Page MenuHomeFreeBSD

uvideo: replace contigmalloc with OBJT_PHYS vm_object for mmap buffer
ClosedPublic

Authored by bapt on Jul 22 2026, 1:09 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Sep 16, 4:01 PM
Unknown Object (File)
Tue, Sep 15, 4:38 AM
Unknown Object (File)
Mon, Sep 14, 4:02 AM
Unknown Object (File)
Mon, Sep 14, 4:01 AM
Unknown Object (File)
Mon, Sep 14, 3:58 AM
Unknown Object (File)
Sun, Sep 13, 3:44 AM
Unknown Object (File)
Fri, Sep 11, 4:18 AM
Unknown Object (File)
Fri, Sep 11, 4:18 AM
Subscribers

Details

Summary

Allocate the mmap buffer via phys_pager_allocate() and map it into
kernel space with vm_map_find()/vm_map_wire(), instead of a custom
cdev_pager backed by contigmalloc. phys_pager_allocate() is required
over a bare vm_object_allocate(OBJT_PHYS) to initialise un_pager.phys.ops,
otherwise phys_pager_getpages() NULL-derefs during vm_map_wire().

Reported by: markj

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

bapt requested review of this revision.Jul 22 2026, 1:09 PM
markj added inline comments.
sys/dev/usb/video/uvideo.c
3588

I believe this vm_object_deallocate() is wrong and should be removed. The vm_map_find() call above consumes a reference to obj, and then the vm_map_remove() call releases that reference. See the comment above vm_map_find().

I believe uvideo_vs_free_frame() has the same problem, it calls vm_map_remove(), which releases the original reference, then calls vm_object_deallocate() again.

address @markj's comment about deallocate

bapt marked an inline comment as done.Jul 22 2026, 1:40 PM

Seems fine. There are other problems in the cdev methods, but this change on its own looks ok.

sys/dev/usb/video/uvideo.c
3115

Can this addition overflow?

This revision is now accepted and ready to land.Jul 22 2026, 1:48 PM