From patchwork Tue Mar 2 12:23:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Kieran Bingham X-Patchwork-Id: 11445 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id 2EDBDBD808 for ; Tue, 2 Mar 2021 12:23:48 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id ECDF068AAB; Tue, 2 Mar 2021 13:23:46 +0100 (CET) Authentication-Results: lancelot.ideasonboard.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=ideasonboard.com header.i=@ideasonboard.com header.b="O14nrx5/"; dkim-atps=neutral Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [213.167.242.64]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id B0DFE68A98 for ; Tue, 2 Mar 2021 13:23:45 +0100 (CET) Received: from Q.local (cpc89244-aztw30-2-0-cust3082.18-1.cable.virginm.net [86.31.172.11]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id 4A19A8F3; Tue, 2 Mar 2021 13:23:45 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com; s=mail; t=1614687825; bh=4+cQre32CGAD54M4055pdgyfYWJb6NvbhJm1CZobWH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O14nrx5/JDPIXmJUFJGIBlOOHZF375q9T3wwZY//28/c+sNto0MhoONWbjVn2Ya8N /jK+1BNnSihfUZ63N0vpy/KQYpC9ZTOIHX5JKhvG+UwHfGOGP5iYrZxSxfXj80wvlt 5WQ/Fnp0k2rq0VmJL5N11H9ui3CdQtyZkhM3t1Jk= From: Kieran Bingham To: libcamera devel Date: Tue, 2 Mar 2021 12:23:40 +0000 Message-Id: <20210302122341.83985-2-kieran.bingham@ideasonboard.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210302122341.83985-1-kieran.bingham@ideasonboard.com> References: <20210302122341.83985-1-kieran.bingham@ideasonboard.com> MIME-Version: 1.0 Subject: [libcamera-devel] [PATCH 1/2] libcamera: Request: validate state on complete X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" Requests should only be completed from the RequestPending state. Requests which are completed from the RequestCancelled, or RequestComplete state, will indicate that a double-complete has been called on the Request, or that it has been used internally after it has been given back to the application. Ensure that this can be caught early if it occurs by enforcing the state required with an assert. Signed-off-by: Kieran Bingham Reviewed-by: Laurent Pinchart Reviewed-by: Umang Jain Reviewed-by: Niklas Söderlund --- This issue has been seen while developing the IPA for the IPU3. Requests are completed, and then completed again while closing. It is likely that this occured, where a request was completed, and was then re-used. A use case where the Request was deleted instead of re-used was also seen which caused a segmentation fault instead, due to the use of the memory after free(). src/libcamera/request.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/libcamera/request.cpp b/src/libcamera/request.cpp index e561ce1d5d0e..24c3694de5fc 100644 --- a/src/libcamera/request.cpp +++ b/src/libcamera/request.cpp @@ -262,7 +262,9 @@ FrameBuffer *Request::findBuffer(const Stream *stream) const */ void Request::complete() { + ASSERT(status_ == RequestPending); ASSERT(!hasPendingBuffers()); + status_ = cancelled_ ? RequestCancelled : RequestComplete; LOG(Request, Debug)