leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[media] v4l: vsp1: Protect against race conditions between get and set format

Browse Source 
The subdev userspace API isn't serialized in the core, serialize access
to formats and selection rectangles in the driver.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Acked-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Laurent Pinchart 2016-06-26 08:09:31 -03:00 committed by Mauro Carvalho Chehab
parent e4e70a147a
commit 34e77ed84b
10 changed files with 161 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/media/platform/vsp1/vsp1_bru.c
View File

@ -142,10 +142,15 @@ static int bru_set_format(struct v4l2_subdev *subdev,
struct vsp1_bru *bru = to_bru(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
mutex_lock(&bru->entity.lock);
config = vsp1_entity_get_pad_config(&bru->entity, cfg, fmt->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
bru_try_format(bru, config, fmt->pad, &fmt->format);
@ -174,7 +179,9 @@ static int bru_set_format(struct v4l2_subdev *subdev,
}
}
return 0;
done:
mutex_unlock(&bru->entity.lock);
return ret;
}
static int bru_get_selection(struct v4l2_subdev *subdev,
@ -201,7 +208,9 @@ static int bru_get_selection(struct v4l2_subdev *subdev,
if (!config)
return -EINVAL;
mutex_lock(&bru->entity.lock);
sel->r = *bru_get_compose(bru, config, sel->pad);
mutex_unlock(&bru->entity.lock);
return 0;
default:
@ -217,6 +226,7 @@ static int bru_set_selection(struct v4l2_subdev *subdev,
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
struct v4l2_rect *compose;
int ret = 0;
if (sel->pad == bru->entity.source_pad)
return -EINVAL;
@ -224,9 +234,13 @@ static int bru_set_selection(struct v4l2_subdev *subdev,
if (sel->target != V4L2_SEL_TGT_COMPOSE)
return -EINVAL;
mutex_lock(&bru->entity.lock);
config = vsp1_entity_get_pad_config(&bru->entity, cfg, sel->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
/* The compose rectangle top left corner must be inside the output
* frame.
@ -246,7 +260,9 @@ static int bru_set_selection(struct v4l2_subdev *subdev,
compose = bru_get_compose(bru, config, sel->pad);
*compose = sel->r;
return 0;
done:
mutex_unlock(&bru->entity.lock);
return ret;
}
static const struct v4l2_subdev_pad_ops bru_pad_ops = {

15
drivers/media/platform/vsp1/vsp1_clu.c
View File

@ -148,10 +148,15 @@ static int clu_set_format(struct v4l2_subdev *subdev,
struct vsp1_clu *clu = to_clu(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
mutex_lock(&clu->entity.lock);
config = vsp1_entity_get_pad_config(&clu->entity, cfg, fmt->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
/* Default to YUV if the requested format is not supported. */
if (fmt->format.code != MEDIA_BUS_FMT_ARGB8888_1X32 &&
@ -164,7 +169,7 @@ static int clu_set_format(struct v4l2_subdev *subdev,
if (fmt->pad == CLU_PAD_SOURCE) {
/* The CLU output format can't be modified. */
fmt->format = *format;
return 0;
goto done;
}
format->code = fmt->format.code;
@ -182,7 +187,9 @@ static int clu_set_format(struct v4l2_subdev *subdev,
CLU_PAD_SOURCE);
*format = fmt->format;
return 0;
done:
mutex_unlock(&clu->entity.lock);
return ret;
}
/* -----------------------------------------------------------------------------

22
drivers/media/platform/vsp1/vsp1_entity.c
View File

@ -51,6 +51,9 @@ void vsp1_entity_route_setup(struct vsp1_entity *source,
* @cfg: the TRY pad configuration
* @which: configuration selector (ACTIVE or TRY)
*
* When called with which set to V4L2_SUBDEV_FORMAT_ACTIVE the caller must hold
* the entity lock to access the returned configuration.
*
* Return the pad configuration requested by the which argument. The TRY
* configuration is passed explicitly to the function through the cfg argument
* and simply returned when requested. The ACTIVE configuration comes from the
@ -160,7 +163,9 @@ int vsp1_subdev_get_pad_format(struct v4l2_subdev *subdev,
if (!config)
return -EINVAL;
mutex_lock(&entity->lock);
fmt->format = *vsp1_entity_get_pad_format(entity, config, fmt->pad);
mutex_unlock(&entity->lock);
return 0;
}
@ -204,8 +209,10 @@ int vsp1_subdev_enum_mbus_code(struct v4l2_subdev *subdev,
if (!config)
return -EINVAL;
mutex_lock(&entity->lock);
format = vsp1_entity_get_pad_format(entity, config, 0);
code->code = format->code;
mutex_unlock(&entity->lock);
}
return 0;
@ -235,6 +242,7 @@ int vsp1_subdev_enum_frame_size(struct v4l2_subdev *subdev,
struct vsp1_entity *entity = to_vsp1_entity(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
config = vsp1_entity_get_pad_config(entity, cfg, fse->which);
if (!config)
@ -242,8 +250,12 @@ int vsp1_subdev_enum_frame_size(struct v4l2_subdev *subdev,
format = vsp1_entity_get_pad_format(entity, config, fse->pad);
if (fse->index || fse->code != format->code)
return -EINVAL;
mutex_lock(&entity->lock);
if (fse->index || fse->code != format->code) {
ret = -EINVAL;
goto done;
}
if (fse->pad == 0) {
fse->min_width = min_width;
@ -260,7 +272,9 @@ int vsp1_subdev_enum_frame_size(struct v4l2_subdev *subdev,
fse->max_height = format->height;
}
return 0;
done:
mutex_unlock(&entity->lock);
return ret;
}
/* -----------------------------------------------------------------------------
@ -358,6 +372,8 @@ int vsp1_entity_init(struct vsp1_device *vsp1, struct vsp1_entity *entity,
if (i == ARRAY_SIZE(vsp1_routes))
return -EINVAL;
mutex_init(&entity->lock);
entity->vsp1 = vsp1;
entity->source_pad = num_pads - 1;

4
drivers/media/platform/vsp1/vsp1_entity.h
View File

@ -14,7 +14,7 @@
#define __VSP1_ENTITY_H__
#include <linux/list.h>
#include <linux/spinlock.h>
#include <linux/mutex.h>
#include <media/v4l2-subdev.h>
@ -96,6 +96,8 @@ struct vsp1_entity {
struct v4l2_subdev subdev;
struct v4l2_subdev_pad_config *config;
struct mutex lock; /* Protects the pad config */
};
static inline struct vsp1_entity *to_vsp1_entity(struct v4l2_subdev *subdev)

15
drivers/media/platform/vsp1/vsp1_hsit.c
View File

@ -71,10 +71,15 @@ static int hsit_set_format(struct v4l2_subdev *subdev,
struct vsp1_hsit *hsit = to_hsit(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
mutex_lock(&hsit->entity.lock);
config = vsp1_entity_get_pad_config(&hsit->entity, cfg, fmt->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
format = vsp1_entity_get_pad_format(&hsit->entity, config, fmt->pad);
@ -83,7 +88,7 @@ static int hsit_set_format(struct v4l2_subdev *subdev,
* modified.
*/
fmt->format = *format;
return 0;
goto done;
}
format->code = hsit->inverse ? MEDIA_BUS_FMT_AHSV8888_1X32
@ -104,7 +109,9 @@ static int hsit_set_format(struct v4l2_subdev *subdev,
format->code = hsit->inverse ? MEDIA_BUS_FMT_ARGB8888_1X32
: MEDIA_BUS_FMT_AHSV8888_1X32;
return 0;
done:
mutex_unlock(&hsit->entity.lock);
return ret;
}
static const struct v4l2_subdev_pad_ops hsit_pad_ops = {

15
drivers/media/platform/vsp1/vsp1_lif.c
View File

@ -66,10 +66,15 @@ static int lif_set_format(struct v4l2_subdev *subdev,
struct vsp1_lif *lif = to_lif(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
mutex_lock(&lif->entity.lock);
config = vsp1_entity_get_pad_config(&lif->entity, cfg, fmt->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
/* Default to YUV if the requested format is not supported. */
if (fmt->format.code != MEDIA_BUS_FMT_ARGB8888_1X32 &&
@ -83,7 +88,7 @@ static int lif_set_format(struct v4l2_subdev *subdev,
* format.
*/
fmt->format = *format;
return 0;
goto done;
}
format->code = fmt->format.code;
@ -101,7 +106,9 @@ static int lif_set_format(struct v4l2_subdev *subdev,
LIF_PAD_SOURCE);
*format = fmt->format;
return 0;
done:
mutex_unlock(&lif->entity.lock);
return ret;
}
static const struct v4l2_subdev_pad_ops lif_pad_ops = {

15
drivers/media/platform/vsp1/vsp1_lut.c
View File

@ -124,10 +124,15 @@ static int lut_set_format(struct v4l2_subdev *subdev,
struct vsp1_lut *lut = to_lut(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
mutex_lock(&lut->entity.lock);
config = vsp1_entity_get_pad_config(&lut->entity, cfg, fmt->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
/* Default to YUV if the requested format is not supported. */
if (fmt->format.code != MEDIA_BUS_FMT_ARGB8888_1X32 &&
@ -140,7 +145,7 @@ static int lut_set_format(struct v4l2_subdev *subdev,
if (fmt->pad == LUT_PAD_SOURCE) {
/* The LUT output format can't be modified. */
fmt->format = *format;
return 0;
goto done;
}
format->code = fmt->format.code;
@ -158,7 +163,9 @@ static int lut_set_format(struct v4l2_subdev *subdev,
LUT_PAD_SOURCE);
*format = fmt->format;
return 0;
done:
mutex_unlock(&lut->entity.lock);
return ret;
}
/* -----------------------------------------------------------------------------

44
drivers/media/platform/vsp1/vsp1_rwpf.c
View File

@ -67,10 +67,15 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev,
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
struct v4l2_rect *crop;
int ret = 0;
mutex_lock(&rwpf->entity.lock);
config = vsp1_entity_get_pad_config(&rwpf->entity, cfg, fmt->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
/* Default to YUV if the requested format is not supported. */
if (fmt->format.code != MEDIA_BUS_FMT_ARGB8888_1X32 &&
@ -85,7 +90,7 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev,
*/
format->code = fmt->format.code;
fmt->format = *format;
return 0;
goto done;
}
format->code = fmt->format.code;
@ -110,7 +115,9 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev,
RWPF_PAD_SOURCE);
*format = fmt->format;
return 0;
done:
mutex_unlock(&rwpf->entity.lock);
return ret;
}
static int vsp1_rwpf_get_selection(struct v4l2_subdev *subdev,
@ -120,14 +127,19 @@ static int vsp1_rwpf_get_selection(struct v4l2_subdev *subdev,
struct vsp1_rwpf *rwpf = to_rwpf(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
/* Cropping is implemented on the sink pad. */
if (sel->pad != RWPF_PAD_SINK)
return -EINVAL;
mutex_lock(&rwpf->entity.lock);
config = vsp1_entity_get_pad_config(&rwpf->entity, cfg, sel->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
switch (sel->target) {
case V4L2_SEL_TGT_CROP:
@ -144,10 +156,13 @@ static int vsp1_rwpf_get_selection(struct v4l2_subdev *subdev,
break;
default:
return -EINVAL;
ret = -EINVAL;
break;
}
return 0;
done:
mutex_unlock(&rwpf->entity.lock);
return ret;
}
static int vsp1_rwpf_set_selection(struct v4l2_subdev *subdev,
@ -158,6 +173,7 @@ static int vsp1_rwpf_set_selection(struct v4l2_subdev *subdev,
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
struct v4l2_rect *crop;
int ret = 0;
/* Cropping is implemented on the sink pad. */
if (sel->pad != RWPF_PAD_SINK)
@ -166,9 +182,13 @@ static int vsp1_rwpf_set_selection(struct v4l2_subdev *subdev,
if (sel->target != V4L2_SEL_TGT_CROP)
return -EINVAL;
mutex_lock(&rwpf->entity.lock);
config = vsp1_entity_get_pad_config(&rwpf->entity, cfg, sel->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
/* Make sure the crop rectangle is entirely contained in the image. The
* WPF top and left offsets are limited to 255.
@ -206,7 +226,9 @@ static int vsp1_rwpf_set_selection(struct v4l2_subdev *subdev,
format->width = crop->width;
format->height = crop->height;
return 0;
done:
mutex_unlock(&rwpf->entity.lock);
return ret;
}
const struct v4l2_subdev_pad_ops vsp1_rwpf_pad_ops = {

26
drivers/media/platform/vsp1/vsp1_sru.c
View File

@ -128,6 +128,7 @@ static int sru_enum_frame_size(struct v4l2_subdev *subdev,
struct vsp1_sru *sru = to_sru(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
config = vsp1_entity_get_pad_config(&sru->entity, cfg, fse->which);
if (!config)
@ -135,8 +136,12 @@ static int sru_enum_frame_size(struct v4l2_subdev *subdev,
format = vsp1_entity_get_pad_format(&sru->entity, config, SRU_PAD_SINK);
if (fse->index || fse->code != format->code)
return -EINVAL;
mutex_lock(&sru->entity.lock);
if (fse->index || fse->code != format->code) {
ret = -EINVAL;
goto done;
}
if (fse->pad == SRU_PAD_SINK) {
fse->min_width = SRU_MIN_SIZE;
@ -156,7 +161,9 @@ static int sru_enum_frame_size(struct v4l2_subdev *subdev,
}
}
return 0;
done:
mutex_unlock(&sru->entity.lock);
return ret;
}
static void sru_try_format(struct vsp1_sru *sru,
@ -217,10 +224,15 @@ static int sru_set_format(struct v4l2_subdev *subdev,
struct vsp1_sru *sru = to_sru(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
mutex_lock(&sru->entity.lock);
config = vsp1_entity_get_pad_config(&sru->entity, cfg, fmt->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
sru_try_format(sru, config, fmt->pad, &fmt->format);
@ -236,7 +248,9 @@ static int sru_set_format(struct v4l2_subdev *subdev,
sru_try_format(sru, config, SRU_PAD_SOURCE, format);
}
return 0;
done:
mutex_unlock(&sru->entity.lock);
return ret;
}
static const struct v4l2_subdev_pad_ops sru_pad_ops = {

26
drivers/media/platform/vsp1/vsp1_uds.c
View File

@ -133,6 +133,7 @@ static int uds_enum_frame_size(struct v4l2_subdev *subdev,
struct vsp1_uds *uds = to_uds(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
config = vsp1_entity_get_pad_config(&uds->entity, cfg, fse->which);
if (!config)
@ -141,8 +142,12 @@ static int uds_enum_frame_size(struct v4l2_subdev *subdev,
format = vsp1_entity_get_pad_format(&uds->entity, config,
UDS_PAD_SINK);
if (fse->index || fse->code != format->code)
return -EINVAL;
mutex_lock(&uds->entity.lock);
if (fse->index || fse->code != format->code) {
ret = -EINVAL;
goto done;
}
if (fse->pad == UDS_PAD_SINK) {
fse->min_width = UDS_MIN_SIZE;
@ -156,7 +161,9 @@ static int uds_enum_frame_size(struct v4l2_subdev *subdev,
&fse->max_height);
}
return 0;
done:
mutex_unlock(&uds->entity.lock);
return ret;
}
static void uds_try_format(struct vsp1_uds *uds,
@ -202,10 +209,15 @@ static int uds_set_format(struct v4l2_subdev *subdev,
struct vsp1_uds *uds = to_uds(subdev);
struct v4l2_subdev_pad_config *config;
struct v4l2_mbus_framefmt *format;
int ret = 0;
mutex_lock(&uds->entity.lock);
config = vsp1_entity_get_pad_config(&uds->entity, cfg, fmt->which);
if (!config)
return -EINVAL;
if (!config) {
ret = -EINVAL;
goto done;
}
uds_try_format(uds, config, fmt->pad, &fmt->format);
@ -221,7 +233,9 @@ static int uds_set_format(struct v4l2_subdev *subdev,
uds_try_format(uds, config, UDS_PAD_SOURCE, format);
}
return 0;
done:
mutex_unlock(&uds->entity.lock);
return ret;
}
/* -----------------------------------------------------------------------------