[PATCH v13 17/20] media/v4l2-core, arm64: untag user pointers in videobuf_dma_contig_user_get

[Andrey Konovalov]

On Mon, Mar 25, 2019 at 3:08 PM Kevin Brodsky <kevin.brodsky at arm.com> wrote:
>
> On 22/03/2019 16:07, Catalin Marinas wrote:
> > On Wed, Mar 20, 2019 at 03:51:31PM +0100, Andrey Konovalov wrote:
> >> This patch is a part of a series that extends arm64 kernel ABI to allow to
> >> pass tagged user pointers (with the top byte set to something else other
> >> than 0x00) as syscall arguments.
> >>
> >> videobuf_dma_contig_user_get() uses provided user pointers for vma
> >> lookups, which can only by done with untagged pointers.
> >>
> >> Untag the pointers in this function.
> >>
> >> Signed-off-by: Andrey Konovalov <andreyknvl at google.com>
> >> ---
> >>   drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++----
> >>   1 file changed, 5 insertions(+), 4 deletions(-)
> >>
> >> diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
> >> index e1bf50df4c70..8a1ddd146b17 100644
> >> --- a/drivers/media/v4l2-core/videobuf-dma-contig.c
> >> +++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
> >> @@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem)
> >>   static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
> >>                                      struct videobuf_buffer *vb)
> >>   {
> >> +    unsigned long untagged_baddr = untagged_addr(vb->baddr);
> >>      struct mm_struct *mm = current->mm;
> >>      struct vm_area_struct *vma;
> >>      unsigned long prev_pfn, this_pfn;
> >> @@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
> >>      unsigned int offset;
> >>      int ret;
> >>
> >> -    offset = vb->baddr & ~PAGE_MASK;
> >> +    offset = untagged_baddr & ~PAGE_MASK;
> >>      mem->size = PAGE_ALIGN(vb->size + offset);
> >>      ret = -EINVAL;
> >>
> >>      down_read(&mm->mmap_sem);
> >>
> >> -    vma = find_vma(mm, vb->baddr);
> >> +    vma = find_vma(mm, untagged_baddr);
> >>      if (!vma)
> >>              goto out_up;
> >>
> >> -    if ((vb->baddr + mem->size) > vma->vm_end)
> >> +    if ((untagged_baddr + mem->size) > vma->vm_end)
> >>              goto out_up;
> >>
> >>      pages_done = 0;
> >>      prev_pfn = 0; /* kill warning */
> >> -    user_address = vb->baddr;
> >> +    user_address = untagged_baddr;
> >>
> >>      while (pages_done < (mem->size >> PAGE_SHIFT)) {
> >>              ret = follow_pfn(vma, user_address, &this_pfn);
> > I don't think vb->baddr here is anonymous mmap() but worth checking the
> > call paths.

The call path is
__videobuf_iolock()->videobuf_dma_contig_user_get()->find_vma().

>
> I spent some time on this, I didn't find any restriction on the kind of mapping
> that's allowed here. The API regarding V4L2_MEMORY_USERPTR doesn't seem to say
> anything about that either [0] [1]. It's probably best to ask the V4L2 maintainers.

Mauro, could you comment on whether the vb->baddr argument for the
V4L2_MEMORY_USERPTR API can come from an anonymous memory mapping?

>
> Kevin
>
> [0] https://www.kernel.org/doc/html/latest/media/uapi/v4l/vidioc-qbuf.html
> [1] https://www.kernel.org/doc/html/latest/media/uapi/v4l/userp.html