Page MenuHomeFreeBSD

uvideo: replace contigmalloc with OBJT_PHYS vm_object for mmap buffer
ClosedPublic

Authored by bapt on Jul 22 2026, 1:09 PM.
Tags
None
Referenced Files
F167860578: D58394.id182453.diff
Tue, Aug 25, 1:44 AM
Unknown Object (File)
Wed, Aug 19, 10:55 AM
Unknown Object (File)
Wed, Aug 19, 4:25 AM
Unknown Object (File)
Tue, Aug 18, 7:24 AM
Unknown Object (File)
Sat, Aug 15, 11:17 AM
Unknown Object (File)
Thu, Aug 13, 1:37 AM
Unknown Object (File)
Mon, Aug 10, 5:03 AM
Unknown Object (File)
Sat, Aug 8, 6:25 PM
Subscribers

Details

Summary

Allocate the mmap buffer via phys_pager_allocate() and map it into
kernel space with vm_map_find()/vm_map_wire(), instead of a custom
cdev_pager backed by contigmalloc. phys_pager_allocate() is required
over a bare vm_object_allocate(OBJT_PHYS) to initialise un_pager.phys.ops,
otherwise phys_pager_getpages() NULL-derefs during vm_map_wire().

Reported by: markj

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

bapt requested review of this revision.Jul 22 2026, 1:09 PM
markj added inline comments.
sys/dev/usb/video/uvideo.c
3588

I believe this vm_object_deallocate() is wrong and should be removed. The vm_map_find() call above consumes a reference to obj, and then the vm_map_remove() call releases that reference. See the comment above vm_map_find().

I believe uvideo_vs_free_frame() has the same problem, it calls vm_map_remove(), which releases the original reference, then calls vm_object_deallocate() again.

address @markj's comment about deallocate

bapt marked an inline comment as done.Jul 22 2026, 1:40 PM

Seems fine. There are other problems in the cdev methods, but this change on its own looks ok.

sys/dev/usb/video/uvideo.c
3115

Can this addition overflow?

This revision is now accepted and ready to land.Jul 22 2026, 1:48 PM