On Mon, Mar 25, 2019 at 3:08 PM Kevin Brodsky <kevin.brodsky@xxxxxxx> wrote:
>
> On 22/03/2019 16:07, Catalin Marinas wrote:
> > On Wed, Mar 20, 2019 at 03:51:31PM +0100, Andrey Konovalov wrote:
> >> This patch is a part of a series that extends arm64 kernel ABI to allow to
> >> pass tagged user pointers (with the top byte set to something else other
> >> than 0x00) as syscall arguments.
> >>
> >> videobuf_dma_contig_user_get() uses provided user pointers for vma
> >> lookups, which can only by done with untagged pointers.
> >>
> >> Untag the pointers in this function.
> >>
> >> Signed-off-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
> >> ---
> >> drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++----
> >> 1 file changed, 5 insertions(+), 4 deletions(-)
> >>
> >> diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
> >> index e1bf50df4c70..8a1ddd146b17 100644
> >> --- a/drivers/media/v4l2-core/videobuf-dma-contig.c
> >> +++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
> >> @@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem)
> >> static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
> >> struct videobuf_buffer *vb)
> >> {
> >> + unsigned long untagged_baddr = untagged_addr(vb->baddr);
> >> struct mm_struct *mm = current->mm;
> >> struct vm_area_struct *vma;
> >> unsigned long prev_pfn, this_pfn;
> >> @@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
> >> unsigned int offset;
> >> int ret;
> >>
> >> - offset = vb->baddr & ~PAGE_MASK;
> >> + offset = untagged_baddr & ~PAGE_MASK;
> >> mem->size = PAGE_ALIGN(vb->size + offset);
> >> ret = -EINVAL;
> >>
> >> down_read(&mm->mmap_sem);
> >>
> >> - vma = find_vma(mm, vb->baddr);
> >> + vma = find_vma(mm, untagged_baddr);
> >> if (!vma)
> >> goto out_up;
> >>
> >> - if ((vb->baddr + mem->size) > vma->vm_end)
> >> + if ((untagged_baddr + mem->size) > vma->vm_end)
> >> goto out_up;
> >>
> >> pages_done = 0;
> >> prev_pfn = 0; /* kill warning */
> >> - user_address = vb->baddr;
> >> + user_address = untagged_baddr;
> >>
> >> while (pages_done < (mem->size >> PAGE_SHIFT)) {
> >> ret = follow_pfn(vma, user_address, &this_pfn);
> > I don't think vb->baddr here is anonymous mmap() but worth checking the
> > call paths.
The call path is
__videobuf_iolock()->videobuf_dma_contig_user_get()->find_vma().
>
> I spent some time on this, I didn't find any restriction on the kind of mapping
> that's allowed here. The API regarding V4L2_MEMORY_USERPTR doesn't seem to say
> anything about that either [0] [1]. It's probably best to ask the V4L2 maintainers.
Mauro, could you comment on whether the vb->baddr argument for the
V4L2_MEMORY_USERPTR API can come from an anonymous memory mapping?
>
> Kevin
>
> [0] https://www.kernel.org/doc/html/latest/media/uapi/v4l/vidioc-qbuf.html
> [1] https://www.kernel.org/doc/html/latest/media/uapi/v4l/userp.html
