This is an automatic generated email to let you know that the following patch
were queued:
Subject: [media] v4l: vsp1: Protect against race conditions between get and set
format
Author: Laurent Pinchart <laurent.pinchart+rene...@ideasonboard.com>
Date: Sun Jun 26 08:09:31 2016 -0300
The subdev userspace API isn't serialized in the core, serialize access
to formats and selection rectangles in the driver.
Signed-off-by: Laurent Pinchart <laurent.pinchart+rene...@ideasonboard.com>
Acked-by: Niklas Söderlund <niklas.soderlund+rene...@ragnatech.se>
Signed-off-by: Mauro Carvalho Chehab <mche...@s-opensource.com>
drivers/media/platform/vsp1/vsp1_bru.c | 28 +++++++++++++++-----
drivers/media/platform/vsp1/vsp1_clu.c | 15 ++++++++---
drivers/media/platform/vsp1/vsp1_entity.c | 22 +++++++++++++---
drivers/media/platform/vsp1/vsp1_entity.h | 4 ++-
drivers/media/platform/vsp1/vsp1_hsit.c | 15 ++++++++---
drivers/media/platform/vsp1/vsp1_lif.c | 15 ++++++++---
drivers/media/platform/vsp1/vsp1_lut.c | 15 ++++++++---
drivers/media/platform/vsp1/vsp1_rwpf.c | 44 +++++++++++++++++++++++--------
drivers/media/platform/vsp1/vsp1_sru.c | 26 +++++++++++++-----
drivers/media/platform/vsp1/vsp1_uds.c | 26 +++++++++++++-----
10 files changed, 161 insertions(+), 49 deletions(-)
---
diff --git a/drivers/media/platform/vsp1/vsp1_bru.c
b/drivers/media/platform/vsp1/vsp1_bru.c
index 8268b87727a7..5ae3c8d1dcf0 100644
--- a/drivers/media/platform/vsp1/vsp1_bru.c
+++ b/drivers/media/platform/vsp1/vsp1_bru.c
@@ -142,10 +142,15 @@ static int bru_set_format(struct v4l2_subdev *subdev,
struct vsp1_bru *bru = to_bru(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
+
+ mutex_lock(&bru->entity.lock);
config = vsp1_entity_get_pad_config(&bru->entity, cfg, fmt->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
bru_try_format(bru, config, fmt->pad, &fmt->format);
@@ -174,7 +179,9 @@ static int bru_set_format(struct v4l2_subdev *subdev,
}
}
- return 0;
+done:
+ mutex_unlock(&bru->entity.lock);
+ return ret;
}
static int bru_get_selection(struct v4l2_subdev *subdev,
@@ -201,7 +208,9 @@ static int bru_get_selection(struct v4l2_subdev *subdev,
if (!config)
return -EINVAL;
+ mutex_lock(&bru->entity.lock);
sel->r = *bru_get_compose(bru, config, sel->pad);
+ mutex_unlock(&bru->entity.lock);
return 0;
default:
@@ -217,6 +226,7 @@ static int bru_set_selection(struct v4l2_subdev *subdev,
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
struct v4l2_rect *compose;
+ int ret = 0;
if (sel->pad == bru->entity.source_pad)
return -EINVAL;
@@ -224,9 +234,13 @@ static int bru_set_selection(struct v4l2_subdev *subdev,
if (sel->target != V4L2_SEL_TGT_COMPOSE)
return -EINVAL;
+ mutex_lock(&bru->entity.lock);
+
config = vsp1_entity_get_pad_config(&bru->entity, cfg, sel->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
/* The compose rectangle top left corner must be inside the output
* frame.
@@ -246,7 +260,9 @@ static int bru_set_selection(struct v4l2_subdev *subdev,
compose = bru_get_compose(bru, config, sel->pad);
*compose = sel->r;
- return 0;
+done:
+ mutex_unlock(&bru->entity.lock);
+ return ret;
}
static const struct v4l2_subdev_pad_ops bru_pad_ops = {
diff --git a/drivers/media/platform/vsp1/vsp1_clu.c
b/drivers/media/platform/vsp1/vsp1_clu.c
index b63d2dbe5ea3..e1fd03811dda 100644
--- a/drivers/media/platform/vsp1/vsp1_clu.c
+++ b/drivers/media/platform/vsp1/vsp1_clu.c
@@ -148,10 +148,15 @@ static int clu_set_format(struct v4l2_subdev *subdev,
struct vsp1_clu *clu = to_clu(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
+
+ mutex_lock(&clu->entity.lock);
config = vsp1_entity_get_pad_config(&clu->entity, cfg, fmt->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
/* Default to YUV if the requested format is not supported. */
if (fmt->format.code != MEDIA_BUS_FMT_ARGB8888_1X32 &&
@@ -164,7 +169,7 @@ static int clu_set_format(struct v4l2_subdev *subdev,
if (fmt->pad == CLU_PAD_SOURCE) {
/* The CLU output format can't be modified. */
fmt->format = *format;
- return 0;
+ goto done;
}
format->code = fmt->format.code;
@@ -182,7 +187,9 @@ static int clu_set_format(struct v4l2_subdev *subdev,
CLU_PAD_SOURCE);
*format = fmt->format;
- return 0;
+done:
+ mutex_unlock(&clu->entity.lock);
+ return ret;
}
/*
-----------------------------------------------------------------------------
diff --git a/drivers/media/platform/vsp1/vsp1_entity.c
b/drivers/media/platform/vsp1/vsp1_entity.c
index 4cf6cc719c00..da673495c222 100644
--- a/drivers/media/platform/vsp1/vsp1_entity.c
+++ b/drivers/media/platform/vsp1/vsp1_entity.c
@@ -51,6 +51,9 @@ void vsp1_entity_route_setup(struct vsp1_entity *source,
* @cfg: the TRY pad configuration
* @which: configuration selector (ACTIVE or TRY)
*
+ * When called with which set to V4L2_SUBDEV_FORMAT_ACTIVE the caller must hold
+ * the entity lock to access the returned configuration.
+ *
* Return the pad configuration requested by the which argument. The TRY
* configuration is passed explicitly to the function through the cfg argument
* and simply returned when requested. The ACTIVE configuration comes from the
@@ -160,7 +163,9 @@ int vsp1_subdev_get_pad_format(struct v4l2_subdev *subdev,
if (!config)
return -EINVAL;
+ mutex_lock(&entity->lock);
fmt->format = *vsp1_entity_get_pad_format(entity, config, fmt->pad);
+ mutex_unlock(&entity->lock);
return 0;
}
@@ -204,8 +209,10 @@ int vsp1_subdev_enum_mbus_code(struct v4l2_subdev *subdev,
if (!config)
return -EINVAL;
+ mutex_lock(&entity->lock);
format = vsp1_entity_get_pad_format(entity, config, 0);
code->code = format->code;
+ mutex_unlock(&entity->lock);
}
return 0;
@@ -235,6 +242,7 @@ int vsp1_subdev_enum_frame_size(struct v4l2_subdev *subdev,
struct vsp1_entity *entity = to_vsp1_entity(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
config = vsp1_entity_get_pad_config(entity, cfg, fse->which);
if (!config)
@@ -242,8 +250,12 @@ int vsp1_subdev_enum_frame_size(struct v4l2_subdev *subdev,
format = vsp1_entity_get_pad_format(entity, config, fse->pad);
- if (fse->index || fse->code != format->code)
- return -EINVAL;
+ mutex_lock(&entity->lock);
+
+ if (fse->index || fse->code != format->code) {
+ ret = -EINVAL;
+ goto done;
+ }
if (fse->pad == 0) {
fse->min_width = min_width;
@@ -260,7 +272,9 @@ int vsp1_subdev_enum_frame_size(struct v4l2_subdev *subdev,
fse->max_height = format->height;
}
- return 0;
+done:
+ mutex_unlock(&entity->lock);
+ return ret;
}
/*
-----------------------------------------------------------------------------
@@ -358,6 +372,8 @@ int vsp1_entity_init(struct vsp1_device *vsp1, struct
vsp1_entity *entity,
if (i == ARRAY_SIZE(vsp1_routes))
return -EINVAL;
+ mutex_init(&entity->lock);
+
entity->vsp1 = vsp1;
entity->source_pad = num_pads - 1;
diff --git a/drivers/media/platform/vsp1/vsp1_entity.h
b/drivers/media/platform/vsp1/vsp1_entity.h
index b43457fd2c43..b5e4dbb1f7d4 100644
--- a/drivers/media/platform/vsp1/vsp1_entity.h
+++ b/drivers/media/platform/vsp1/vsp1_entity.h
@@ -14,7 +14,7 @@
#define __VSP1_ENTITY_H__
#include <linux/list.h>
-#include <linux/spinlock.h>
+#include <linux/mutex.h>
#include <media/v4l2-subdev.h>
@@ -96,6 +96,8 @@ struct vsp1_entity {
struct v4l2_subdev subdev;
struct v4l2_subdev_pad_config *config;
+
+ struct mutex lock; /* Protects the pad config */
};
static inline struct vsp1_entity *to_vsp1_entity(struct v4l2_subdev *subdev)
diff --git a/drivers/media/platform/vsp1/vsp1_hsit.c
b/drivers/media/platform/vsp1/vsp1_hsit.c
index 6e5077beb38c..6ffbedb5c095 100644
--- a/drivers/media/platform/vsp1/vsp1_hsit.c
+++ b/drivers/media/platform/vsp1/vsp1_hsit.c
@@ -71,10 +71,15 @@ static int hsit_set_format(struct v4l2_subdev *subdev,
struct vsp1_hsit *hsit = to_hsit(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
+
+ mutex_lock(&hsit->entity.lock);
config = vsp1_entity_get_pad_config(&hsit->entity, cfg, fmt->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
format = vsp1_entity_get_pad_format(&hsit->entity, config, fmt->pad);
@@ -83,7 +88,7 @@ static int hsit_set_format(struct v4l2_subdev *subdev,
* modified.
*/
fmt->format = *format;
- return 0;
+ goto done;
}
format->code = hsit->inverse ? MEDIA_BUS_FMT_AHSV8888_1X32
@@ -104,7 +109,9 @@ static int hsit_set_format(struct v4l2_subdev *subdev,
format->code = hsit->inverse ? MEDIA_BUS_FMT_ARGB8888_1X32
: MEDIA_BUS_FMT_AHSV8888_1X32;
- return 0;
+done:
+ mutex_unlock(&hsit->entity.lock);
+ return ret;
}
static const struct v4l2_subdev_pad_ops hsit_pad_ops = {
diff --git a/drivers/media/platform/vsp1/vsp1_lif.c
b/drivers/media/platform/vsp1/vsp1_lif.c
index a720063f38c5..702df863b13a 100644
--- a/drivers/media/platform/vsp1/vsp1_lif.c
+++ b/drivers/media/platform/vsp1/vsp1_lif.c
@@ -66,10 +66,15 @@ static int lif_set_format(struct v4l2_subdev *subdev,
struct vsp1_lif *lif = to_lif(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
+
+ mutex_lock(&lif->entity.lock);
config = vsp1_entity_get_pad_config(&lif->entity, cfg, fmt->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
/* Default to YUV if the requested format is not supported. */
if (fmt->format.code != MEDIA_BUS_FMT_ARGB8888_1X32 &&
@@ -83,7 +88,7 @@ static int lif_set_format(struct v4l2_subdev *subdev,
* format.
*/
fmt->format = *format;
- return 0;
+ goto done;
}
format->code = fmt->format.code;
@@ -101,7 +106,9 @@ static int lif_set_format(struct v4l2_subdev *subdev,
LIF_PAD_SOURCE);
*format = fmt->format;
- return 0;
+done:
+ mutex_unlock(&lif->entity.lock);
+ return ret;
}
static const struct v4l2_subdev_pad_ops lif_pad_ops = {
diff --git a/drivers/media/platform/vsp1/vsp1_lut.c
b/drivers/media/platform/vsp1/vsp1_lut.c
index dc31de9602ba..e1c0bb7535e4 100644
--- a/drivers/media/platform/vsp1/vsp1_lut.c
+++ b/drivers/media/platform/vsp1/vsp1_lut.c
@@ -124,10 +124,15 @@ static int lut_set_format(struct v4l2_subdev *subdev,
struct vsp1_lut *lut = to_lut(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
+
+ mutex_lock(&lut->entity.lock);
config = vsp1_entity_get_pad_config(&lut->entity, cfg, fmt->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
/* Default to YUV if the requested format is not supported. */
if (fmt->format.code != MEDIA_BUS_FMT_ARGB8888_1X32 &&
@@ -140,7 +145,7 @@ static int lut_set_format(struct v4l2_subdev *subdev,
if (fmt->pad == LUT_PAD_SOURCE) {
/* The LUT output format can't be modified. */
fmt->format = *format;
- return 0;
+ goto done;
}
format->code = fmt->format.code;
@@ -158,7 +163,9 @@ static int lut_set_format(struct v4l2_subdev *subdev,
LUT_PAD_SOURCE);
*format = fmt->format;
- return 0;
+done:
+ mutex_unlock(&lut->entity.lock);
+ return ret;
}
/*
-----------------------------------------------------------------------------
diff --git a/drivers/media/platform/vsp1/vsp1_rwpf.c
b/drivers/media/platform/vsp1/vsp1_rwpf.c
index 8d461b375e91..8cb87e96b78b 100644
--- a/drivers/media/platform/vsp1/vsp1_rwpf.c
+++ b/drivers/media/platform/vsp1/vsp1_rwpf.c
@@ -67,10 +67,15 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev,
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
struct v4l2_rect *crop;
+ int ret = 0;
+
+ mutex_lock(&rwpf->entity.lock);
config = vsp1_entity_get_pad_config(&rwpf->entity, cfg, fmt->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
/* Default to YUV if the requested format is not supported. */
if (fmt->format.code != MEDIA_BUS_FMT_ARGB8888_1X32 &&
@@ -85,7 +90,7 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev,
*/
format->code = fmt->format.code;
fmt->format = *format;
- return 0;
+ goto done;
}
format->code = fmt->format.code;
@@ -110,7 +115,9 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev,
RWPF_PAD_SOURCE);
*format = fmt->format;
- return 0;
+done:
+ mutex_unlock(&rwpf->entity.lock);
+ return ret;
}
static int vsp1_rwpf_get_selection(struct v4l2_subdev *subdev,
@@ -120,14 +127,19 @@ static int vsp1_rwpf_get_selection(struct v4l2_subdev
*subdev,
struct vsp1_rwpf *rwpf = to_rwpf(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
/* Cropping is implemented on the sink pad. */
if (sel->pad != RWPF_PAD_SINK)
return -EINVAL;
+ mutex_lock(&rwpf->entity.lock);
+
config = vsp1_entity_get_pad_config(&rwpf->entity, cfg, sel->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
switch (sel->target) {
case V4L2_SEL_TGT_CROP:
@@ -144,10 +156,13 @@ static int vsp1_rwpf_get_selection(struct v4l2_subdev
*subdev,
break;
default:
- return -EINVAL;
+ ret = -EINVAL;
+ break;
}
- return 0;
+done:
+ mutex_unlock(&rwpf->entity.lock);
+ return ret;
}
static int vsp1_rwpf_set_selection(struct v4l2_subdev *subdev,
@@ -158,6 +173,7 @@ static int vsp1_rwpf_set_selection(struct v4l2_subdev
*subdev,
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
struct v4l2_rect *crop;
+ int ret = 0;
/* Cropping is implemented on the sink pad. */
if (sel->pad != RWPF_PAD_SINK)
@@ -166,9 +182,13 @@ static int vsp1_rwpf_set_selection(struct v4l2_subdev
*subdev,
if (sel->target != V4L2_SEL_TGT_CROP)
return -EINVAL;
+ mutex_lock(&rwpf->entity.lock);
+
config = vsp1_entity_get_pad_config(&rwpf->entity, cfg, sel->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
/* Make sure the crop rectangle is entirely contained in the image. The
* WPF top and left offsets are limited to 255.
@@ -206,7 +226,9 @@ static int vsp1_rwpf_set_selection(struct v4l2_subdev
*subdev,
format->width = crop->width;
format->height = crop->height;
- return 0;
+done:
+ mutex_unlock(&rwpf->entity.lock);
+ return ret;
}
const struct v4l2_subdev_pad_ops vsp1_rwpf_pad_ops = {
diff --git a/drivers/media/platform/vsp1/vsp1_sru.c
b/drivers/media/platform/vsp1/vsp1_sru.c
index 47f5e0cea2ce..6e13cdfa5ed4 100644
--- a/drivers/media/platform/vsp1/vsp1_sru.c
+++ b/drivers/media/platform/vsp1/vsp1_sru.c
@@ -128,6 +128,7 @@ static int sru_enum_frame_size(struct v4l2_subdev *subdev,
struct vsp1_sru *sru = to_sru(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
config = vsp1_entity_get_pad_config(&sru->entity, cfg, fse->which);
if (!config)
@@ -135,8 +136,12 @@ static int sru_enum_frame_size(struct v4l2_subdev *subdev,
format = vsp1_entity_get_pad_format(&sru->entity, config, SRU_PAD_SINK);
- if (fse->index || fse->code != format->code)
- return -EINVAL;
+ mutex_lock(&sru->entity.lock);
+
+ if (fse->index || fse->code != format->code) {
+ ret = -EINVAL;
+ goto done;
+ }
if (fse->pad == SRU_PAD_SINK) {
fse->min_width = SRU_MIN_SIZE;
@@ -156,7 +161,9 @@ static int sru_enum_frame_size(struct v4l2_subdev *subdev,
}
}
- return 0;
+done:
+ mutex_unlock(&sru->entity.lock);
+ return ret;
}
static void sru_try_format(struct vsp1_sru *sru,
@@ -217,10 +224,15 @@ static int sru_set_format(struct v4l2_subdev *subdev,
struct vsp1_sru *sru = to_sru(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
+
+ mutex_lock(&sru->entity.lock);
config = vsp1_entity_get_pad_config(&sru->entity, cfg, fmt->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
sru_try_format(sru, config, fmt->pad, &fmt->format);
@@ -236,7 +248,9 @@ static int sru_set_format(struct v4l2_subdev *subdev,
sru_try_format(sru, config, SRU_PAD_SOURCE, format);
}
- return 0;
+done:
+ mutex_unlock(&sru->entity.lock);
+ return ret;
}
static const struct v4l2_subdev_pad_ops sru_pad_ops = {
diff --git a/drivers/media/platform/vsp1/vsp1_uds.c
b/drivers/media/platform/vsp1/vsp1_uds.c
index 652dcd895022..a8fc893a31ee 100644
--- a/drivers/media/platform/vsp1/vsp1_uds.c
+++ b/drivers/media/platform/vsp1/vsp1_uds.c
@@ -133,6 +133,7 @@ static int uds_enum_frame_size(struct v4l2_subdev *subdev,
struct vsp1_uds *uds = to_uds(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
config = vsp1_entity_get_pad_config(&uds->entity, cfg, fse->which);
if (!config)
@@ -141,8 +142,12 @@ static int uds_enum_frame_size(struct v4l2_subdev *subdev,
format = vsp1_entity_get_pad_format(&uds->entity, config,
UDS_PAD_SINK);
- if (fse->index || fse->code != format->code)
- return -EINVAL;
+ mutex_lock(&uds->entity.lock);
+
+ if (fse->index || fse->code != format->code) {
+ ret = -EINVAL;
+ goto done;
+ }
if (fse->pad == UDS_PAD_SINK) {
fse->min_width = UDS_MIN_SIZE;
@@ -156,7 +161,9 @@ static int uds_enum_frame_size(struct v4l2_subdev *subdev,
&fse->max_height);
}
- return 0;
+done:
+ mutex_unlock(&uds->entity.lock);
+ return ret;
}
static void uds_try_format(struct vsp1_uds *uds,
@@ -202,10 +209,15 @@ static int uds_set_format(struct v4l2_subdev *subdev,
struct vsp1_uds *uds = to_uds(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
+ int ret = 0;
+
+ mutex_lock(&uds->entity.lock);
config = vsp1_entity_get_pad_config(&uds->entity, cfg, fmt->which);
- if (!config)
- return -EINVAL;
+ if (!config) {
+ ret = -EINVAL;
+ goto done;
+ }
uds_try_format(uds, config, fmt->pad, &fmt->format);
@@ -221,7 +233,9 @@ static int uds_set_format(struct v4l2_subdev *subdev,
uds_try_format(uds, config, UDS_PAD_SOURCE, format);
}
- return 0;
+done:
+ mutex_unlock(&uds->entity.lock);
+ return ret;
}
/*
-----------------------------------------------------------------------------
_______________________________________________
linuxtv-commits mailing list
linuxtv-commits@linuxtv.org
https://www.linuxtv.org/cgi-bin/mailman/listinfo/linuxtv-commits
