Re: [PATCH v13 17/20] media/v4l2-core, arm64: untag user pointers in videobuf_dma_contig_user_get

Kevin Brodsky
2019-03-25T14:08:30Z

On 22/03/2019 16:07, Catalin Marinas wrote:
> On Wed, Mar 20, 2019 at 03:51:31PM +0100, Andrey Konovalov wrote:
>> This patch is a part of a series that extends arm64 kernel ABI to allow to
>> pass tagged user pointers (with the top byte set to something else other
>> than 0x00) as syscall arguments.
>>
>> videobuf_dma_contig_user_get() uses provided user pointers for vma
>> lookups, which can only by done with untagged pointers.
>>
>> Untag the pointers in this function.
>>
>> Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
>> ---
>> drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++----
>> 1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
>> index e1bf50df4c70..8a1ddd146b17 100644
>> --- a/drivers/media/v4l2-core/videobuf-dma-contig.c
>> +++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
>> @@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem)
>> static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
>> struct videobuf_buffer *vb)
>> {
>> + unsigned long untagged_baddr = untagged_addr(vb->baddr);
>> struct mm_struct *mm = current->mm;
>> struct vm_area_struct *vma;
>> unsigned long prev_pfn, this_pfn;
>> @@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
>> unsigned int offset;
>> int ret;
>>
>> - offset = vb->baddr & ~PAGE_MASK;
>> + offset = untagged_baddr & ~PAGE_MASK;
>> mem->size = PAGE_ALIGN(vb->size + offset);
>> ret = -EINVAL;
>>
>> down_read(&mm->mmap_sem);
>>
>> - vma = find_vma(mm, vb->baddr);
>> + vma = find_vma(mm, untagged_baddr);
>> if (!vma)
>> goto out_up;
>>
>> - if ((vb->baddr + mem->size) > vma->vm_end)
>> + if ((untagged_baddr + mem->size) > vma->vm_end)
>> goto out_up;
>>
>> pages_done = 0;
>> prev_pfn = 0; /* kill warning */
>> - user_address = vb->baddr;
>> + user_address = untagged_baddr;
>>
>> while (pages_done < (mem->size >> PAGE_SHIFT)) {
>> ret = follow_pfn(vma, user_address, &this_pfn);
> I don't think vb->baddr here is anonymous mmap() but worth checking the
> call paths.

I spent some time on this, I didn't find any restriction on the kind of mapping
that's allowed here. The API regarding V4L2_MEMORY_USERPTR doesn't seem to say
anything about that either [0] [1]. It's probably best to ask the V4L2 maintainers.

Kevin

[0] https://www.kernel.org/doc/html/latest/media/uapi/v4l/vidioc-qbuf.html
[1] https://www.kernel.org/doc/html/latest/media/uapi/v4l/userp.html