From b7007cd5ed64ae060f20be9e25e3641dc66b74db Mon Sep 17 00:00:00 2001 From: George Shen Date: Sun, 19 Apr 2020 10:54:54 -0700 Subject: [PATCH] msm: cvp: Avoid dereferencing dangling pointer CVP SSR crashed when derefencing the pointer to a shared memory buffer descriptor. Change-Id: I3f7b690d90496efdf0451b5500578fee636f81fe Signed-off-by: George Shen --- drivers/media/platform/msm/cvp/msm_cvp.c | 2 ++ drivers/media/platform/msm/cvp/msm_cvp_buf.c | 18 ++---------------- 2 files changed, 4 insertions(+), 16 deletions(-) diff --git a/drivers/media/platform/msm/cvp/msm_cvp.c b/drivers/media/platform/msm/cvp/msm_cvp.c index 7c0a99988e84..322141c18838 100644 --- a/drivers/media/platform/msm/cvp/msm_cvp.c +++ b/drivers/media/platform/msm/cvp/msm_cvp.c @@ -1074,6 +1074,8 @@ static int msm_cvp_session_stop(struct msm_cvp_inst *inst, } sq->state = QUEUE_STOP; + pr_info(CVP_DBG_TAG "Stop session: %pK session_id = %d\n", + "sess", inst, hash32_ptr(inst->session)); spin_unlock(&sq->lock); wake_up_all(&inst->session_queue.wq); diff --git a/drivers/media/platform/msm/cvp/msm_cvp_buf.c b/drivers/media/platform/msm/cvp/msm_cvp_buf.c index da53c90a6abf..a009da7638db 100644 --- a/drivers/media/platform/msm/cvp/msm_cvp_buf.c +++ b/drivers/media/platform/msm/cvp/msm_cvp_buf.c @@ -731,7 +731,7 @@ int msm_cvp_session_deinit_buffers(struct msm_cvp_inst *inst) msm_cvp_unmap_smem(smem); msm_cvp_smem_put_dma_buf(smem->dma_buf); kmem_cache_free(cvp_driver->smem_cache, smem); - smem = NULL; + inst->dma_cache.entries[i] = NULL; } mutex_unlock(&inst->dma_cache.lock); @@ -913,22 +913,8 @@ int cvp_release_arp_buffers(struct msm_cvp_inst *inst) smem->dma_buf->name, buf->size); msm_cvp_smem_free(smem); kmem_cache_free(cvp_driver->smem_cache, smem); - } else if (buf->ownership == CLIENT) { - dprintk(CVP_MEM, - "%s: %x : fd %d %s size %d", - "unmap persist", hash32_ptr(inst->session), - buf->fd, smem->dma_buf->name, buf->size); - - mutex_lock(&inst->dma_cache.lock); - if (atomic_read(&smem->refcount) == 0) { - list_del(&smem->list); - msm_cvp_unmap_smem(smem); - dma_buf_put(smem->dma_buf); - kfree(smem); - buf->smem = NULL; - } - mutex_unlock(&inst->dma_cache.lock); } + buf->smem = NULL; kmem_cache_free(cvp_driver->buf_cache, buf); } mutex_unlock(&inst->persistbufs.lock);