From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C512C3A8734 for ; Sat, 30 May 2026 11:10:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780139424; cv=none; b=OfAmw9SQJHemUm+oT5MREHN5w2pj2qQiUg5C9QT8yqFENIaTim6KPldIbOPikZJCj+2LgKLj6fWoA/KUl4cmahggAHh3wmTBhV9wv8EKilyXvtpBsHikrdFl2k+f92r5PqbLn2e1OME1by0Ej0KLiNBQ8eQrStz8C0n5goQxeTw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780139424; c=relaxed/simple; bh=tqYFsiyiOTI3wib+NAngYkKunkiI4TSEPNfrzQ7CWi8=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=Dmme6IYYEDdZuH4vC6bYz69ntYUNuoTsA6eh+0RC2JVTmn2yrossdBLMrg/YV89a5teRhOne3/3UjpOfA1JGw7omoeOHirNmOfWZpOMLHtdomnHKELGCnZPUJw+rjpGnwQxp9NzWpAqm3SseP8G7cd3dlvZ57VFf9G5YeAY54fo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=E3YU0GSJ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="E3YU0GSJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C6D71F00893; Sat, 30 May 2026 11:10:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780139423; bh=cRidFqpaHYJwIgtkoGwGJAGfQh466yyG3vrix1ctLvE=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=E3YU0GSJ3vEJvpjuF5qE+6zz37Ya7Iow9ybJp/xzhEmwl9kfzFYOf31VH4x+/IBoU LCyEjPNSAbr76mYhj0JD2sXlb3dCj6HGrvUMuJaXwleK8NZ3UfThPxbwswAaafWV9K xAtBCf/ZyajOpXzjbD7fA8pqUsOWy9b0apnb79FplU0XnAXkcSsCOAxT3ASat7NhYk 6PsDOE7iV/TIBKkBCusupxNMht7LI4dboY9BnLJXsTpGAdIlHH5jGtY4Z8a8teMSmO DGLD2yY6ZgyCR3PSz4Xtm2YbVlV9RKfieGaFmdXVMeGAW/5lpxIscdMLQhQPyE/n0p 9ywOSZnbbsmZg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v6 6/8] media: meson: vdec: Configure DMA mask and segment size in probe Reply-To: sashiko-reviews@lists.linux.dev To: "Anand Moon" Cc: linux-media@vger.kernel.org, neil.armstrong@linaro.org, linux-amlogic@lists.infradead.org In-Reply-To: <20260530094326.11892-7-linux.amoon@gmail.com> References: <20260530094326.11892-7-linux.amoon@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Sat, 30 May 2026 11:10:22 +0000 Message-Id: <20260530111022.9C6D71F00893@smtp.kernel.org> Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 2 potential issue(= s) to consider: New issues: - [Critical] Applying a 64-bit DMA mask causes silent physical address trun= cation and memory corruption, as the hardware and driver only support 32-bi= t addresses. Pre-existing issues: - [High] The vdec driver stores a raw pointer to the `meson_canvas` device = without linking the devices or holding a reference, leading to a Use-After-= Free if the canvas provider unbinds. -- commit 895ef453d9c75df04fd40367102f8eafce76e013 Author: Anand Moon media: meson: vdec: Configure DMA mask and segment size in probe The vdec probe routine did not set explicit DMA constraints, leaving the driver dependent on platform defaults. This could cause allocation failures or fragmented buffer handling on systems with stricter DMA limits. This change configures a 64-bit DMA mask and sets the maximum contiguous segment size to UINT_MAX. Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ > diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/me= dia/meson/vdec/vdec.c > index 4884ee04b3529..f99335effe176 100644 > --- a/drivers/staging/media/meson/vdec/vdec.c > +++ b/drivers/staging/media/meson/vdec/vdec.c > @@ -1064,6 +1064,15 @@ static int vdec_probe(struct platform_device *pdev) > if (IS_ERR(core->canvas)) > return PTR_ERR(core->canvas); [Severity: High] This isn't a bug introduced by this patch, but can we experience a use-after-free here if the canvas provider unbinds? Looking at meson_canvas_get(), the reference to the provider device is dropped immediately before returning the internal canvas pointer: drivers/soc/amlogic/meson-canvas.c:meson_canvas_get() { ... put_device(&canvas_pdev->dev); return canvas; } Since the vdec driver stores this pointer in core->canvas but does not establish a device link or hold a module reference, what prevents the canvas memory from being freed by devres while the vdec driver is still using it? > =20 > + ret =3D dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)); [Severity: Critical] Will setting a 64-bit DMA mask cause silent physical address truncation? The Meson VDEC hardware natively uses 32-bit registers for DMA addresses, and the driver's helper functions strictly accept 32-bit values: drivers/staging/media/meson/vdec/vdec_helpers.h: void amvdec_write_dos(struct amvdec_core *core, u32 reg, u32 val); If the DMA API allocates memory buffers at physical addresses above 4GB, their 64-bit addresses will be implicitly truncated to 32 bits when passed to the hardware registers. Can this lead to the hardware reading or writing to incorrect physical memory locations in the lower 4GB? > + if (ret) > + return dev_err_probe(dev, ret, "Failed to set DMA mask\n"); > + > + ret =3D vb2_dma_contig_set_max_seg_size(dev, UINT_MAX); > + if (ret) > + return dev_err_probe(dev, ret, > + "Failed to set DMA max segment size\n"); > + > of_id =3D of_match_node(vdec_dt_match, dev->of_node); > core->platform =3D of_id->data; --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260530094326.1189= 2-1-linux.amoon@gmail.com?part=3D6 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3880BCD5BD0 for ; Sat, 30 May 2026 11:10:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=c4I+UFZEHSuVky1Hbw/duobhbvzVWZrvO9bKYm1M6QQ=; b=MrAOSWp7dVqi4/ L6iyFlerpeGAJCgjMHLbABcwS0M4ZPTPuApK0ku+w0fIzpuERBltVl6hDl1qTgjgchNwAyh4glk+K XY4voqTmTkrtEEw0fUqBy71pDdizdYdDeSfebmJbGpQDsB3204vh9RuPofqqRf3uOs+CQAlnNSz0Q n+3Adi+tGUUFJ1WQCM2TQdR0a514H2XNUOf29OQvSBUnICJ4Nv0ih9BJKlunVGGYPkg/8LAT8h15z BK9ODO3jDwfBcGHEieqrzWQjQeyYFoApGSO4i1awgq5ZYZPMWyVjqNjBEaUvBSqCIh3gi3xVSmOwQ 56WEWRiNjfYYaEf0571g==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wTHaE-00000008fXu-3AWz; Sat, 30 May 2026 11:10:26 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wTHaB-00000008fXV-4Bc4 for linux-amlogic@lists.infradead.org; Sat, 30 May 2026 11:10:25 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 3C6D940194; Sat, 30 May 2026 11:10:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C6D71F00893; Sat, 30 May 2026 11:10:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780139423; bh=cRidFqpaHYJwIgtkoGwGJAGfQh466yyG3vrix1ctLvE=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=E3YU0GSJ3vEJvpjuF5qE+6zz37Ya7Iow9ybJp/xzhEmwl9kfzFYOf31VH4x+/IBoU LCyEjPNSAbr76mYhj0JD2sXlb3dCj6HGrvUMuJaXwleK8NZ3UfThPxbwswAaafWV9K xAtBCf/ZyajOpXzjbD7fA8pqUsOWy9b0apnb79FplU0XnAXkcSsCOAxT3ASat7NhYk 6PsDOE7iV/TIBKkBCusupxNMht7LI4dboY9BnLJXsTpGAdIlHH5jGtY4Z8a8teMSmO DGLD2yY6ZgyCR3PSz4Xtm2YbVlV9RKfieGaFmdXVMeGAW/5lpxIscdMLQhQPyE/n0p 9ywOSZnbbsmZg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v6 6/8] media: meson: vdec: Configure DMA mask and segment size in probe To: "Anand Moon" Cc: linux-media@vger.kernel.org, neil.armstrong@linaro.org, linux-amlogic@lists.infradead.org In-Reply-To: <20260530094326.11892-7-linux.amoon@gmail.com> References: <20260530094326.11892-7-linux.amoon@gmail.com> Date: Sat, 30 May 2026 11:10:22 +0000 Message-Id: <20260530111022.9C6D71F00893@smtp.kernel.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260530_041024_114017_24F37B86 X-CRM114-Status: GOOD ( 16.41 ) X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MiBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtDcml0aWNh bF0gQXBwbHlpbmcgYSA2NC1iaXQgRE1BIG1hc2sgY2F1c2VzIHNpbGVudCBwaHlzaWNhbCBhZGRy ZXNzIHRydW5jYXRpb24gYW5kIG1lbW9yeSBjb3JydXB0aW9uLCBhcyB0aGUgaGFyZHdhcmUgYW5k IGRyaXZlciBvbmx5IHN1cHBvcnQgMzItYml0IGFkZHJlc3Nlcy4KClByZS1leGlzdGluZyBpc3N1 ZXM6Ci0gW0hpZ2hdIFRoZSB2ZGVjIGRyaXZlciBzdG9yZXMgYSByYXcgcG9pbnRlciB0byB0aGUg YG1lc29uX2NhbnZhc2AgZGV2aWNlIHdpdGhvdXQgbGlua2luZyB0aGUgZGV2aWNlcyBvciBob2xk aW5nIGEgcmVmZXJlbmNlLCBsZWFkaW5nIHRvIGEgVXNlLUFmdGVyLUZyZWUgaWYgdGhlIGNhbnZh cyBwcm92aWRlciB1bmJpbmRzLgotLQoKY29tbWl0IDg5NWVmNDUzZDljNzVkZjA0ZmQ0MDM2NzEw MmY4ZWFmY2U3NmUwMTMKQXV0aG9yOiBBbmFuZCBNb29uIDxsaW51eC5hbW9vbkBnbWFpbC5jb20+ CgptZWRpYTogbWVzb246IHZkZWM6IENvbmZpZ3VyZSBETUEgbWFzayBhbmQgc2VnbWVudCBzaXpl IGluIHByb2JlCgpUaGUgdmRlYyBwcm9iZSByb3V0aW5lIGRpZCBub3Qgc2V0IGV4cGxpY2l0IERN QSBjb25zdHJhaW50cywgbGVhdmluZyB0aGUKZHJpdmVyIGRlcGVuZGVudCBvbiBwbGF0Zm9ybSBk ZWZhdWx0cy4gVGhpcyBjb3VsZCBjYXVzZSBhbGxvY2F0aW9uIGZhaWx1cmVzCm9yIGZyYWdtZW50 ZWQgYnVmZmVyIGhhbmRsaW5nIG9uIHN5c3RlbXMgd2l0aCBzdHJpY3RlciBETUEgbGltaXRzLiBU aGlzCmNoYW5nZSBjb25maWd1cmVzIGEgNjQtYml0IERNQSBtYXNrIGFuZCBzZXRzIHRoZSBtYXhp bXVtIGNvbnRpZ3VvdXMgc2VnbWVudApzaXplIHRvIFVJTlRfTUFYLgoKQ2xvc2VzOiBodHRwczov L2xvcmUua2VybmVsLm9yZy9hbGwvMjAyNjA1MjEwOTA5NDQuRjM1NDAxRjAwQTNEQHNtdHAua2Vy bmVsLm9yZy8KCj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvc3RhZ2luZy9tZWRpYS9tZXNvbi92ZGVj L3ZkZWMuYyBiL2RyaXZlcnMvc3RhZ2luZy9tZWRpYS9tZXNvbi92ZGVjL3ZkZWMuYwo+IGluZGV4 IDQ4ODRlZTA0YjM1MjkuLmY5OTMzNWVmZmUxNzYgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVycy9zdGFn aW5nL21lZGlhL21lc29uL3ZkZWMvdmRlYy5jCj4gKysrIGIvZHJpdmVycy9zdGFnaW5nL21lZGlh L21lc29uL3ZkZWMvdmRlYy5jCj4gQEAgLTEwNjQsNiArMTA2NCwxNSBAQCBzdGF0aWMgaW50IHZk ZWNfcHJvYmUoc3RydWN0IHBsYXRmb3JtX2RldmljZSAqcGRldikKPiAgCWlmIChJU19FUlIoY29y ZS0+Y2FudmFzKSkKPiAgCQlyZXR1cm4gUFRSX0VSUihjb3JlLT5jYW52YXMpOwoKW1NldmVyaXR5 OiBIaWdoXQpUaGlzIGlzbid0IGEgYnVnIGludHJvZHVjZWQgYnkgdGhpcyBwYXRjaCwgYnV0IGNh biB3ZSBleHBlcmllbmNlIGEKdXNlLWFmdGVyLWZyZWUgaGVyZSBpZiB0aGUgY2FudmFzIHByb3Zp ZGVyIHVuYmluZHM/CgpMb29raW5nIGF0IG1lc29uX2NhbnZhc19nZXQoKSwgdGhlIHJlZmVyZW5j ZSB0byB0aGUgcHJvdmlkZXIgZGV2aWNlIGlzCmRyb3BwZWQgaW1tZWRpYXRlbHkgYmVmb3JlIHJl dHVybmluZyB0aGUgaW50ZXJuYWwgY2FudmFzIHBvaW50ZXI6Cgpkcml2ZXJzL3NvYy9hbWxvZ2lj L21lc29uLWNhbnZhcy5jOm1lc29uX2NhbnZhc19nZXQoKSB7CiAgICAuLi4KICAgIHB1dF9kZXZp Y2UoJmNhbnZhc19wZGV2LT5kZXYpOwogICAgcmV0dXJuIGNhbnZhczsKfQoKU2luY2UgdGhlIHZk ZWMgZHJpdmVyIHN0b3JlcyB0aGlzIHBvaW50ZXIgaW4gY29yZS0+Y2FudmFzIGJ1dCBkb2VzIG5v dAplc3RhYmxpc2ggYSBkZXZpY2UgbGluayBvciBob2xkIGEgbW9kdWxlIHJlZmVyZW5jZSwgd2hh dCBwcmV2ZW50cyB0aGUKY2FudmFzIG1lbW9yeSBmcm9tIGJlaW5nIGZyZWVkIGJ5IGRldnJlcyB3 aGlsZSB0aGUgdmRlYyBkcml2ZXIgaXMgc3RpbGwKdXNpbmcgaXQ/Cgo+ICAKPiArCXJldCA9IGRt YV9zZXRfbWFza19hbmRfY29oZXJlbnQoZGV2LCBETUFfQklUX01BU0soNjQpKTsKCltTZXZlcml0 eTogQ3JpdGljYWxdCldpbGwgc2V0dGluZyBhIDY0LWJpdCBETUEgbWFzayBjYXVzZSBzaWxlbnQg cGh5c2ljYWwgYWRkcmVzcyB0cnVuY2F0aW9uPwoKVGhlIE1lc29uIFZERUMgaGFyZHdhcmUgbmF0 aXZlbHkgdXNlcyAzMi1iaXQgcmVnaXN0ZXJzIGZvciBETUEgYWRkcmVzc2VzLAphbmQgdGhlIGRy aXZlcidzIGhlbHBlciBmdW5jdGlvbnMgc3RyaWN0bHkgYWNjZXB0IDMyLWJpdCB2YWx1ZXM6Cgpk cml2ZXJzL3N0YWdpbmcvbWVkaWEvbWVzb24vdmRlYy92ZGVjX2hlbHBlcnMuaDoKdm9pZCBhbXZk ZWNfd3JpdGVfZG9zKHN0cnVjdCBhbXZkZWNfY29yZSAqY29yZSwgdTMyIHJlZywgdTMyIHZhbCk7 CgpJZiB0aGUgRE1BIEFQSSBhbGxvY2F0ZXMgbWVtb3J5IGJ1ZmZlcnMgYXQgcGh5c2ljYWwgYWRk cmVzc2VzIGFib3ZlIDRHQiwKdGhlaXIgNjQtYml0IGFkZHJlc3NlcyB3aWxsIGJlIGltcGxpY2l0 bHkgdHJ1bmNhdGVkIHRvIDMyIGJpdHMgd2hlbiBwYXNzZWQKdG8gdGhlIGhhcmR3YXJlIHJlZ2lz dGVycy4KCkNhbiB0aGlzIGxlYWQgdG8gdGhlIGhhcmR3YXJlIHJlYWRpbmcgb3Igd3JpdGluZyB0 byBpbmNvcnJlY3QgcGh5c2ljYWwKbWVtb3J5IGxvY2F0aW9ucyBpbiB0aGUgbG93ZXIgNEdCPwoK PiArCWlmIChyZXQpCj4gKwkJcmV0dXJuIGRldl9lcnJfcHJvYmUoZGV2LCByZXQsICJGYWlsZWQg dG8gc2V0IERNQSBtYXNrXG4iKTsKPiArCj4gKwlyZXQgPSB2YjJfZG1hX2NvbnRpZ19zZXRfbWF4 X3NlZ19zaXplKGRldiwgVUlOVF9NQVgpOwo+ICsJaWYgKHJldCkKPiArCQlyZXR1cm4gZGV2X2Vy cl9wcm9iZShkZXYsIHJldCwKPiArCQkJCSAgICAgIkZhaWxlZCB0byBzZXQgRE1BIG1heCBzZWdt ZW50IHNpemVcbiIpOwo+ICsKPiAgCW9mX2lkID0gb2ZfbWF0Y2hfbm9kZSh2ZGVjX2R0X21hdGNo LCBkZXYtPm9mX25vZGUpOwo+ICAJY29yZS0+cGxhdGZvcm0gPSBvZl9pZC0+ZGF0YTsKCi0tIApT YXNoaWtvIEFJIHJldmlldyDCtyBodHRwczovL3Nhc2hpa28uZGV2LyMvcGF0Y2hzZXQvMjAyNjA1 MzAwOTQzMjYuMTE4OTItMS1saW51eC5hbW9vbkBnbWFpbC5jb20/cGFydD02CgpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpsaW51eC1hbWxvZ2ljIG1haWxp bmcgbGlzdApsaW51eC1hbWxvZ2ljQGxpc3RzLmluZnJhZGVhZC5vcmcKaHR0cDovL2xpc3RzLmlu ZnJhZGVhZC5vcmcvbWFpbG1hbi9saXN0aW5mby9saW51eC1hbWxvZ2ljCg==