Patch Detail
Show a patch.
GET /api/patches/4093/?format=api
{ "id": 4093, "url": "https://patchwork.libcamera.org/api/patches/4093/?format=api", "web_url": "https://patchwork.libcamera.org/patch/4093/", "project": { "id": 1, "url": "https://patchwork.libcamera.org/api/projects/1/?format=api", "name": "libcamera", "link_name": "libcamera", "list_id": "libcamera_core", "list_email": "libcamera-devel@lists.libcamera.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20200619054123.19052-14-paul.elder@ideasonboard.com>", "date": "2020-06-19T05:41:19", "name": "[libcamera-devel,v2,13/17] v4l2: v4l2_camera: Clear pending requests on freeBuffers and streamOff", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": false, "hash": "f66a4d49c770dd8ecba3560355a3e532754d92cc", "submitter": { "id": 17, "url": "https://patchwork.libcamera.org/api/people/17/?format=api", "name": "Paul Elder", "email": "paul.elder@ideasonboard.com" }, "delegate": null, "mbox": "https://patchwork.libcamera.org/patch/4093/mbox/", "series": [ { "id": 1017, "url": "https://patchwork.libcamera.org/api/series/1017/?format=api", "web_url": "https://patchwork.libcamera.org/project/libcamera/list/?series=1017", "date": "2020-06-19T05:41:06", "name": "Support v4l2-compliance", "version": 2, "mbox": "https://patchwork.libcamera.org/series/1017/mbox/" } ], "comments": "https://patchwork.libcamera.org/api/patches/4093/comments/", "check": "pending", "checks": "https://patchwork.libcamera.org/api/patches/4093/checks/", "tags": {}, "headers": { "Return-Path": "<paul.elder@ideasonboard.com>", "Received": [ "from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 9FD84603BF\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tFri, 19 Jun 2020 07:42:03 +0200 (CEST)", "from jade.flets-east.jp (unknown\n\t[IPv6:2400:4051:61:600:e972:d773:e99a:4f79])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id D5F55560;\n\tFri, 19 Jun 2020 07:42:01 +0200 (CEST)" ], "Authentication-Results": "lancelot.ideasonboard.com; dkim=pass (1024-bit key; \n\tunprotected) header.d=ideasonboard.com\n\theader.i=@ideasonboard.com\n\theader.b=\"hR5DiO/s\"; dkim-atps=neutral", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1592545323;\n\tbh=V65Bq0jLP4sLjT4P5OiWcus3Rt72bXo3FMcikhMaMuY=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=hR5DiO/sbBwPgBh1/gK/y9EftL9yAwpuEb83y6yLN4RhxU82AyVUUU3mt6CB4blQO\n\tRCVfcP0aWoKfgy9QBDTJQq8972eCx0xDdS36a9KNvfUvNW/kT6DdkZPsvCUFx7phMo\n\twbYHvu8MG1NtMwcsZC8VjwIh9SvFAh8AMyG6Se1E=", "From": "Paul Elder <paul.elder@ideasonboard.com>", "To": "libcamera-devel@lists.libcamera.org", "Date": "Fri, 19 Jun 2020 14:41:19 +0900", "Message-Id": "<20200619054123.19052-14-paul.elder@ideasonboard.com>", "X-Mailer": "git-send-email 2.27.0", "In-Reply-To": "<20200619054123.19052-1-paul.elder@ideasonboard.com>", "References": "<20200619054123.19052-1-paul.elder@ideasonboard.com>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Subject": "[libcamera-devel] [PATCH v2 13/17] v4l2: v4l2_camera: Clear pending\n\trequests on freeBuffers and streamOff", "X-BeenThere": "libcamera-devel@lists.libcamera.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "<libcamera-devel.lists.libcamera.org>", "List-Unsubscribe": "<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>", "List-Archive": "<https://lists.libcamera.org/pipermail/libcamera-devel/>", "List-Post": "<mailto:libcamera-devel@lists.libcamera.org>", "List-Help": "<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>", "List-Subscribe": "<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>", "X-List-Received-Date": "Fri, 19 Jun 2020 05:42:03 -0000" }, "content": "V4L2 allows buffer queueing before streamon while libcamera does not.\nThe compatibility layer thus saves these buffers in a pending queue\nuntil streamon, and then automatically queues them. However, this\npending queue is not cleared when the buffers are freed, so the\nfollowing sequence of actions will cause a use-after-free:\n\n1. queue buffers\n2. free buffers\n - buffers from 1. stay in pending queue but have been freed\n3. queue buffers\n4. streamon\n - buffers from 1. are enqueued, then the buffers from 3. are\n enqueued. Use-after-free segfault when libcamera tries to handle\n the enqueued buffers from 1.\n\nFix this by clearing the pending request queue upon buffers being freed.\nAlso clear the pending request queue on streamOff, for correctness.\n\nSigned-off-by: Paul Elder <paul.elder@ideasonboard.com>\nReviewed-by: Jacopo Mondi <jacopo@jmondi.org>\n\n---\nChanges in v2:\n- also clear pending request queue on streamOff\n- clarify the issue in changelog\n---\n src/v4l2/v4l2_camera.cpp | 4 +++-\n 1 file changed, 3 insertions(+), 1 deletion(-)", "diff": "diff --git a/src/v4l2/v4l2_camera.cpp b/src/v4l2/v4l2_camera.cpp\nindex 99d34b9..301a80e 100644\n--- a/src/v4l2/v4l2_camera.cpp\n+++ b/src/v4l2/v4l2_camera.cpp\n@@ -148,6 +148,7 @@ void V4L2Camera::freeBuffers()\n \tStream *stream = *camera_->streams().begin();\n \n \tbufferAllocator_->free(stream);\n+\tpendingRequests_.clear();\n }\n \n FileDescriptor V4L2Camera::getBufferFd(unsigned int index)\n@@ -187,7 +188,8 @@ int V4L2Camera::streamOn()\n \n int V4L2Camera::streamOff()\n {\n-\t/* \\todo Restore buffers to reqbufs state? */\n+\tpendingRequests_.clear();\n+\n \tif (!isRunning_)\n \t\treturn 0;\n \n", "prefixes": [ "libcamera-devel", "v2", "13/17" ] }