evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: ais: isp: Handling buffer use after getting it freed"

Browse source
This commit is contained in:
Linux Build Service Account 2018-05-03 02:07:35 -07:00 • committed by Gerrit - the friendly Code Review server
commit cebf59e494
2 changed files with 15 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c
View file

@ -2809,9 +2809,11 @@ static int msm_isp_start_axi_stream(struct vfe_device *vfe_dev,
vfe_dev->axi_data.src_info[VFE_PIX_0].eof_id = 0; vfe_dev->axi_data.src_info[VFE_PIX_0].eof_id = 0;
} }
mutex_lock(&vfe_dev->buf_mgr->lock);
for (i = 0; i < stream_cfg_cmd->num_streams; i++) { for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >= if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
VFE_AXI_SRC_MAX) { VFE_AXI_SRC_MAX) {
mutex_unlock(&vfe_dev->buf_mgr->lock);
return -EINVAL; return -EINVAL;
} }
stream_info = &axi_data->stream_info[ stream_info = &axi_data->stream_info[
@ -2821,6 +2823,7 @@ static int msm_isp_start_axi_stream(struct vfe_device *vfe_dev,
SRC_TO_INTF(stream_info->stream_src)].active; SRC_TO_INTF(stream_info->stream_src)].active;
else { else {
ISP_DBG("%s: invalid src info index\n", __func__); ISP_DBG("%s: invalid src info index\n", __func__);
mutex_unlock(&vfe_dev->buf_mgr->lock);
return -EINVAL; return -EINVAL;
} }
@ -2835,6 +2838,7 @@ static int msm_isp_start_axi_stream(struct vfe_device *vfe_dev,
HANDLE_TO_IDX( HANDLE_TO_IDX(
stream_cfg_cmd->stream_handle[i])); stream_cfg_cmd->stream_handle[i]));
spin_unlock_irqrestore(&stream_info->lock, flags); spin_unlock_irqrestore(&stream_info->lock, flags);
mutex_unlock(&vfe_dev->buf_mgr->lock);
return rc; return rc;
} }
@ -2893,6 +2897,7 @@ static int msm_isp_start_axi_stream(struct vfe_device *vfe_dev,
} }
} }
mutex_unlock(&vfe_dev->buf_mgr->lock);
msm_isp_update_stream_bandwidth(vfe_dev, stream_cfg_cmd->hw_state); msm_isp_update_stream_bandwidth(vfe_dev, stream_cfg_cmd->hw_state);
vfe_dev->hw_info->vfe_ops.axi_ops.reload_wm(vfe_dev, vfe_dev->hw_info->vfe_ops.axi_ops.reload_wm(vfe_dev,
vfe_dev->vfe_base, wm_reload_mask); vfe_dev->vfe_base, wm_reload_mask);

12
drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. /* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -684,18 +684,23 @@ static int msm_isp_start_stats_stream(struct vfe_device *vfe_dev,
stream_cfg_cmd->num_streams); stream_cfg_cmd->num_streams);
return -EINVAL; return -EINVAL;
} }
mutex_lock(&vfe_dev->buf_mgr->lock);
num_stats_comp_mask = num_stats_comp_mask =
vfe_dev->hw_info->stats_hw_info->num_stats_comp_mask; vfe_dev->hw_info->stats_hw_info->num_stats_comp_mask;
rc = vfe_dev->hw_info->vfe_ops.stats_ops.check_streams( rc = vfe_dev->hw_info->vfe_ops.stats_ops.check_streams(
stats_data->stream_info); stats_data->stream_info);
if (rc < 0) if (rc < 0) {
mutex_unlock(&vfe_dev->buf_mgr->lock);
return rc; return rc;
}
for (i = 0; i < stream_cfg_cmd->num_streams; i++) { for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
idx = STATS_IDX(stream_cfg_cmd->stream_handle[i]); idx = STATS_IDX(stream_cfg_cmd->stream_handle[i]);
if (idx >= vfe_dev->hw_info->stats_hw_info->num_stats_type) { if (idx >= vfe_dev->hw_info->stats_hw_info->num_stats_type) {
pr_err("%s Invalid stats index %d", __func__, idx); pr_err("%s Invalid stats index %d", __func__, idx);
mutex_unlock(&vfe_dev->buf_mgr->lock);
return -EINVAL; return -EINVAL;
} }
@ -711,11 +716,13 @@ static int msm_isp_start_stats_stream(struct vfe_device *vfe_dev,
pr_err("%s: comp grp %d exceed max %d\n", pr_err("%s: comp grp %d exceed max %d\n",
__func__, stream_info->composite_flag, __func__, stream_info->composite_flag,
num_stats_comp_mask); num_stats_comp_mask);
mutex_unlock(&vfe_dev->buf_mgr->lock);
return -EINVAL; return -EINVAL;
} }
rc = msm_isp_init_stats_ping_pong_reg(vfe_dev, stream_info); rc = msm_isp_init_stats_ping_pong_reg(vfe_dev, stream_info);
if (rc < 0) { if (rc < 0) {
pr_err("%s: No buffer for stream%d\n", __func__, idx); pr_err("%s: No buffer for stream%d\n", __func__, idx);
mutex_unlock(&vfe_dev->buf_mgr->lock);
return rc; return rc;
} }
if (!stream_info->composite_flag) if (!stream_info->composite_flag)
@ -740,6 +747,7 @@ static int msm_isp_start_stats_stream(struct vfe_device *vfe_dev,
stats_data->num_active_stream); stats_data->num_active_stream);
} }
mutex_unlock(&vfe_dev->buf_mgr->lock);
if (vfe_dev->axi_data.src_info[VFE_PIX_0].active) { if (vfe_dev->axi_data.src_info[VFE_PIX_0].active) {
rc = msm_isp_stats_wait_for_cfg_done(vfe_dev); rc = msm_isp_stats_wait_for_cfg_done(vfe_dev);