• Hans Verkuil's avatar
    media: videobuf2-vmalloc: get_userptr: buffers are always writable · 70794724
    Hans Verkuil authored
    In vb2_vmalloc_get_userptr() the framevector is created with the
    'write' argument set to false when vb2_create_framevec() is called
    for OUTPUT buffers. So the pages are marked as read-only.
    
    However, userspace will write to these buffers since it will fill
    in the data to output. Since get_userptr is only called if the userptr
    of the queued buffer has changed since the last time that same buffer
    was queued, this will fail when the buffer contents is updated and the
    buffer is queued again.
    
    E.g., userspace fills buffer 1 with the output video and queues it.
    The first time get_userptr is called and the pages are grabbed and
    pinned in memory and marked read-only. The second time buffer 1 is
    filled with different video data and queued again. Since the userptr
    hasn't changed the get_userptr() callback isn't called again. Since
    the pages were marked as read-only the new contents isn't updated.
    
    Just always call vb2_create_framevec() with FOLL_WRITE to always
    allow writing to the buffers.
    
    Using USERPTR streaming with OUTPUT devices is almost never done. And
    when it is done it is via v4l2-compliance and a driver like vim2m. But
    since v4l2-compliance doesn't actually inspect the capture buffer and
    compare it to the original output buffer, this issue was never noticed.
    
    But the vicodec driver actually needs to parse the bitstream in the
    OUTPUT buffers and any errors there will be immediately noticed. So
    this time v4l2-compliance failed the USERPTR streaming test.
    Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
    70794724
videobuf2-dma-contig.c 18.3 KB