Page MenuHomeFreeBSD

uvideo: replace contigmalloc with OBJT_PHYS vm_object for mmap buffer
ClosedPublic

Authored by bapt on Jul 22 2026, 1:09 PM.
Tags
None
Referenced Files
F169576251: D58394.id182454.diff
Tue, Sep 1, 11:22 PM
F169552838: D58394.id182463.diff
Tue, Sep 1, 9:52 PM
F169498913: D58394.id182453.diff
Tue, Sep 1, 5:31 PM
F169484251: D58394.id.diff
Tue, Sep 1, 4:14 PM
F169344155: D58394.id182463.diff
Tue, Sep 1, 6:23 AM
Unknown Object (File)
Mon, Aug 31, 5:30 PM
Unknown Object (File)
Mon, Aug 31, 12:36 AM
Unknown Object (File)
Sun, Aug 30, 8:28 PM
Subscribers

Details

Summary

Allocate the mmap buffer via phys_pager_allocate() and map it into
kernel space with vm_map_find()/vm_map_wire(), instead of a custom
cdev_pager backed by contigmalloc. phys_pager_allocate() is required
over a bare vm_object_allocate(OBJT_PHYS) to initialise un_pager.phys.ops,
otherwise phys_pager_getpages() NULL-derefs during vm_map_wire().

Reported by: markj

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

bapt requested review of this revision.Jul 22 2026, 1:09 PM
markj added inline comments.
sys/dev/usb/video/uvideo.c
3588

I believe this vm_object_deallocate() is wrong and should be removed. The vm_map_find() call above consumes a reference to obj, and then the vm_map_remove() call releases that reference. See the comment above vm_map_find().

I believe uvideo_vs_free_frame() has the same problem, it calls vm_map_remove(), which releases the original reference, then calls vm_object_deallocate() again.

address @markj's comment about deallocate

bapt marked an inline comment as done.Jul 22 2026, 1:40 PM

Seems fine. There are other problems in the cdev methods, but this change on its own looks ok.

sys/dev/usb/video/uvideo.c
3115

Can this addition overflow?

This revision is now accepted and ready to land.Jul 22 2026, 1:48 PM