[{"id":5253,"web_url":"https://patchwork.libcamera.org/comment/5253/","msgid":"<20200617154054.uqg5jt5vxupp2s3b@uno.localdomain>","date":"2020-06-17T15:40:54","subject":"Re: [libcamera-devel] [PATCH 13/15] v4l2: v4l2_camera: Clear\n\tpending requests on freeBuffers","submitter":{"id":3,"url":"https://patchwork.libcamera.org/api/people/3/","name":"Jacopo Mondi","email":"jacopo@jmondi.org"},"content":"Hi Paul,\n\nOn Tue, Jun 16, 2020 at 10:12:42PM +0900, Paul Elder wrote:\n> V4L2 allows buffer queueing before streamon while libcamera does not.\n> The compatibility layer thus saves these buffers in a pending queue\n> until streamon, and then automatically queues them. However, this\n> pending queue is not cleared when the buffers a freed, so if buffers are\n\ns/a freed/are freed.\n\n> queued, the stream is not started, buffers are freed, more buffers are\n> queued, and the stream is finally started, then the first set of buffers\n> will be used-after-free. Fix this by clearing the pending quest queue\n> upon the buffers being freed.\n>\n> Signed-off-by: Paul Elder \n\nShould this happen at streamoff time as well ?\nGot a bit lost :)\n\nOtherwise\nReviewed-by: Jacopo Mondi \n\nThanks\n j\n\n> ---\n> src/v4l2/v4l2_camera.cpp | 1 +\n> 1 file changed, 1 insertion(+)\n>\n> diff --git a/src/v4l2/v4l2_camera.cpp b/src/v4l2/v4l2_camera.cpp\n> index f0ec54b..bae270a 100644\n> --- a/src/v4l2/v4l2_camera.cpp\n> +++ b/src/v4l2/v4l2_camera.cpp\n> @@ -155,6 +155,7 @@ void V4L2Camera::freeBuffers()\n> \tStream *stream = *camera_->streams().begin();\n>\n> \tbufferAllocator_->free(stream);\n> +\tpendingRequests_.clear();\n> }\n>\n> FileDescriptor V4L2Camera::getBufferFd(unsigned int index)\n> --\n> 2.27.0\n>\n> _______________________________________________\n> libcamera-devel mailing list\n> libcamera-devel@lists.libcamera.org\n> https://lists.libcamera.org/listinfo/libcamera-devel","headers":{"Return-Path":"","Received":["from relay3-d.mail.gandi.net (relay3-d.mail.gandi.net\n\t[217.70.183.195])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 52E95603BF\n\tfor ;\n\tWed, 17 Jun 2020 17:37:45 +0200 (CEST)","from uno.localdomain (93-34-118-233.ip49.fastwebnet.it\n\t[93.34.118.233]) (Authenticated sender: jacopo@jmondi.org)\n\tby relay3-d.mail.gandi.net (Postfix) with ESMTPSA id CD8E860014;\n\tWed, 17 Jun 2020 15:37:44 +0000 (UTC)"],"X-Originating-IP":"93.34.118.233","Date":"Wed, 17 Jun 2020 17:40:54 +0200","From":"Jacopo Mondi ","To":"Paul Elder ","Cc":"libcamera-devel@lists.libcamera.org","Message-ID":"<20200617154054.uqg5jt5vxupp2s3b@uno.localdomain>","References":"<20200616131244.70308-1-paul.elder@ideasonboard.com>\n\t<20200616131244.70308-14-paul.elder@ideasonboard.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20200616131244.70308-14-paul.elder@ideasonboard.com>","Subject":"Re: [libcamera-devel] [PATCH 13/15] v4l2: v4l2_camera: Clear\n\tpending requests on freeBuffers","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","X-List-Received-Date":"Wed, 17 Jun 2020 15:37:45 -0000"}},{"id":5271,"web_url":"https://patchwork.libcamera.org/comment/5271/","msgid":"<20200618092026.GC2095@jade.amanokami.net>","date":"2020-06-18T09:20:26","subject":"Re: [libcamera-devel] [PATCH 13/15] v4l2: v4l2_camera: Clear\n\tpending requests on freeBuffers","submitter":{"id":17,"url":"https://patchwork.libcamera.org/api/people/17/","name":"Paul Elder","email":"paul.elder@ideasonboard.com"},"content":"On Wed, Jun 17, 2020 at 05:40:54PM +0200, Jacopo Mondi wrote:\n> Hi Paul,\n> \n> On Tue, Jun 16, 2020 at 10:12:42PM +0900, Paul Elder wrote:\n> > V4L2 allows buffer queueing before streamon while libcamera does not.\n> > The compatibility layer thus saves these buffers in a pending queue\n> > until streamon, and then automatically queues them. However, this\n> > pending queue is not cleared when the buffers a freed, so if buffers are\n> \n> s/a freed/are freed.\n> \n> > queued, the stream is not started, buffers are freed, more buffers are\n> > queued, and the stream is finally started, then the first set of buffers\n> > will be used-after-free. Fix this by clearing the pending quest queue\n> > upon the buffers being freed.\n> >\n> > Signed-off-by: Paul Elder \n> \n> Should this happen at streamoff time as well ?\n\nOh you're right yeah, it should.\n\n> Got a bit lost :)\n\nI'll try to clarify it.\n\n> Otherwise\n> Reviewed-by: Jacopo Mondi \n> \n\n\nThanks,\n\nPaul\n> > ---\n> > src/v4l2/v4l2_camera.cpp | 1 +\n> > 1 file changed, 1 insertion(+)\n> >\n> > diff --git a/src/v4l2/v4l2_camera.cpp b/src/v4l2/v4l2_camera.cpp\n> > index f0ec54b..bae270a 100644\n> > --- a/src/v4l2/v4l2_camera.cpp\n> > +++ b/src/v4l2/v4l2_camera.cpp\n> > @@ -155,6 +155,7 @@ void V4L2Camera::freeBuffers()\n> > \tStream *stream = *camera_->streams().begin();\n> >\n> > \tbufferAllocator_->free(stream);\n> > +\tpendingRequests_.clear();\n> > }\n> >\n> > FileDescriptor V4L2Camera::getBufferFd(unsigned int index)\n> > --\n> > 2.27.0\n> >\n> > _______________________________________________\n> > libcamera-devel mailing list\n> > libcamera-devel@lists.libcamera.org\n> > https://lists.libcamera.org/listinfo/libcamera-devel","headers":{"Return-Path":"","Received":["from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id D156061E77\n\tfor ;\n\tThu, 18 Jun 2020 11:20:36 +0200 (CEST)","from jade.amanokami.net (unknown\n\t[IPv6:2400:4051:61:600:a17c:96b8:ddb0:63b7])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 2CB42F9;\n\tThu, 18 Jun 2020 11:20:34 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key; \n\tunprotected) header.d=ideasonboard.com\n\theader.i=@ideasonboard.com\n\theader.b=\"EtewOcWo\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1592472036;\n\tbh=kskGRyYLCMqv8eRfNrYl81S+lhEP2hCAAgDgBopBJfw=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=EtewOcWo+XeyfVcdGXdO1t8AmajDXy6WYJvmLQtlWjJUds6wXdrI//KvP6IsiXqj+\n\tr0HvDcxR//EYzw1J5GsMBS3j1ToIPP5HIqP9mxXce1fhq+rz3x3mJ0GFihQtpwZZUX\n\tqCpRQlKXilvhkBKc6HEvIOkVLFNlmGeqQVVLJ8PA=","Date":"Thu, 18 Jun 2020 18:20:26 +0900","From":"Paul Elder ","To":"Jacopo Mondi ","Cc":"libcamera-devel@lists.libcamera.org","Message-ID":"<20200618092026.GC2095@jade.amanokami.net>","References":"<20200616131244.70308-1-paul.elder@ideasonboard.com>\n\t<20200616131244.70308-14-paul.elder@ideasonboard.com>\n\t<20200617154054.uqg5jt5vxupp2s3b@uno.localdomain>","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"<20200617154054.uqg5jt5vxupp2s3b@uno.localdomain>","Subject":"Re: [libcamera-devel] [PATCH 13/15] v4l2: v4l2_camera: Clear\n\tpending requests on freeBuffers","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","X-List-Received-Date":"Thu, 18 Jun 2020 09:20:37 -0000"}}]