A driver without a control handler receives VIDIOC_G_CTRL and VIDIOC_S_CTRL from the V4L2 core as a single extended control that the core builds on its own stack, with the control's size left uninitialized. virtio_media_send_ext_controls_ioctl() takes a nonzero size as a payload to copy from userspace, so these ioctls fail with -EINVAL whenever the stack is dirty. GStreamer's V4L2 encoders set their profile with VIDIOC_S_CTRL and cannot negotiate, and v4l2-ctl cannot read the MIN_BUFFERS controls.
Legacy controls carry a 32-bit value and never a payload, and an array that comes from userspace is copied into an allocation, never onto the stack. Clear the size of each control when the array is on the stack. The core is being fixed to zero the structure [1]; this keeps the driver working on kernels without that fix. [1] https://lore.kernel.org/all/[email protected]/ Assisted-by: LLM Signed-off-by: Nick Rogers <[email protected]> --- This applies on top of the virtio-media v9 series and turns point 3 of my review above into a patch. Build-tested on media.git next with v9 applied (arm64, W=1, no new warnings). drivers/media/virtio/virtio_media_ioctls.c | 25 ++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/drivers/media/virtio/virtio_media_ioctls.c b/drivers/media/virtio/virtio_media_ioctls.c index f0b82b5ec..19abcf95e 100644 --- a/drivers/media/virtio/virtio_media_ioctls.c +++ b/drivers/media/virtio/virtio_media_ioctls.c @@ -6,6 +6,7 @@ * Copyright (c) 2024-2026 Google LLC. */ +#include <linux/sched/task_stack.h> #include <linux/mutex.h> #include <linux/videodev2.h> #include <linux/virtio_config.h> @@ -576,11 +577,31 @@ static int virtio_media_querycap(struct file *file, void *fh, * Extended control ioctls are handled mostly identically. */ +/* + * VIDIOC_G_CTRL and VIDIOC_S_CTRL reach a driver without a control handler + * as one extended control the V4L2 core builds on its own stack, with its + * size left uninitialized. They carry a 32-bit value and never a payload, + * so a size there is stack garbage, which would be sent as a user pointer + * to copy and fail the ioctl. An array from userspace is never on the + * stack: the core copies it into an allocation. + */ +static void virtio_media_legacy_ctrl(struct v4l2_ext_controls *ctrls) +{ + u32 i; + + if (!ctrls->count || !object_is_on_stack(ctrls->controls)) + return; + for (i = 0; i < ctrls->count; i++) + ctrls->controls[i].size = 0; +} + static int virtio_media_g_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *ctrls) { struct v4l2_fh *vfh = file_to_v4l2_fh(file); + virtio_media_legacy_ctrl(ctrls); + return virtio_media_send_ext_controls_ioctl(vfh, VIDIOC_G_EXT_CTRLS, ctrls); } @@ -590,6 +611,8 @@ static int virtio_media_s_ext_ctrls(struct file *file, void *fh, { struct v4l2_fh *vfh = file_to_v4l2_fh(file); + virtio_media_legacy_ctrl(ctrls); + return virtio_media_send_ext_controls_ioctl(vfh, VIDIOC_S_EXT_CTRLS, ctrls); } @@ -599,6 +622,8 @@ static int virtio_media_try_ext_ctrls(struct file *file, void *fh, { struct v4l2_fh *vfh = file_to_v4l2_fh(file); + virtio_media_legacy_ctrl(ctrls); + return virtio_media_send_ext_controls_ioctl(vfh, VIDIOC_TRY_EXT_CTRLS, ctrls); } -- 2.54.0 (Apple Git-157)
