From patchwork Tue Mar 2 12:23:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Kieran Bingham X-Patchwork-Id: 11445 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id 2EDBDBD808 for ; Tue, 2 Mar 2021 12:23:48 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id ECDF068AAB; Tue, 2 Mar 2021 13:23:46 +0100 (CET) Authentication-Results: lancelot.ideasonboard.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=ideasonboard.com header.i=@ideasonboard.com header.b="O14nrx5/"; dkim-atps=neutral Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [213.167.242.64]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id B0DFE68A98 for ; Tue, 2 Mar 2021 13:23:45 +0100 (CET) Received: from Q.local (cpc89244-aztw30-2-0-cust3082.18-1.cable.virginm.net [86.31.172.11]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id 4A19A8F3; Tue, 2 Mar 2021 13:23:45 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com; s=mail; t=1614687825; bh=4+cQre32CGAD54M4055pdgyfYWJb6NvbhJm1CZobWH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O14nrx5/JDPIXmJUFJGIBlOOHZF375q9T3wwZY//28/c+sNto0MhoONWbjVn2Ya8N /jK+1BNnSihfUZ63N0vpy/KQYpC9ZTOIHX5JKhvG+UwHfGOGP5iYrZxSxfXj80wvlt 5WQ/Fnp0k2rq0VmJL5N11H9ui3CdQtyZkhM3t1Jk= From: Kieran Bingham To: libcamera devel Date: Tue, 2 Mar 2021 12:23:40 +0000 Message-Id: <20210302122341.83985-2-kieran.bingham@ideasonboard.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210302122341.83985-1-kieran.bingham@ideasonboard.com> References: <20210302122341.83985-1-kieran.bingham@ideasonboard.com> MIME-Version: 1.0 Subject: [libcamera-devel] [PATCH 1/2] libcamera: Request: validate state on complete X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" Requests should only be completed from the RequestPending state. Requests which are completed from the RequestCancelled, or RequestComplete state, will indicate that a double-complete has been called on the Request, or that it has been used internally after it has been given back to the application. Ensure that this can be caught early if it occurs by enforcing the state required with an assert. Signed-off-by: Kieran Bingham Reviewed-by: Laurent Pinchart Reviewed-by: Umang Jain Reviewed-by: Niklas Söderlund --- This issue has been seen while developing the IPA for the IPU3. Requests are completed, and then completed again while closing. It is likely that this occured, where a request was completed, and was then re-used. A use case where the Request was deleted instead of re-used was also seen which caused a segmentation fault instead, due to the use of the memory after free(). src/libcamera/request.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/libcamera/request.cpp b/src/libcamera/request.cpp index e561ce1d5d0e..24c3694de5fc 100644 --- a/src/libcamera/request.cpp +++ b/src/libcamera/request.cpp @@ -262,7 +262,9 @@ FrameBuffer *Request::findBuffer(const Stream *stream) const */ void Request::complete() { + ASSERT(status_ == RequestPending); ASSERT(!hasPendingBuffers()); + status_ = cancelled_ ? RequestCancelled : RequestComplete; LOG(Request, Debug) From patchwork Tue Mar 2 12:23:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Kieran Bingham X-Patchwork-Id: 11446 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id A9609BD80C for ; Tue, 2 Mar 2021 12:23:48 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id 6AC6268AA5; Tue, 2 Mar 2021 13:23:47 +0100 (CET) Authentication-Results: lancelot.ideasonboard.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=ideasonboard.com header.i=@ideasonboard.com header.b="eVjSWvjW"; dkim-atps=neutral Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [213.167.242.64]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id 07D3768A98 for ; Tue, 2 Mar 2021 13:23:46 +0100 (CET) Received: from Q.local (cpc89244-aztw30-2-0-cust3082.18-1.cable.virginm.net [86.31.172.11]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id 9874EFE0; Tue, 2 Mar 2021 13:23:45 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com; s=mail; t=1614687825; bh=TGB0glKg659i3z6GT7Bz2IJOucy67Q9UY2eK7Gg31BY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eVjSWvjWDt89/HiKbUZ401scyDxuOXpA+8eRicAHb9+4zF5OazllVAPzb/vE8Lpo3 HIe0vWzIbzh7xE3qrNj20endwbynnF+IzQShQwQH6ouxSqg7SLecASKHnw6nwKg8Ga 0EwHVQWjXb+sZWTnOrbUgLA7/7iiJzkmgCjSiIyg= From: Kieran Bingham To: libcamera devel Date: Tue, 2 Mar 2021 12:23:41 +0000 Message-Id: <20210302122341.83985-3-kieran.bingham@ideasonboard.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210302122341.83985-1-kieran.bingham@ideasonboard.com> References: <20210302122341.83985-1-kieran.bingham@ideasonboard.com> MIME-Version: 1.0 Subject: [libcamera-devel] [PATCH 2/2] libcamera: pipeline_handler: Update request usage comment X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" When a pipeline handler completes a request, the request itself is not deleted by libcamera, and the application regains control over the object. It may choose to delete the Request, or re-use it. Clarify this in the comment by removing the declaration that the Request is deleted, but state that it is no longer managed by the pipeline handler and must not be accessed further after this function returns. Signed-off-by: Kieran Bingham Reviewed-by: Umang Jain Reviewed-by: Laurent Pinchart Reviewed-by: Niklas Söderlund --- src/libcamera/pipeline_handler.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libcamera/pipeline_handler.cpp b/src/libcamera/pipeline_handler.cpp index aff83af2e90e..0255d9476de0 100644 --- a/src/libcamera/pipeline_handler.cpp +++ b/src/libcamera/pipeline_handler.cpp @@ -432,8 +432,8 @@ bool PipelineHandler::completeBuffer(Request *request, FrameBuffer *buffer) * \param[in] request The request that has completed * * The pipeline handler shall call this method to notify the \a camera that the - * request has completed. The request is deleted and shall not be accessed once - * this method returns. + * request has completed. The request is no longer managed by the pipeline + * handler and shall not be accessed once this method returns. * * This method ensures that requests will be returned to the application in * submission order, the pipeline handler may call it on any complete request