Skip to content

cam_hal/ll_cam: avoid ISR queue use-after-free; fully quiesce DMA on stop #784

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

RubenKelevra
Copy link
Contributor

@RubenKelevra RubenKelevra commented Aug 4, 2025

PR requires the following PRs to be merged first, and thus contains their commits:

Description

In PSRAM DMA mode the driver could dereference a deleted event queue and
leave EOF interrupts armed after shutdown, leading to late ISRs and NPDs.

Changes:

  • ll_cam_send_event(): return early if event_queue is NULL; use a local
    woken and propagate to caller via hp when non-NULL.
  • cam_deinit(): call cam_stop() before deleting queues; NULL out
    event_queue and frame_buffer_queue after vQueueDelete().
  • ll_cam_stop(): disable all GDMA IN interrupts and clear them with a
    full W1C mask; stop CAM_START and halt link.
  • ll_cam_start(): clear all interrupts, then enable only IN_SUC_EOF.
  • ll_cam_dma_reset(): use 0xFFFFFFFF W1C mask for int_clr.
  • ISRs (VSYNC/DMA): use hp variable and portYIELD_FROM_ISR() if set.
  • cam_obj.state: mark as volatile.
  • Headers: update ll_cam_send_event() signature to BaseType_t *hp.

Result: no null-pointer derefs or late interrupts after teardown; ISR
wakeups propagate correctly and the DMA path restarts cleanly.

Testing

Does fix some crashes, but not everything in psram_mode with JPEGs.


Checklist

Before submitting a Pull Request, please ensure the following:

  • 🚨 This PR does not introduce breaking changes.
  • All CI checks (GH Actions) pass.
  • Documentation is updated as needed.
  • Tests are updated or added as necessary.
  • Code is well-commented, especially in complex areas.
  • Git history is clean — commits are squashed to the minimum necessary.

@me-no-dev
Copy link
Member

@RubenKelevra please resolve the conflicts and update the branch with latest master

@RubenKelevra
Copy link
Contributor Author

@me-no-dev this fix is not yet ready for prime time and is causing issues. I will work on it a bit more and then remove the draft mark.

…stop

In PSRAM DMA mode the driver could dereference a deleted event queue and
leave EOF interrupts armed after shutdown, leading to late ISRs and NPDs.

Changes:
- ll_cam_send_event(): return early if event_queue is NULL; use a local
  `woken` and propagate to caller via `hp` when non-NULL.
- cam_deinit(): call cam_stop() before deleting queues; NULL out
  event_queue and frame_buffer_queue after vQueueDelete().
- ll_cam_stop(): disable all GDMA IN interrupts and clear them with a
  full W1C mask; stop CAM_START and halt link.
- ll_cam_start(): clear all interrupts, then enable only IN_SUC_EOF.
- ll_cam_dma_reset(): use 0xFFFFFFFF W1C mask for int_clr.
- ISRs (VSYNC/DMA): use `hp` variable and portYIELD_FROM_ISR() if set.
- cam_obj.state: mark as volatile.
- Headers: update ll_cam_send_event() signature to `BaseType_t *hp`.

Result: no null-pointer derefs or late interrupts after teardown; ISR
wakeups propagate correctly and the DMA path restarts cleanly.
@RubenKelevra RubenKelevra force-pushed the fix/nullpointer_dereference_in_psram_mode branch from a94e277 to 9a95a22 Compare August 5, 2025 19:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants