This is a note to let you know that I've just added the patch titled
[media] v4l: vsp1: Prevent multiple streamon race commencing pipeline early
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
v4l-vsp1-prevent-multiple-streamon-race-commencing-pipeline-early.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Sun Mar 18 16:55:33 CET 2018
From: Kieran Bingham <kieran.bingham+renesas@xxxxxxxxxxxxxxxx>
Date: Fri, 6 Jan 2017 10:15:28 -0200
Subject: [media] v4l: vsp1: Prevent multiple streamon race commencing pipeline early
From: Kieran Bingham <kieran.bingham+renesas@xxxxxxxxxxxxxxxx>
[ Upstream commit 4461c84b52b4a952c657505ef7e4e06b016783df ]
With multiple inputs through the BRU it is feasible for the streams to
race each other at stream-on.
Multiple VIDIOC_STREAMON calls racing each other could have process
N-1 skipping over the pipeline setup section and then start the pipeline
early, if videobuf2 has already enqueued buffers to the driver for
process N but not called the .start_streaming() operation yet
In the case of the video pipelines, this
can present two serious issues.
1) A null-dereference if the pipe->dl is committed at the same time as
the vsp1_video_setup_pipeline() is processing
2) A hardware hang, where a display list is committed without having
called vsp1_video_setup_pipeline() first
Repair this issue, by ensuring that only the stream which configures the
pipeline is able to start it.
Signed-off-by: Kieran Bingham <kieran.bingham+renesas@xxxxxxxxxxxxxxxx>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@xxxxxxxxxxxxxxxx>
Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <alexander.levin@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/media/platform/vsp1/vsp1_video.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/media/platform/vsp1/vsp1_video.c
+++ b/drivers/media/platform/vsp1/vsp1_video.c
@@ -792,6 +792,7 @@ static int vsp1_video_start_streaming(st
{
struct vsp1_video *video = vb2_get_drv_priv(vq);
struct vsp1_pipeline *pipe = video->rwpf->pipe;
+ bool start_pipeline = false;
unsigned long flags;
int ret;
@@ -802,11 +803,23 @@ static int vsp1_video_start_streaming(st
mutex_unlock(&pipe->lock);
return ret;
}
+
+ start_pipeline = true;
}
pipe->stream_count++;
mutex_unlock(&pipe->lock);
+ /*
+ * vsp1_pipeline_ready() is not sufficient to establish that all streams
+ * are prepared and the pipeline is configured, as multiple streams
+ * can race through streamon with buffers already queued; Therefore we
+ * don't even attempt to start the pipeline until the last stream has
+ * called through here.
+ */
+ if (!start_pipeline)
+ return 0;
+
spin_lock_irqsave(&pipe->irqlock, flags);
if (vsp1_pipeline_ready(pipe))
vsp1_video_pipeline_run(pipe);
Patches currently in stable-queue which might be from kieran.bingham+renesas@xxxxxxxxxxxxxxxx are
queue-4.9/v4l-vsp1-prevent-multiple-streamon-race-commencing-pipeline-early.patch
queue-4.9/v4l-vsp1-register-pipe-with-output-wpf.patch
queue-4.9/media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch