On 22/03/2019 16:07, Catalin Marinas wrote:
On Wed, Mar 20, 2019 at 03:51:31PM +0100, Andrey Konovalov wrote:
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.

videobuf_dma_contig_user_get() uses provided user pointers for vma
lookups, which can only by done with untagged pointers.

Untag the pointers in this function.

Signed-off-by: Andrey Konovalov <andreyk...@google.com>
---
  drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++----
  1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c 
b/drivers/media/v4l2-core/videobuf-dma-contig.c
index e1bf50df4c70..8a1ddd146b17 100644
--- a/drivers/media/v4l2-core/videobuf-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
@@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct 
videobuf_dma_contig_memory *mem)
  static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory 
*mem,
                                        struct videobuf_buffer *vb)
  {
+       unsigned long untagged_baddr = untagged_addr(vb->baddr);
        struct mm_struct *mm = current->mm;
        struct vm_area_struct *vma;
        unsigned long prev_pfn, this_pfn;
@@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct 
videobuf_dma_contig_memory *mem,
        unsigned int offset;
        int ret;
- offset = vb->baddr & ~PAGE_MASK;
+       offset = untagged_baddr & ~PAGE_MASK;
        mem->size = PAGE_ALIGN(vb->size + offset);
        ret = -EINVAL;
down_read(&mm->mmap_sem); - vma = find_vma(mm, vb->baddr);
+       vma = find_vma(mm, untagged_baddr);
        if (!vma)
                goto out_up;
- if ((vb->baddr + mem->size) > vma->vm_end)
+       if ((untagged_baddr + mem->size) > vma->vm_end)
                goto out_up;
pages_done = 0;
        prev_pfn = 0; /* kill warning */
-       user_address = vb->baddr;
+       user_address = untagged_baddr;
while (pages_done < (mem->size >> PAGE_SHIFT)) {
                ret = follow_pfn(vma, user_address, &this_pfn);
I don't think vb->baddr here is anonymous mmap() but worth checking the
call paths.

I spent some time on this, I didn't find any restriction on the kind of mapping that's allowed here. The API regarding V4L2_MEMORY_USERPTR doesn't seem to say anything about that either [0] [1]. It's probably best to ask the V4L2 maintainers.

Kevin

[0] https://www.kernel.org/doc/html/latest/media/uapi/v4l/vidioc-qbuf.html
[1] https://www.kernel.org/doc/html/latest/media/uapi/v4l/userp.html
_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Reply via email to