duff/android_kernel_motorola_sm6225
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: ope: Avoid submitting NULL request to CDM

Browse Source 
In corner case, there is a chance that userspace can submit
request while flush is ongoing. In some cases submitted request
can get flushed and corresponding data structures  memory gets
freed.

Add a logic to check for pending request before submitting request
to cdm hw.

CRs-Fixed: 2815901
Change-Id: I74096201e204f204c4f15d14698b4e9af6435f55
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
This commit is contained in:
Alok Chauhan committed 2020-11-10 16:05:10 +05:30
1 parent 86afe4d27e
commit b91c235d7f
1 file changed
+15 -6
Download Patch File Download Diff File Expand all files Collapse all files
drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c
+15 -6
View File
@@ -81,6 +81,11 @@ end:
return rsc_idx;
}
static bool cam_ope_is_pending_request(struct cam_ope_ctx *ctx_data)
{
return !bitmap_empty(ctx_data->bitmap, CAM_CTX_REQ_MAX);
}
static int cam_ope_mgr_process_cmd(void *priv, void *data)
{
int rc;
@@ -96,14 +101,16 @@ static int cam_ope_mgr_process_cmd(void *priv, void *data)
ctx_data = priv;
task_data = (struct ope_cmd_work_data *)data;
mutex_lock(&hw_mgr->hw_mgr_mutex);
cdm_cmd = task_data->data;
if (!cdm_cmd) {
CAM_ERR(CAM_OPE, "Invalid params%pK", cdm_cmd);
mutex_unlock(&hw_mgr->hw_mgr_mutex);
return -EINVAL;
}
mutex_lock(&hw_mgr->hw_mgr_mutex);
if (ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) {
mutex_unlock(&hw_mgr->hw_mgr_mutex);
CAM_ERR(CAM_OPE, "ctx id :%u is not in use",
@@ -119,6 +126,13 @@ static int cam_ope_mgr_process_cmd(void *priv, void *data)
return -EINVAL;
}
if (!cam_ope_is_pending_request(ctx_data)) {
CAM_WARN(CAM_OPE, "no pending req, req %lld last flush %lld",
task_data->req_id, ctx_data->last_flush_req);
mutex_unlock(&hw_mgr->hw_mgr_mutex);
return -EINVAL;
}
CAM_DBG(CAM_OPE,
"cam_cdm_submit_bls: handle 0x%x, ctx_id %d req %d cookie %d",
ctx_data->ope_cdm.cdm_handle, ctx_data->ctx_id,
@@ -256,11 +270,6 @@ static int cam_ope_mgr_reapply_config(struct cam_ope_hw_mgr *hw_mgr,
return rc;
}
static bool cam_ope_is_pending_request(struct cam_ope_ctx *ctx_data)
{
return !bitmap_empty(ctx_data->bitmap, CAM_CTX_REQ_MAX);
}
static int cam_get_valid_ctx_id(void)
{
struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;