[PATCH v13 17/20] media/v4l2-core, arm64: untag user pointers in videobuf_dma_contig_user_get

[Kevin Brodsky]

On 22/03/2019 16:07, Catalin Marinas wrote:
> On Wed, Mar 20, 2019 at 03:51:31PM +0100, Andrey Konovalov wrote:
>> This patch is a part of a series that extends arm64 kernel ABI to allow to
>> pass tagged user pointers (with the top byte set to something else other
>> than 0x00) as syscall arguments.
>>
>> videobuf_dma_contig_user_get() uses provided user pointers for vma
>> lookups, which can only by done with untagged pointers.
>>
>> Untag the pointers in this function.
>>
>> Signed-off-by: Andrey Konovalov <andreyknvl at google.com>
>> ---
>>   drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++----
>>   1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
>> index e1bf50df4c70..8a1ddd146b17 100644
>> --- a/drivers/media/v4l2-core/videobuf-dma-contig.c
>> +++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
>> @@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem)
>>   static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
>>   					struct videobuf_buffer *vb)
>>   {
>> +	unsigned long untagged_baddr = untagged_addr(vb->baddr);
>>   	struct mm_struct *mm = current->mm;
>>   	struct vm_area_struct *vma;
>>   	unsigned long prev_pfn, this_pfn;
>> @@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
>>   	unsigned int offset;
>>   	int ret;
>>   
>> -	offset = vb->baddr & ~PAGE_MASK;
>> +	offset = untagged_baddr & ~PAGE_MASK;
>>   	mem->size = PAGE_ALIGN(vb->size + offset);
>>   	ret = -EINVAL;
>>   
>>   	down_read(&mm->mmap_sem);
>>   
>> -	vma = find_vma(mm, vb->baddr);
>> +	vma = find_vma(mm, untagged_baddr);
>>   	if (!vma)
>>   		goto out_up;
>>   
>> -	if ((vb->baddr + mem->size) > vma->vm_end)
>> +	if ((untagged_baddr + mem->size) > vma->vm_end)
>>   		goto out_up;
>>   
>>   	pages_done = 0;
>>   	prev_pfn = 0; /* kill warning */
>> -	user_address = vb->baddr;
>> +	user_address = untagged_baddr;
>>   
>>   	while (pages_done < (mem->size >> PAGE_SHIFT)) {
>>   		ret = follow_pfn(vma, user_address, &this_pfn);
> I don't think vb->baddr here is anonymous mmap() but worth checking the
> call paths.

I spent some time on this, I didn't find any restriction on the kind of mapping 
that's allowed here. The API regarding V4L2_MEMORY_USERPTR doesn't seem to say 
anything about that either [0] [1]. It's probably best to ask the V4L2 maintainers.

Kevin

[0] https://www.kernel.org/doc/html/latest/media/uapi/v4l/vidioc-qbuf.html
[1] https://www.kernel.org/doc/html/latest/media/uapi/v4l/userp.html