From e874b94c3ad30f580246b22599277826b0736f33 Mon Sep 17 00:00:00 2001 From: Alok Chauhan Date: Tue, 13 Oct 2020 16:55:34 +0530 Subject: [PATCH] msm: camera: ope: Avoid submitting NULL request to CDM In corner case, there is a chance that userspace can submit request while flush is ongoing. In some cases submitted request can get flushed and corresponding data structures memory gets freed. Add a logic to check for pending request before submitting request to cdm hw. CRs-Fixed: 2815901 Change-Id: I74096201e204f204c4f15d14698b4e9af6435f55 Signed-off-by: Alok Chauhan --- drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c index 8560c77f89fc..2b46462dbdc9 100644 --- a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c +++ b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c @@ -81,6 +81,11 @@ end: return rsc_idx; } +static bool cam_ope_is_pending_request(struct cam_ope_ctx *ctx_data) +{ + return !bitmap_empty(ctx_data->bitmap, CAM_CTX_REQ_MAX); +} + static int cam_ope_mgr_process_cmd(void *priv, void *data) { int rc; @@ -96,14 +101,16 @@ static int cam_ope_mgr_process_cmd(void *priv, void *data) ctx_data = priv; task_data = (struct ope_cmd_work_data *)data; + + mutex_lock(&hw_mgr->hw_mgr_mutex); cdm_cmd = task_data->data; if (!cdm_cmd) { CAM_ERR(CAM_OPE, "Invalid params%pK", cdm_cmd); + mutex_unlock(&hw_mgr->hw_mgr_mutex); return -EINVAL; } - mutex_lock(&hw_mgr->hw_mgr_mutex); if (ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) { mutex_unlock(&hw_mgr->hw_mgr_mutex); CAM_ERR(CAM_OPE, "ctx id :%u is not in use", @@ -119,6 +126,13 @@ static int cam_ope_mgr_process_cmd(void *priv, void *data) return -EINVAL; } + if (!cam_ope_is_pending_request(ctx_data)) { + CAM_WARN(CAM_OPE, "no pending req, req %lld last flush %lld", + task_data->req_id, ctx_data->last_flush_req); + mutex_unlock(&hw_mgr->hw_mgr_mutex); + return -EINVAL; + } + CAM_DBG(CAM_OPE, "cam_cdm_submit_bls: handle 0x%x, ctx_id %d req %d cookie %d", ctx_data->ope_cdm.cdm_handle, ctx_data->ctx_id, @@ -256,11 +270,6 @@ static int cam_ope_mgr_reapply_config(struct cam_ope_hw_mgr *hw_mgr, return rc; } -static bool cam_ope_is_pending_request(struct cam_ope_ctx *ctx_data) -{ - return !bitmap_empty(ctx_data->bitmap, CAM_CTX_REQ_MAX); -} - static int cam_get_valid_ctx_id(void) { struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;