On Tue, Mar 21, 2023 at 11:28:50AM +0100, Benjamin Gaignard wrote: > Add module parameter "max_vb_buffer_per_queue" to be able to limit > the number of vb2 buffers store in queue. > > Signed-off-by: Benjamin Gaignard <benjamin.gaignard@xxxxxxxxxxxxx> > --- > drivers/media/common/videobuf2/videobuf2-core.c | 15 +++------------ > include/media/videobuf2-core.h | 11 +++++++++-- > 2 files changed, 12 insertions(+), 14 deletions(-) > > diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c > index ae9d72f4d181..f4da917ccf3f 100644 > --- a/drivers/media/common/videobuf2/videobuf2-core.c > +++ b/drivers/media/common/videobuf2/videobuf2-core.c > @@ -34,6 +34,8 @@ > static int debug; > module_param(debug, int, 0644); > > +module_param(max_vb_buffer_per_queue, ulong, 0644); > + > #define dprintk(q, level, fmt, arg...) \ > do { \ > if (debug >= level) \ > @@ -412,10 +414,6 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory, > struct vb2_buffer *vb; > int ret; > > - /* Ensure that q->num_buffers+num_buffers is below VB2_MAX_FRAME */ > - num_buffers = min_t(unsigned int, num_buffers, > - VB2_MAX_FRAME - q->num_buffers); > - We should keep the validation here, just using the new module parameter instead of VB2_MAX_FRAME. Otherwise we let the userspace pass UINT_MAX to REQBUFS and have the array below exhaust the system memory. > for (buffer = 0; buffer < num_buffers; ++buffer) { > /* Allocate vb2 buffer structures */ > vb = kzalloc(q->buf_struct_size, GFP_KERNEL); > @@ -801,9 +799,7 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory, > /* > * Make sure the requested values and current defaults are sane. > */ > - WARN_ON(q->min_buffers_needed > VB2_MAX_FRAME); > num_buffers = max_t(unsigned int, *count, q->min_buffers_needed); > - num_buffers = min_t(unsigned int, num_buffers, VB2_MAX_FRAME); Similar concern here. > memset(q->alloc_devs, 0, sizeof(q->alloc_devs)); > /* > * Set this now to ensure that drivers see the correct q->memory value > @@ -919,11 +915,6 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory, > bool no_previous_buffers = !q->num_buffers; > int ret; > > - if (q->num_buffers == VB2_MAX_FRAME) { > - dprintk(q, 1, "maximum number of buffers already allocated\n"); > - return -ENOBUFS; > - } > - Ditto. > if (no_previous_buffers) { > if (q->waiting_in_dqbuf && *count) { > dprintk(q, 1, "another dup()ped fd is waiting for a buffer\n"); > @@ -948,7 +939,7 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory, > return -EINVAL; > } > > - num_buffers = min(*count, VB2_MAX_FRAME - q->num_buffers); > + num_buffers = *count; Ditto. > > if (requested_planes && requested_sizes) { > num_planes = requested_planes; > diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h > index 397dbf6e61e1..b8b34a993e04 100644 > --- a/include/media/videobuf2-core.h > +++ b/include/media/videobuf2-core.h > @@ -12,6 +12,7 @@ > #ifndef _MEDIA_VIDEOBUF2_CORE_H > #define _MEDIA_VIDEOBUF2_CORE_H > > +#include <linux/minmax.h> > #include <linux/mm_types.h> > #include <linux/mutex.h> > #include <linux/poll.h> > @@ -48,6 +49,8 @@ struct vb2_fileio_data; > struct vb2_threadio_data; > struct vb2_buffer; > > +static size_t max_vb_buffer_per_queue = 1024; > + > /** > * struct vb2_mem_ops - memory handling/memory allocator operations. > * @alloc: allocate video memory and, optionally, allocator private data, > @@ -1268,12 +1271,16 @@ static inline bool vb2_queue_add_buffer(struct vb2_queue *q, struct vb2_buffer * > > if (vb->index >= q->max_num_bufs) { > struct vb2_buffer **tmp; > + int cnt = min(max_vb_buffer_per_queue, q->max_num_bufs * 2); Should cnt also be size_t to match max_vb_buffer_per_queue? This could also overflow given q->max_num_bufs big enough, so maybe it would just be better to rewrite to? size_t cnt = (q->max_num_bufs > max_vb_buffer_per_queue / 2) ? max_vb_buffer_per_queue : q->max_num_bufs * 2; Or we could just switch to XArray and it would solve this for us. :) Best regards, Tomasz > + > + if (cnt >= q->max_num_bufs) > + goto realloc_failed; > > - tmp = krealloc_array(q->bufs, q->max_num_bufs * 2, sizeof(*q->bufs), GFP_KERNEL); > + tmp = krealloc_array(q->bufs, cnt, sizeof(*q->bufs), GFP_KERNEL); > if (!tmp) > goto realloc_failed; > > - q->max_num_bufs *= 2; > + q->max_num_bufs = cnt; > q->bufs = tmp; > } > > -- > 2.34.1 >