Re: [PATCH v17 4/8] media: core: Add bitmap manage bufs array entries

From: Hans Verkuil
Date: Wed Jan 24 2024 - 06:52:19 EST

Next message: Eric Dumazet: "Re: [PATCH 1/1] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()"
Previous message: Di Shen: "[PATCH] thermal: power_allocator: initialize params->sustainable_power in the bind callback"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On 19/01/2024 10:49, Benjamin Gaignard wrote:
> Add a bitmap field to know which of bufs array entries are
> used or not.
> Remove no more used num_buffers field from queue structure.
> Use bitmap_find_next_zero_area() to find the first possible
> range when creating new buffers to fill the gaps.
> If no suitable range is found try to allocate less buffers
> than requested.
>
> Signed-off-by: Benjamin Gaignard <benjamin.gaignard@xxxxxxxxxxxxx>
> ---
> version 17:
> - allow to allocate less buffers than requested in __vb2_queue_alloc()
> when using bitmap.
> - add vb2_core_allocated_queue_buffers_storage() and
> vb2_core_free_queue_buffers_storage() to avoid duplicate code.
> .../media/common/videobuf2/videobuf2-core.c | 71 ++++++++++++++-----
> include/media/videobuf2-core.h | 18 +++--
> 2 files changed, 64 insertions(+), 25 deletions(-)
>
> diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
> index fd5ac2845018..45cbdfaf72b5 100644
> --- a/drivers/media/common/videobuf2/videobuf2-core.c
> +++ b/drivers/media/common/videobuf2/videobuf2-core.c
> @@ -421,11 +421,12 @@ static void init_buffer_cache_hints(struct vb2_queue *q, struct vb2_buffer *vb)
> */
> static void vb2_queue_add_buffer(struct vb2_queue *q, struct vb2_buffer *vb, unsigned int index)
> {
> - WARN_ON(index >= q->max_num_buffers || q->bufs[index] || vb->vb2_queue);
> + WARN_ON(index >= q->max_num_buffers || test_bit(index, q->bufs_bitmap) || vb->vb2_queue);
>
> q->bufs[index] = vb;
> vb->index = index;
> vb->vb2_queue = q;
> + set_bit(index, q->bufs_bitmap);
> }
>
> /**
> @@ -434,6 +435,7 @@ static void vb2_queue_add_buffer(struct vb2_queue *q, struct vb2_buffer *vb, uns
> */
> static void vb2_queue_remove_buffer(struct vb2_buffer *vb)
> {
> + clear_bit(vb->index, vb->vb2_queue->bufs_bitmap);
> vb->vb2_queue->bufs[vb->index] = NULL;
> vb->vb2_queue = NULL;
> }
> @@ -452,9 +454,9 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory,
> const unsigned int plane_sizes[VB2_MAX_PLANES],
> unsigned int *first_index)
> {
> - unsigned int q_num_buffers = vb2_get_num_buffers(q);
> unsigned int buffer, plane;
> struct vb2_buffer *vb;
> + unsigned long index = 0;

0 -> q->max_num_buffers

This ensure an error occurs in case num_buffers == 0 (which it should never
be, but you never know) with the 'while' code suggested below.

> int ret;
>
> /*
> @@ -462,9 +464,25 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory,
> * in the queue is below q->max_num_buffers
> */
> num_buffers = min_t(unsigned int, num_buffers,
> - q->max_num_buffers - q_num_buffers);
> + q->max_num_buffers - vb2_get_num_buffers(q));
> +
> +again:
> + index = bitmap_find_next_zero_area(q->bufs_bitmap, q->max_num_buffers,
> + 0, num_buffers, 0);
> +
> + /* Try to find free space for less buffers */
> + if (index >= q->max_num_buffers && num_buffers) {
> + num_buffers--;
> + goto again;
> + }

Hmm, this is really just a:

while (num_buffers) {
index = bitmap_find_next_zero_area(q->bufs_bitmap, q->max_num_buffers,
0, num_buffers, 0);

if (index < q->max_num_buffers)
break;
/* Try to find free space for less buffers */
num_buffers--;
}

This avoids the ugly goto.

>
> - *first_index = q_num_buffers;
> + /* If there is no space left to allocate buffers return 0 to indicate the error */
> + if (index >= q->max_num_buffers) {
> + *first_index = 0;
> + return 0;
> + }
> +
> + *first_index = index;
>
> for (buffer = 0; buffer < num_buffers; ++buffer) {
> /* Allocate vb2 buffer structures */
> @@ -484,7 +502,7 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory,
> vb->planes[plane].min_length = plane_sizes[plane];
> }
>
> - vb2_queue_add_buffer(q, vb, q_num_buffers + buffer);
> + vb2_queue_add_buffer(q, vb, index++);
> call_void_bufop(q, init_buffer, vb);
>
> /* Allocate video buffer memory for the MMAP type */
> @@ -664,7 +682,6 @@ static void __vb2_queue_free(struct vb2_queue *q, unsigned int buffers)
> kfree(vb);
> }
>
> - q->num_buffers -= buffers;
> if (!vb2_get_num_buffers(q)) {
> q->memory = VB2_MEMORY_UNKNOWN;
> INIT_LIST_HEAD(&q->queued_list);
> @@ -818,6 +835,32 @@ static bool verify_coherency_flags(struct vb2_queue *q, bool non_coherent_mem)
> return true;
> }
>
> +static int vb2_core_allocated_queue_buffers_storage(struct vb2_queue *q)

I think vb2_core_allocate_buffers_storage is a better name.

> +{
> + if (!q->bufs)
> + q->bufs = kcalloc(q->max_num_buffers, sizeof(*q->bufs), GFP_KERNEL);
> + if (!q->bufs)
> + return -ENOMEM;
> +
> + if (!q->bufs_bitmap)
> + q->bufs_bitmap = bitmap_zalloc(q->max_num_buffers, GFP_KERNEL);
> + if (!q->bufs_bitmap) {
> + kfree(q->bufs);
> + q->bufs = NULL;
> + return -ENOMEM;
> + }
> +
> + return 0;
> +}
> +
> +static void vb2_core_free_queue_buffers_storage(struct vb2_queue *q)

Drop the "_queue" part here as well.

> +{
> + kfree(q->bufs);
> + q->bufs = NULL;
> + bitmap_free(q->bufs_bitmap);
> + q->bufs_bitmap = NULL;
> +}
> +
> int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
> unsigned int flags, unsigned int *count)
> {
> @@ -878,10 +921,7 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
> * in the queue_setup op.
> */
> mutex_lock(&q->mmap_lock);
> - if (!q->bufs)
> - q->bufs = kcalloc(q->max_num_buffers, sizeof(*q->bufs), GFP_KERNEL);
> - if (!q->bufs)
> - ret = -ENOMEM;
> + ret = vb2_core_allocated_queue_buffers_storage(q);
> q->memory = memory;
> mutex_unlock(&q->mmap_lock);
> if (ret)
> @@ -953,7 +993,6 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
> }
>
> mutex_lock(&q->mmap_lock);
> - q->num_buffers = allocated_buffers;
>
> if (ret < 0) {
> /*
> @@ -980,6 +1019,7 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
> mutex_lock(&q->mmap_lock);
> q->memory = VB2_MEMORY_UNKNOWN;
> mutex_unlock(&q->mmap_lock);
> + vb2_core_free_queue_buffers_storage(q);
> return ret;
> }
> EXPORT_SYMBOL_GPL(vb2_core_reqbufs);
> @@ -1013,11 +1053,8 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
> * value in the queue_setup op.
> */
> mutex_lock(&q->mmap_lock);
> + ret = vb2_core_allocated_queue_buffers_storage(q);
> q->memory = memory;
> - if (!q->bufs)
> - q->bufs = kcalloc(q->max_num_buffers, sizeof(*q->bufs), GFP_KERNEL);
> - if (!q->bufs)
> - ret = -ENOMEM;
> mutex_unlock(&q->mmap_lock);
> if (ret)
> return ret;
> @@ -1080,7 +1117,6 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
> }
>
> mutex_lock(&q->mmap_lock);
> - q->num_buffers += allocated_buffers;
>
> if (ret < 0) {
> /*
> @@ -2579,8 +2615,7 @@ void vb2_core_queue_release(struct vb2_queue *q)
> __vb2_queue_cancel(q);
> mutex_lock(&q->mmap_lock);
> __vb2_queue_free(q, vb2_get_num_buffers(q));
> - kfree(q->bufs);
> - q->bufs = NULL;
> + vb2_core_free_queue_buffers_storage(q);
> mutex_unlock(&q->mmap_lock);
> }
> EXPORT_SYMBOL_GPL(vb2_core_queue_release);
> diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h
> index e29ff77814d3..8647eee348bd 100644
> --- a/include/media/videobuf2-core.h
> +++ b/include/media/videobuf2-core.h
> @@ -346,8 +346,8 @@ struct vb2_buffer {
> * describes the requested number of planes and sizes\[\]
> * contains the requested plane sizes. In this case
> * \*num_buffers are being allocated additionally to
> - * q->num_buffers. If either \*num_planes or the requested
> - * sizes are invalid callback must return %-EINVAL.
> + * the buffers already allocated. If either \*num_planes
> + * or the requested sizes are invalid callback must return %-EINVAL.
> * @wait_prepare: release any locks taken while calling vb2 functions;
> * it is called before an ioctl needs to wait for a new
> * buffer to arrive; required to avoid a deadlock in
> @@ -571,8 +571,9 @@ struct vb2_buf_ops {
> * @mmap_lock: private mutex used when buffers are allocated/freed/mmapped
> * @memory: current memory type used
> * @dma_dir: DMA mapping direction.
> - * @bufs: videobuf2 buffer structures
> - * @num_buffers: number of allocated/used buffers
> + * @bufs: videobuf2 buffer structures. If it is non-NULL then
> + * bufs_bitmap is also non-NULL.
> + * @bufs_bitmap: bitmap tracking whether each bufs[] entry is used
> * @max_num_buffers: upper limit of number of allocated/used buffers.
> * If set to 0 v4l2 core will change it VB2_MAX_FRAME
> * for backward compatibility.
> @@ -639,7 +640,7 @@ struct vb2_queue {
> unsigned int memory;
> enum dma_data_direction dma_dir;
> struct vb2_buffer **bufs;
> - unsigned int num_buffers;
> + unsigned long *bufs_bitmap;
> unsigned int max_num_buffers;
>
> struct list_head queued_list;
> @@ -1168,7 +1169,10 @@ static inline bool vb2_fileio_is_active(struct vb2_queue *q)
> */
> static inline unsigned int vb2_get_num_buffers(struct vb2_queue *q)
> {
> - return q->num_buffers;
> + if (q->bufs_bitmap)
> + return bitmap_weight(q->bufs_bitmap, q->max_num_buffers);
> +
> + return 0;
> }
>
> /**
> @@ -1277,7 +1281,7 @@ static inline struct vb2_buffer *vb2_get_buffer(struct vb2_queue *q,
> if (index >= q->max_num_buffers)
> return NULL;
>
> - if (index < q->num_buffers)
> + if (test_bit(index, q->bufs_bitmap))
> return q->bufs[index];
> return NULL;
> }

Regards,

Hans

Next message: Eric Dumazet: "Re: [PATCH 1/1] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()"
Previous message: Di Shen: "[PATCH] thermal: power_allocator: initialize params->sustainable_power in the bind callback"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]