[{"id":23113,"web_url":"https://patchwork.libcamera.org/comment/23113/","msgid":"<20220520144713.n6kdlptnijai6ftt@uno.localdomain>","date":"2022-05-20T14:47:13","subject":"Re: [libcamera-devel] [PATCH] pipeline: raspberrypi: Fix possible\n\tnull dereference","submitter":{"id":3,"url":"https://patchwork.libcamera.org/api/people/3/","name":"Jacopo Mondi","email":"jacopo@jmondi.org"},"content":"Hi Naush,\n\nOn Fri, May 20, 2022 at 01:49:19PM +0100, Naushir Patuck via libcamera-devel wrote:\n> The freeBuffers() cleanup code calls into the IPA to unmap and free shared\n> buffers. However, this function could be called before the IPA has opened (via\n> registerCamera()), causing a segmentation fault. Fix this by guarding against\n> calling the IPA if it has not been opened.\n>\n> Signed-off-by: Naushir Patuck <naush@raspberrypi.com>\n\nReviewed-by: Jacopo Mondi <jacopo@jmondi.org>\n\nThanks\n   j\n\n> ---\n>  src/libcamera/pipeline/raspberrypi/raspberrypi.cpp | 10 ++++++----\n>  1 file changed, 6 insertions(+), 4 deletions(-)\n>\n> diff --git a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> index 2636acb758b7..26cd4e5f2b99 100644\n> --- a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> +++ b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> @@ -1484,10 +1484,12 @@ void PipelineHandlerRPi::mapBuffers(Camera *camera, const RPi::BufferMap &buffer\n>\n>  void RPiCameraData::freeBuffers()\n>  {\n> -\t/* Copy the buffer ids from the unordered_set to a vector to pass to the IPA. */\n> -\tstd::vector<unsigned int> ipaBuffers(ipaBuffers_.begin(), ipaBuffers_.end());\n> -\tipa_->unmapBuffers(ipaBuffers);\n> -\tipaBuffers_.clear();\n> +\tif (ipa_) {\n> +\t\t/* Copy the buffer ids from the unordered_set to a vector to pass to the IPA. */\n> +\t\tstd::vector<unsigned int> ipaBuffers(ipaBuffers_.begin(), ipaBuffers_.end());\n> +\t\tipa_->unmapBuffers(ipaBuffers);\n> +\t\tipaBuffers_.clear();\n> +\t}\n>\n>  \tfor (auto const stream : streams_)\n>  \t\tstream->releaseBuffers();\n> --\n> 2.34.1\n>","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id B5E9EC0F2A\n\tfor <parsemail@patchwork.libcamera.org>;\n\tFri, 20 May 2022 14:47:18 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id D494965663;\n\tFri, 20 May 2022 16:47:17 +0200 (CEST)","from relay12.mail.gandi.net (relay12.mail.gandi.net\n\t[217.70.178.232])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 5EB8760440\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tFri, 20 May 2022 16:47:16 +0200 (CEST)","(Authenticated sender: jacopo@jmondi.org)\n\tby mail.gandi.net (Postfix) with ESMTPSA id B0F5320000D;\n\tFri, 20 May 2022 14:47:15 +0000 (UTC)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=libcamera.org;\n\ts=mail; t=1653058037;\n\tbh=vAEgeP9bQR5fJiZBF2rpZHbp6BAbNdUSBKUhgiKOV+Q=;\n\th=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe:\n\tList-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc:\n\tFrom;\n\tb=nGJ7NsECr+oN6agp48PwT3us123TTYPzPzu+rCQGcMwyZVBnKKRiRaz98ki03IKE2\n\to3QGCTrVOTYFBxS/0AC+078uN480CIQxgscDjG6e6Pkub+KZFGe8hjluPiSLzFuMP7\n\tQNOQSFqCKOc6peeRLlD89dBsEELL0cacmAKBwN7/d07oc4ytPTxd/+I6gujAw7OkYV\n\tUt7A2pxhTMotRwEWdm4kXstfvox3HSaXTzCAvA2dK8Z19PSvM5Az3kYqUFuhjPPpwc\n\tk8UBIh42z0YdLgN7g3eWnKJ9wiBeLboKLiySn9qC4oYU1/xqehIozYGZTNxyFf+RDL\n\t7GLBW1vE7hHig==","Date":"Fri, 20 May 2022 16:47:13 +0200","To":"Naushir Patuck <naush@raspberrypi.com>","Message-ID":"<20220520144713.n6kdlptnijai6ftt@uno.localdomain>","References":"<20220520124919.2873559-1-naush@raspberrypi.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20220520124919.2873559-1-naush@raspberrypi.com>","Subject":"Re: [libcamera-devel] [PATCH] pipeline: raspberrypi: Fix possible\n\tnull dereference","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","From":"Jacopo Mondi via libcamera-devel <libcamera-devel@lists.libcamera.org>","Reply-To":"Jacopo Mondi <jacopo@jmondi.org>","Cc":"libcamera-devel@lists.libcamera.org","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}},{"id":23129,"web_url":"https://patchwork.libcamera.org/comment/23129/","msgid":"<Yop0FyycUjJCb6oc@pendragon.ideasonboard.com>","date":"2022-05-22T17:34:15","subject":"Re: [libcamera-devel] [PATCH] pipeline: raspberrypi: Fix possible\n\tnull dereference","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"Hi Naush,\n\nThank you for the patch.\n\nOn Fri, May 20, 2022 at 01:49:19PM +0100, Naushir Patuck via libcamera-devel wrote:\n> The freeBuffers() cleanup code calls into the IPA to unmap and free shared\n> buffers. However, this function could be called before the IPA has opened (via\n> registerCamera()), causing a segmentation fault. Fix this by guarding against\n> calling the IPA if it has not been opened.\n> \n> Signed-off-by: Naushir Patuck <naush@raspberrypi.com>\n> ---\n>  src/libcamera/pipeline/raspberrypi/raspberrypi.cpp | 10 ++++++----\n>  1 file changed, 6 insertions(+), 4 deletions(-)\n> \n> diff --git a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> index 2636acb758b7..26cd4e5f2b99 100644\n> --- a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> +++ b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> @@ -1484,10 +1484,12 @@ void PipelineHandlerRPi::mapBuffers(Camera *camera, const RPi::BufferMap &buffer\n>  \n>  void RPiCameraData::freeBuffers()\n>  {\n> -\t/* Copy the buffer ids from the unordered_set to a vector to pass to the IPA. */\n> -\tstd::vector<unsigned int> ipaBuffers(ipaBuffers_.begin(), ipaBuffers_.end());\n> -\tipa_->unmapBuffers(ipaBuffers);\n> -\tipaBuffers_.clear();\n> +\tif (ipa_) {\n> +\t\t/* Copy the buffer ids from the unordered_set to a vector to pass to the IPA. */\n> +\t\tstd::vector<unsigned int> ipaBuffers(ipaBuffers_.begin(), ipaBuffers_.end());\n\nI'll wrap this when applying.\n\nReviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\n\n> +\t\tipa_->unmapBuffers(ipaBuffers);\n> +\t\tipaBuffers_.clear();\n> +\t}\n>  \n>  \tfor (auto const stream : streams_)\n>  \t\tstream->releaseBuffers();","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 590C0BD160\n\tfor <parsemail@patchwork.libcamera.org>;\n\tSun, 22 May 2022 17:34:24 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id BFF0E65663;\n\tSun, 22 May 2022 19:34:23 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id A879C60419\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tSun, 22 May 2022 19:34:22 +0200 (CEST)","from pendragon.ideasonboard.com (unknown [86.8.200.222])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id A5C10563;\n\tSun, 22 May 2022 19:34:21 +0200 (CEST)"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/simple; d=libcamera.org;\n\ts=mail; t=1653240863;\n\tbh=B65+1qzp1y7CJHyEkq8dl/qdB/deTBKFZUX7gGcD+0Y=;\n\th=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe:\n\tList-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc:\n\tFrom;\n\tb=Uv+LylsFdTnIHkXhkPU2dugy1K8cWVFE82w1vyyKi/C63f/bslUBZvv6bQVwgxBhM\n\tfvf7pGERqM1Q7GT2IBdtHm+kMl6kpov0zxbj+5JK8fYG1xtHPAEA5aKKMFvJPwW0dW\n\tcF4MTqcjN3oysPJXi3m9A2j0xBsb1a6OowI/B/kfunvua79g1VxYlgftZ4/z3HmiO9\n\tDBNcn7ErUmJoxM6ebnZVAHPkA5w1P3VXCu7pGFJhC6Y4156KbyUwwot0x2Tyzp7cAH\n\tBOVwCJiZ8XvAA4qzVY6jIkcqPtKuzewjOVnsQnF4GHjfUDDEVmg2Tnc9nzdvYUx9gY\n\txAa8980iKbSvw==","v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1653240862;\n\tbh=B65+1qzp1y7CJHyEkq8dl/qdB/deTBKFZUX7gGcD+0Y=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=nnIsl28s/KE3l/gokgdh1OpPC4r4KCv49k+NGa97T61xIkAMjjA+HdyfNeQKjgMBK\n\ta/hADlAsJJPmG9+U0ufCQvF5oEBMoRycz9PuxoL257NWzPT1UiNyGuaYACZENQtT5l\n\t4NlufiBn2OVjf6gNJHqMDXyLbJTeOqKnOqgEOo/4="],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key; \n\tunprotected) header.d=ideasonboard.com\n\theader.i=@ideasonboard.com\n\theader.b=\"nnIsl28s\"; dkim-atps=neutral","Date":"Sun, 22 May 2022 20:34:15 +0300","To":"Naushir Patuck <naush@raspberrypi.com>","Message-ID":"<Yop0FyycUjJCb6oc@pendragon.ideasonboard.com>","References":"<20220520124919.2873559-1-naush@raspberrypi.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20220520124919.2873559-1-naush@raspberrypi.com>","Subject":"Re: [libcamera-devel] [PATCH] pipeline: raspberrypi: Fix possible\n\tnull dereference","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","From":"Laurent Pinchart via libcamera-devel\n\t<libcamera-devel@lists.libcamera.org>","Reply-To":"Laurent Pinchart <laurent.pinchart@ideasonboard.com>","Cc":"libcamera-devel@lists.libcamera.org","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}},{"id":23132,"web_url":"https://patchwork.libcamera.org/comment/23132/","msgid":"<165329109142.4190441.1688696432283456926@Monstersaurus>","date":"2022-05-23T07:31:31","subject":"Re: [libcamera-devel] [PATCH] pipeline: raspberrypi: Fix possible\n\tnull dereference","submitter":{"id":4,"url":"https://patchwork.libcamera.org/api/people/4/","name":"Kieran Bingham","email":"kieran.bingham@ideasonboard.com"},"content":"Quoting Laurent Pinchart via libcamera-devel (2022-05-22 18:34:15)\n> Hi Naush,\n> \n> Thank you for the patch.\n> \n> On Fri, May 20, 2022 at 01:49:19PM +0100, Naushir Patuck via libcamera-devel wrote:\n> > The freeBuffers() cleanup code calls into the IPA to unmap and free shared\n> > buffers. However, this function could be called before the IPA has opened (via\n> > registerCamera()), causing a segmentation fault. Fix this by guarding against\n> > calling the IPA if it has not been opened.\n> > \n> > Signed-off-by: Naushir Patuck <naush@raspberrypi.com>\n> > ---\n> >  src/libcamera/pipeline/raspberrypi/raspberrypi.cpp | 10 ++++++----\n> >  1 file changed, 6 insertions(+), 4 deletions(-)\n> > \n> > diff --git a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> > index 2636acb758b7..26cd4e5f2b99 100644\n> > --- a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> > +++ b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> > @@ -1484,10 +1484,12 @@ void PipelineHandlerRPi::mapBuffers(Camera *camera, const RPi::BufferMap &buffer\n> >  \n> >  void RPiCameraData::freeBuffers()\n> >  {\n> > -     /* Copy the buffer ids from the unordered_set to a vector to pass to the IPA. */\n> > -     std::vector<unsigned int> ipaBuffers(ipaBuffers_.begin(), ipaBuffers_.end());\n> > -     ipa_->unmapBuffers(ipaBuffers);\n> > -     ipaBuffers_.clear();\n> > +     if (ipa_) {\n> > +             /* Copy the buffer ids from the unordered_set to a vector to pass to the IPA. */\n> > +             std::vector<unsigned int> ipaBuffers(ipaBuffers_.begin(), ipaBuffers_.end());\n> \n> I'll wrap this when applying.\n> \n> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\n\n\nReviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>\n\nCan this be handled more generically by the interface layer between the\nIPA? (Doesn't need to be done for this patch), but it seems like\nsomething that could occur in other places (/pipelines) too.\n\n--\nKieran\n\n> \n> > +             ipa_->unmapBuffers(ipaBuffers);\n> > +             ipaBuffers_.clear();\n> > +     }\n> >  \n> >       for (auto const stream : streams_)\n> >               stream->releaseBuffers();\n> \n> -- \n> Regards,\n> \n> Laurent Pinchart","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 19F13BD161\n\tfor <parsemail@patchwork.libcamera.org>;\n\tMon, 23 May 2022 07:31:37 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 14C2765664;\n\tMon, 23 May 2022 09:31:36 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 5518E6565E\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tMon, 23 May 2022 09:31:34 +0200 (CEST)","from pendragon.ideasonboard.com\n\t(cpc89244-aztw30-2-0-cust3082.18-1.cable.virginm.net [86.31.172.11])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id D8ACA45F;\n\tMon, 23 May 2022 09:31:33 +0200 (CEST)"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/simple; d=libcamera.org;\n\ts=mail; t=1653291096;\n\tbh=Q1bcIy1HQw6t9Lmja/P2pNiGml65EDo+QUjNm4lO5Y0=;\n\th=In-Reply-To:References:To:Date:Subject:List-Id:List-Unsubscribe:\n\tList-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc:\n\tFrom;\n\tb=PG93EkZ8fE5MFGQVjZj9UDOlEGbMqW+36bPzGasWtXVy4ncS+WNn/Gd3RlNt3BSr4\n\tGveoEw7SNDCxPKYl1jitCd2Jz18SwARRt9Xw5vz3TcGneBBnyM7aj8Ok1W66UqP1cr\n\tWKbzJ6cadTXiQM3Y/Pi9p/UZiOd/DBkNpI8KGHsFIxPc3hBcYGdIigJOl3qqNn+cpW\n\tiwZVXGrs0scCMiWRTCg1LWh3GzzhJ3rU9MQhTCpr4L6nX7ytueovMv/Tjnt8o6H2gU\n\t4NC9LytpijVULlyGuJBA5Gt6gKYDvIqaJcm/9SfWzQmus8i1F/UVArS4VDHkDcLShW\n\tXr51ph8yOGYsA==","v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1653291093;\n\tbh=Q1bcIy1HQw6t9Lmja/P2pNiGml65EDo+QUjNm4lO5Y0=;\n\th=In-Reply-To:References:Subject:From:Cc:To:Date:From;\n\tb=i24cdFHeX4uZf4xjnAL/0yhM8QMF4fLSuCBhXzuWveHMWDIs6po8IFNGeOdX+m2M0\n\tpOZiDg5kEvDIEO4TuWxIZGX6vGlcPy+x8Z1vi8oyIWM7wgduBIKgjGRI8Xobojvhbm\n\tXVWRbrPRlZJoRtEVopU5d6Y8IffT38HoV4oZ8Od0="],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key; \n\tunprotected) header.d=ideasonboard.com\n\theader.i=@ideasonboard.com\n\theader.b=\"i24cdFHe\"; dkim-atps=neutral","Content-Type":"text/plain; charset=\"utf-8\"","MIME-Version":"1.0","Content-Transfer-Encoding":"quoted-printable","In-Reply-To":"<Yop0FyycUjJCb6oc@pendragon.ideasonboard.com>","References":"<20220520124919.2873559-1-naush@raspberrypi.com>\n\t<Yop0FyycUjJCb6oc@pendragon.ideasonboard.com>","To":"Laurent Pinchart <laurent.pinchart@ideasonboard.com>,\n\tLaurent Pinchart via libcamera-devel\n\t<libcamera-devel@lists.libcamera.org>, \n\tNaushir Patuck <naush@raspberrypi.com>","Date":"Mon, 23 May 2022 08:31:31 +0100","Message-ID":"<165329109142.4190441.1688696432283456926@Monstersaurus>","User-Agent":"alot/0.10","Subject":"Re: [libcamera-devel] [PATCH] pipeline: raspberrypi: Fix possible\n\tnull dereference","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","From":"Kieran Bingham via libcamera-devel\n\t<libcamera-devel@lists.libcamera.org>","Reply-To":"Kieran Bingham <kieran.bingham@ideasonboard.com>","Cc":"libcamera-devel@lists.libcamera.org","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}},{"id":23133,"web_url":"https://patchwork.libcamera.org/comment/23133/","msgid":"<CAEmqJPrwyL0qGkWzt8E_6NFFwEFNc3K=NiE2SRJmw-TNvOGdrg@mail.gmail.com>","date":"2022-05-23T07:34:54","subject":"Re: [libcamera-devel] [PATCH] pipeline: raspberrypi: Fix possible\n\tnull dereference","submitter":{"id":34,"url":"https://patchwork.libcamera.org/api/people/34/","name":"Naushir Patuck","email":"naush@raspberrypi.com"},"content":"Hi Kieran,\n\nThank you for the review!\n\nOn Mon, 23 May 2022 at 08:31, Kieran Bingham <\nkieran.bingham@ideasonboard.com> wrote:\n\n> Quoting Laurent Pinchart via libcamera-devel (2022-05-22 18:34:15)\n> > Hi Naush,\n> >\n> > Thank you for the patch.\n> >\n> > On Fri, May 20, 2022 at 01:49:19PM +0100, Naushir Patuck via\n> libcamera-devel wrote:\n> > > The freeBuffers() cleanup code calls into the IPA to unmap and free\n> shared\n> > > buffers. However, this function could be called before the IPA has\n> opened (via\n> > > registerCamera()), causing a segmentation fault. Fix this by guarding\n> against\n> > > calling the IPA if it has not been opened.\n> > >\n> > > Signed-off-by: Naushir Patuck <naush@raspberrypi.com>\n> > > ---\n> > >  src/libcamera/pipeline/raspberrypi/raspberrypi.cpp | 10 ++++++----\n> > >  1 file changed, 6 insertions(+), 4 deletions(-)\n> > >\n> > > diff --git a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> > > index 2636acb758b7..26cd4e5f2b99 100644\n> > > --- a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> > > +++ b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp\n> > > @@ -1484,10 +1484,12 @@ void PipelineHandlerRPi::mapBuffers(Camera\n> *camera, const RPi::BufferMap &buffer\n> > >\n> > >  void RPiCameraData::freeBuffers()\n> > >  {\n> > > -     /* Copy the buffer ids from the unordered_set to a vector to\n> pass to the IPA. */\n> > > -     std::vector<unsigned int> ipaBuffers(ipaBuffers_.begin(),\n> ipaBuffers_.end());\n> > > -     ipa_->unmapBuffers(ipaBuffers);\n> > > -     ipaBuffers_.clear();\n> > > +     if (ipa_) {\n> > > +             /* Copy the buffer ids from the unordered_set to a\n> vector to pass to the IPA. */\n> > > +             std::vector<unsigned int>\n> ipaBuffers(ipaBuffers_.begin(), ipaBuffers_.end());\n> >\n> > I'll wrap this when applying.\n> >\n> > Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\n>\n>\n> Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>\n>\n> Can this be handled more generically by the interface layer between the\n> IPA? (Doesn't need to be done for this patch), but it seems like\n> something that could occur in other places (/pipelines) too.\n>\n\nIn this particular instance, I don't think so.  The ipa_ variable itself is\nuninitialised\nat this point, so the IPA interface doesn't even exist yet :)\n\nI'm sure in other cases, errors like this could be handled in the interface\nlayer.\n\nRegards,\nNaush\n\n\n\n>\n> --\n> Kieran\n>\n> >\n> > > +             ipa_->unmapBuffers(ipaBuffers);\n> > > +             ipaBuffers_.clear();\n> > > +     }\n> > >\n> > >       for (auto const stream : streams_)\n> > >               stream->releaseBuffers();\n> >\n> > --\n> > Regards,\n> >\n> > Laurent Pinchart\n>","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id F10BFBD160\n\tfor <parsemail@patchwork.libcamera.org>;\n\tMon, 23 May 2022 07:35:16 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 5955765666;\n\tMon, 23 May 2022 09:35:16 +0200 (CEST)","from mail-lf1-x12c.google.com (mail-lf1-x12c.google.com\n\t[IPv6:2a00:1450:4864:20::12c])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 936F86565E\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tMon, 23 May 2022 09:35:11 +0200 (CEST)","by mail-lf1-x12c.google.com with SMTP id bu29so24131931lfb.0\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tMon, 23 May 2022 00:35:11 -0700 (PDT)"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/simple; d=libcamera.org;\n\ts=mail; t=1653291316;\n\tbh=NViw6aeGL9jPUZ0QHmWe+ZxhURMDxNseYY+rpKSiMCc=;\n\th=References:In-Reply-To:Date:To:Subject:List-Id:List-Unsubscribe:\n\tList-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc:\n\tFrom;\n\tb=1J3aSm+DVlzsz86/1uy9qEb9fyXad0pKRPt7KNqKOktTpk3gjwZDGZO83jQbrv1XI\n\tRuHKczqRyogjU7MEDPuOkFX1YCga2kul4BCSbuvA6CljyTUPjBqaKfzH5pMgYdEG4W\n\tfrUB5mWw6/Hd6YcXvuuBnl+4i4YssVszzrX8OqMZdoamwlfogbKstTXjH3kyWtt7Hc\n\tNF6ut8EIiH6w04S/XSGfdhL46QPt90+VsqV3Sjr0fIFpne0L6A+JKF2X3y7lQ8YaIf\n\teoW+rjV7lVd8GSBQw6KsAKvfPlXfOGVn4ietf4Hd8U3YMYT6pEV7xYJSyT+Oc1telv\n\t9yzpl/RSxRV5Q==","v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=raspberrypi.com; s=google;\n\th=mime-version:references:in-reply-to:from:date:message-id:subject:to\n\t:cc; bh=Vg+lrt4fSN9N7rFjCwwLJ7ByUD4Ax0s96n1jVkFYJV0=;\n\tb=IFR/XMJhdfo4PtwGjjrF27PXWEi7WposRPom2ezJKCYMabn3M8e+FPWR3K5UesZ6Zb\n\tG+xC9VdYSHN/pKpKcPp+iGdfGI1TdpbNBKcC3K7csy439ZmDd6Vi4jDYAirKEDDC6Vpr\n\tII6FWQ1Mi395hvavEIkl53PM3cCclfCZdh3RSVae+V8sYYITOPXOUx3NehJSucz/64tu\n\tAvxjG86o+oshlU2QtN9+VM9fybahzV1gMvGmlfMuSVQxoM5s/u7z1M8fpk1MQZCd+V7m\n\t+kBypAmxeeVyT/jwWBKCOZxisUwsoj05g74ahI/YkXp67vKJ8YjHklrg8Y65yFbsWTkX\n\tgVPQ=="],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (2048-bit key; \n\tunprotected) header.d=raspberrypi.com\n\theader.i=@raspberrypi.com\n\theader.b=\"IFR/XMJh\"; dkim-atps=neutral","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20210112;\n\th=x-gm-message-state:mime-version:references:in-reply-to:from:date\n\t:message-id:subject:to:cc;\n\tbh=Vg+lrt4fSN9N7rFjCwwLJ7ByUD4Ax0s96n1jVkFYJV0=;\n\tb=1IJJSjVmofOyn7o7/PNj0AJiqy7zD5UZ7VW5ie2cFb2sg2FjybBHcO4VWHLlvfQHO2\n\tCRSmPo887EoBv7Ex+hpuzkZnPOgzFUwRdS79TcU8D5NBlWaRtPsdWjiVTWAcR7n6Y3S/\n\thF4EwS8X+WFAl9ss3TKhenfP8KTHaCOjtishM40VEslqoxOawNWFhJuc6HTr9gcH1VS0\n\t61gVhKObA4DkkIF0DE3kI8s9iuJuV7TCfSNAiYJsIyxTcyw/PDYs31SyQR37bIsMZK/K\n\ti1rP60cSl17SAS7O50tZnQXtz+3PTlh0Z+o/vZCY8QCrR6D0TT38+tSbZI/9CBUiyWwT\n\t3P8A==","X-Gm-Message-State":"AOAM530XeUYiR0tJdCWsYbBR7znRT/GBLpXaDIeZPs3omp/DqOH6H2zK\n\tx4ametjKIHuEPgY9ZUu0RcknKP2+3h4Ksgemc7sQpA==","X-Google-Smtp-Source":"ABdhPJwr156IgR2yb4jY1+8hOMb/U71F4jq1GvMbOmGrcXLwH99a+pPTBB1Dp6Gwv33kHXcEWS6qAD46T+gdbaEHBMI=","X-Received":"by 2002:a05:6512:131d:b0:477:9d81:7f17 with SMTP id\n\tx29-20020a056512131d00b004779d817f17mr15840958lfu.63.1653291310773;\n\tMon, 23 May 2022 00:35:10 -0700 (PDT)","MIME-Version":"1.0","References":"<20220520124919.2873559-1-naush@raspberrypi.com>\n\t<Yop0FyycUjJCb6oc@pendragon.ideasonboard.com>\n\t<165329109142.4190441.1688696432283456926@Monstersaurus>","In-Reply-To":"<165329109142.4190441.1688696432283456926@Monstersaurus>","Date":"Mon, 23 May 2022 08:34:54 +0100","Message-ID":"<CAEmqJPrwyL0qGkWzt8E_6NFFwEFNc3K=NiE2SRJmw-TNvOGdrg@mail.gmail.com>","To":"Kieran Bingham <kieran.bingham@ideasonboard.com>","Content-Type":"multipart/alternative; boundary=\"0000000000004a0cc105dfa8e1ed\"","Subject":"Re: [libcamera-devel] [PATCH] pipeline: raspberrypi: Fix possible\n\tnull dereference","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","From":"Naushir Patuck via libcamera-devel\n\t<libcamera-devel@lists.libcamera.org>","Reply-To":"Naushir Patuck <naush@raspberrypi.com>","Cc":"Laurent Pinchart via libcamera-devel\n\t<libcamera-devel@lists.libcamera.org>","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}}]