc/vimc.cpp b/src/libcamera/pipeline/vimc/vimc.cpp\n> > index 92b30f2e..e98adab6 100644\n> > --- a/src/libcamera/pipeline/vimc/vimc.cpp\n> > +++ b/src/libcamera/pipeline/vimc/vimc.cpp\n> > @@ -571,6 +571,18 @@ void VimcCameraData::bufferReady(FrameBuffer *buffer)\n> >  \trequest->metadata().set(controls::SensorTimestamp,\n> >  \t\t\t\tbuffer->metadata().timestamp);\n> >  \n> > +\t/* If the buffer is cancelled force a complete of the whole request. */\n> > +\tif (buffer->metadata().status == FrameMetadata::FrameCancelled) {\n> > +\t\tfor (auto it : request->buffers()) {\n> > +\t\t\tFrameBuffer *b = it.second;\n> > +\t\t\tb->cancel();\n> > +\t\t\tpipe_->completeBuffer(request, b);\n> > +\t\t}\n> > +\n> > +\t\tpipe_->completeRequest(request);\n> > +\t\treturn;\n> > +\t}\n> > +\n> \n> I'd move this before setting the SensorTimestamp, as timestamps are not\n> relevant for cancelled requests. Apart from this,\n> \n> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\n\nTested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\n\n> >  \tpipe_->completeBuffer(request, buffer);\n> >  \tpipe_->completeRequest(request);\n> >","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 88199BD87D\n\tfor <parsemail@patchwork.libcamera.org>;\n\tMon, 16 Aug 2021 13:55:21 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 1A0126025D;\n\tMon, 16 Aug 2021 15:55:21 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 9DBDC6025D\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tMon, 16 Aug 2021 15:55:19 +0200 (CEST)","from pendragon.ideasonboard.com (62-78-145-57.bb.dnainternet.fi\n\t[62.78.145.57])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 119CF3E5;\n\tMon, 16 Aug 2021 15:55:19 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"ZheLLasq\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1629122119;\n\tbh=YqWxeodwH35wdpjWte19Ll8CJ97zeJw0htlgs3p0d44=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=ZheLLasqNqRm/gsaWOa2Yn6ahAAIwKO9lCbx7XQCET6ZUkhzva5VBE74JRAiQVKET\n\trsWa+XpllTeFUhGWfm0WNECAVeQ6kKqbvVA4YcOwdnDF2dg5fHFgk+wFPfcrvKJMXf\n\tDO0j6ql9vLcsriMPNc92TzHqIx2bnUe1R5p1B/vU=","Date":"Mon, 16 Aug 2021 16:55:13 +0300","From":"Laurent Pinchart <laurent.pinchart@ideasonboard.com>","To":"Umang Jain <umang.jain@ideasonboard.com>","Message-ID":"<YRpuQR9n0BRH8xFI@pendragon.ideasonboard.com>","References":"<20210816130337.120053-1-umang.jain@ideasonboard.com>\n\t<YRpk1QAJudppOzTB@pendragon.ideasonboard.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<YRpk1QAJudppOzTB@pendragon.ideasonboard.com>","Subject":"Re: [libcamera-devel] [PATCH] pipeline: vimc: Force complete of\n\trequest on cancelled buffers","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","Cc":"libcamera-devel@lists.libcamera.org","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}},{"id":18842,"web_url":"https://patchwork.libcamera.org/comment/18842/","msgid":"<e247d2c9-dbf4-ad52-039d-5b5fb401916c@ideasonboard.com>","date":"2021-08-16T14:09:31","subject":"Re: [libcamera-devel] [PATCH] pipeline: vimc: Force complete of\n\trequest on cancelled buffers","submitter":{"id":4,"url":"https://patchwork.libcamera.org/api/people/4/","name":"Kieran Bingham","email":"kieran.bingham@ideasonboard.com"},"content":"Hi Umang,\n\nOn 16/08/2021 14:03, Umang Jain wrote:\n> When the stream is stopped, the V4L2VideoDevice sends back all\n> the queued buffers with FrameMetadata::FrameCancelled status.\n> It is the responsibility of the pipeline handler to handle\n> these buffers with FrameMetadata::FrameCancelled. VIMC is\n> currently missing this handling path.\n> \n> As the FrameMetadata::FrameCancelled is set when the stream is\n> stopped, we can be sure that no more queued and re-use of request\n> shall happen.  Hence, cancel all the requests' buffers force a\n> complete with completeBuffer().\n> \n> The issue is caught by the gstreamer_single_stream_test.cpp running\n> with vimc. During the check with meson built-in option\n> \t'-Db_sanitize=address,undefined'\n> it was observed:\n> \n> ==118003==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000037108 at pc 0x7f225160c9ac bp 0x7f224a47b620 sp 0x7f224a47b618\n> READ of size 4 at 0x60e000037108 thread T1\n>     #0 0x7f225160c9ab in libcamera::Request::sequence() const ../include/libcamera/request.h:55\n>     #1 0x7f22518297aa in libcamera::VimcCameraData::bufferReady(libcamera::FrameBuffer*) ../src/libcamera/pipeline/vimc/vimc.cpp:577\n>     #2 0x7f225183b1ef in libcamera::BoundMethodMember<libcamera::VimcCameraData, void, libcamera::FrameBuffer*>::activate(libcamera::FrameBuffer*, bool) ../include/libcamera/base/bound_method.h:194\n>     #3 0x7f22515cc91f in libcamera::Signal<libcamera::FrameBuffer*>::emit(libcamera::FrameBuffer*) ../include/libcamera/base/signal.h:126\n>     #4 0x7f22515c3305 in libcamera::V4L2VideoDevice::streamOff() ../src/libcamera/v4l2_videodevice.cpp:1605\n>     #5 0x7f225181f345 in libcamera::PipelineHandlerVimc::stop(libcamera::Camera*) ../src/libcamera/pipeline/vimc/vimc.cpp:365\n> \n> The VimcCameraData::bufferReady seems to emit even after the stream\n> is stopped. It's primarily due to vimc's lack of handling\n> FrameMetadata::FrameCancelled in its pipeline handler.\n> \n> Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>\n> ---\n>  src/libcamera/pipeline/vimc/vimc.cpp | 12 ++++++++++++\n>  1 file changed, 12 insertions(+)\n> \n> diff --git a/src/libcamera/pipeline/vimc/vimc.cpp b/src/libcamera/pipeline/vimc/vimc.cpp\n> index 92b30f2e..e98adab6 100644\n> --- a/src/libcamera/pipeline/vimc/vimc.cpp\n> +++ b/src/libcamera/pipeline/vimc/vimc.cpp\n> @@ -571,6 +571,18 @@ void VimcCameraData::bufferReady(FrameBuffer *buffer)\n>  \trequest->metadata().set(controls::SensorTimestamp,\n>  \t\t\t\tbuffer->metadata().timestamp);\n>  \n> +\t/* If the buffer is cancelled force a complete of the whole request. */\n> +\tif (buffer->metadata().status == FrameMetadata::FrameCancelled) {\n> +\t\tfor (auto it : request->buffers()) {\n> +\t\t\tFrameBuffer *b = it.second;\n> +\t\t\tb->cancel();\n> +\t\t\tpipe_->completeBuffer(request, b);\n> +\t\t}\n> +\n> +\t\tpipe_->completeRequest(request);\n> +\t\treturn;\n> +\t}\n> +\n\nReviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>\n\nI see this is the same location as in the IPU3, so I don't mind if it's\nhere or above the timestamp setting, as Laurent suggested.\n\nIf you make a v2 of this with the FrameCancelled check first, you might\nalso want to make a patch to move the handling in the\nIPU3CameraData::cio2BufferReady() to make it consistent, and check the\nothers too.\n\n--\nKieran\n\n\n\n\n>  \tpipe_->completeBuffer(request, buffer);\n>  \tpipe_->completeRequest(request);\n>  \n>","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 84771BD87D\n\tfor <parsemail@patchwork.libcamera.org>;\n\tMon, 16 Aug 2021 14:09:37 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id EF7F668894;\n\tMon, 16 Aug 2021 16:09:36 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 402866025D\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tMon, 16 Aug 2021 16:09:35 +0200 (CEST)","from [192.168.0.20]\n\t(cpc89244-aztw30-2-0-cust3082.18-1.cable.virginm.net [86.31.172.11])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id AEAA93E5;\n\tMon, 16 Aug 2021 16:09:34 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"UKQm1xr7\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1629122974;\n\tbh=2nNxpBv1vmhf8Rrn/noBF+0UcLZYhJtWyhY0ciCeMhg=;\n\th=To:References:From:Subject:Date:In-Reply-To:From;\n\tb=UKQm1xr7fRFDMO3gPRun15Wh5oYeLqf6d6emtjBAsNLJlL4tXudEl6ym0ZJGwk0t8\n\tOsmbeZjlyedKeEd2T7UpGaIkfImlviKDZnGR/cY6HKIRQwUxScJqGpw/+s+9MczUnZ\n\tn0DeUdzH26/p3G8uijdThZx5InV5JSIVi3UrRmb4=","To":"Umang Jain <umang.jain@ideasonboard.com>,\n\tlibcamera-devel@lists.libcamera.org","References":"<20210816130337.120053-1-umang.jain@ideasonboard.com>","From":"Kieran Bingham <kieran.bingham@ideasonboard.com>","Message-ID":"<e247d2c9-dbf4-ad52-039d-5b5fb401916c@ideasonboard.com>","Date":"Mon, 16 Aug 2021 15:09:31 +0100","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101\n\tThunderbird/78.11.0","MIME-Version":"1.0","In-Reply-To":"<20210816130337.120053-1-umang.jain@ideasonboard.com>","Content-Type":"text/plain; charset=utf-8","Content-Language":"en-GB","Content-Transfer-Encoding":"8bit","Subject":"Re: [libcamera-devel] [PATCH] pipeline: vimc: Force complete of\n\trequest on cancelled buffers","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}},{"id":18844,"web_url":"https://patchwork.libcamera.org/comment/18844/","msgid":"<46e491f7-ecf9-4762-f5ee-84d8a02758ee@ideasonboard.com>","date":"2021-08-16T14:20:58","subject":"Re: [libcamera-devel] [PATCH] pipeline: vimc: Force complete of\n\trequest on cancelled buffers","submitter":{"id":4,"url":"https://patchwork.libcamera.org/api/people/4/","name":"Kieran Bingham","email":"kieran.bingham@ideasonboard.com"},"content":"On 16/08/2021 15:09, Kieran Bingham wrote:\n> Hi Umang,\n> \n> On 16/08/2021 14:03, Umang Jain wrote:\n>> When the stream is stopped, the V4L2VideoDevice sends back all\n>> the queued buffers with FrameMetadata::FrameCancelled status.\n>> It is the responsibility of the pipeline handler to handle\n>> these buffers with FrameMetadata::FrameCancelled. VIMC is\n>> currently missing this handling path.\n>>\n>> As the FrameMetadata::FrameCancelled is set when the stream is\n>> stopped, we can be sure that no more queued and re-use of request\n>> shall happen.  Hence, cancel all the requests' buffers force a\n>> complete with completeBuffer().\n>>\n>> The issue is caught by the gstreamer_single_stream_test.cpp running\n>> with vimc. During the check with meson built-in option\n>> \t'-Db_sanitize=address,undefined'\n>> it was observed:\n>>\n>> ==118003==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000037108 at pc 0x7f225160c9ac bp 0x7f224a47b620 sp 0x7f224a47b618\n>> READ of size 4 at 0x60e000037108 thread T1\n>>     #0 0x7f225160c9ab in libcamera::Request::sequence() const ../include/libcamera/request.h:55\n>>     #1 0x7f22518297aa in libcamera::VimcCameraData::bufferReady(libcamera::FrameBuffer*) ../src/libcamera/pipeline/vimc/vimc.cpp:577\n>>     #2 0x7f225183b1ef in libcamera::BoundMethodMember<libcamera::VimcCameraData, void, libcamera::FrameBuffer*>::activate(libcamera::FrameBuffer*, bool) ../include/libcamera/base/bound_method.h:194\n>>     #3 0x7f22515cc91f in libcamera::Signal<libcamera::FrameBuffer*>::emit(libcamera::FrameBuffer*) ../include/libcamera/base/signal.h:126\n>>     #4 0x7f22515c3305 in libcamera::V4L2VideoDevice::streamOff() ../src/libcamera/v4l2_videodevice.cpp:1605\n>>     #5 0x7f225181f345 in libcamera::PipelineHandlerVimc::stop(libcamera::Camera*) ../src/libcamera/pipeline/vimc/vimc.cpp:365\n>>\n>> The VimcCameraData::bufferReady seems to emit even after the stream\n>> is stopped. It's primarily due to vimc's lack of handling\n>> FrameMetadata::FrameCancelled in its pipeline handler.\n>>\n>> Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>\n>> ---\n>>  src/libcamera/pipeline/vimc/vimc.cpp | 12 ++++++++++++\n>>  1 file changed, 12 insertions(+)\n>>\n>> diff --git a/src/libcamera/pipeline/vimc/vimc.cpp b/src/libcamera/pipeline/vimc/vimc.cpp\n>> index 92b30f2e..e98adab6 100644\n>> --- a/src/libcamera/pipeline/vimc/vimc.cpp\n>> +++ b/src/libcamera/pipeline/vimc/vimc.cpp\n>> @@ -571,6 +571,18 @@ void VimcCameraData::bufferReady(FrameBuffer *buffer)\n>>  \trequest->metadata().set(controls::SensorTimestamp,\n>>  \t\t\t\tbuffer->metadata().timestamp);\n>>  \n>> +\t/* If the buffer is cancelled force a complete of the whole request. */\n>> +\tif (buffer->metadata().status == FrameMetadata::FrameCancelled) {\n>> +\t\tfor (auto it : request->buffers()) {\n>> +\t\t\tFrameBuffer *b = it.second;\n>> +\t\t\tb->cancel();\n>> +\t\t\tpipe_->completeBuffer(request, b);\n>> +\t\t}\n>> +\n>> +\t\tpipe_->completeRequest(request);\n>> +\t\treturn;\n>> +\t}\n>> +\n> \n> Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>\n> \n\nMy tests are passing again locally, so also:\n\nTested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>\n\n\n> I see this is the same location as in the IPU3, so I don't mind if it's\n> here or above the timestamp setting, as Laurent suggested.\n> \n> If you make a v2 of this with the FrameCancelled check first, you might\n> also want to make a patch to move the handling in the\n> IPU3CameraData::cio2BufferReady() to make it consistent, and check the\n> others too.\n> \n> --\n> Kieran\n> \n> \n> \n> \n>>  \tpipe_->completeBuffer(request, buffer);\n>>  \tpipe_->completeRequest(request);\n>>  \n>>","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id B2AC9BD87D\n\tfor <parsemail@patchwork.libcamera.org>;\n\tMon, 16 Aug 2021 14:21:03 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id C725168894;\n\tMon, 16 Aug 2021 16:21:02 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id AC4C368891\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tMon, 16 Aug 2021 16:21:01 +0200 (CEST)","from [192.168.0.20]\n\t(cpc89244-aztw30-2-0-cust3082.18-1.cable.virginm.net [86.31.172.11])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 33BD33E5;\n\tMon, 16 Aug 2021 16:21:01 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"JMDX/Fh0\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1629123661;\n\tbh=jQwRtHE6MDzIIAaX5uA75M0lyJm1d3uQBsShUIDssIg=;\n\th=Subject:From:To:References:Reply-To:Date:In-Reply-To:From;\n\tb=JMDX/Fh0BqE8TGnsaWVL3ss+BRDYI14S0HVhCX79ddwdgLmyyb/FEkgTpeoBHSay7\n\tXOsCMBo6ZCbr+uEW7byrQZ4DHBIENUZ8hUxwjFV5qg4UgT5VURpQtsHgy2xroNmC19\n\tlfBGaipVVDqBn9Yfat3bRaFXkTf13mFJnKWb2jD8=","From":"Kieran Bingham <kieran.bingham@ideasonboard.com>","To":"Umang Jain <umang.jain@ideasonboard.com>,\n\tlibcamera-devel@lists.libcamera.org","References":"<20210816130337.120053-1-umang.jain@ideasonboard.com>\n\t<e247d2c9-dbf4-ad52-039d-5b5fb401916c@ideasonboard.com>","Organization":"Ideas on Board","Message-ID":"<46e491f7-ecf9-4762-f5ee-84d8a02758ee@ideasonboard.com>","Date":"Mon, 16 Aug 2021 15:20:58 +0100","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101\n\tThunderbird/78.11.0","MIME-Version":"1.0","In-Reply-To":"<e247d2c9-dbf4-ad52-039d-5b5fb401916c@ideasonboard.com>","Content-Type":"text/plain; charset=utf-8","Content-Language":"en-GB","Content-Transfer-Encoding":"7bit","Subject":"Re: [libcamera-devel] [PATCH] pipeline: vimc: Force complete of\n\trequest on cancelled buffers","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","Reply-To":"kieran.bingham@ideasonboard.com","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}}]