From d4437467f431b534d474e5284053a67e325d2dc1 Mon Sep 17 00:00:00 2001 From: George Shen Date: Thu, 9 Jul 2020 10:44:29 -0700 Subject: [PATCH] msm: cvp: Fix linked list corruption in CVP driver Avoid mis-matched data structures were used in HFI message sending and receiving paths. Use list_add_tail() in correct way. Change-Id: I329694236601a47cb865af955592f92ac9e888a8 Signed-off-by: George Shen --- drivers/media/platform/msm/cvp/msm_cvp.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/media/platform/msm/cvp/msm_cvp.c b/drivers/media/platform/msm/cvp/msm_cvp.c index 4f8706e63b69..6c60839f745f 100644 --- a/drivers/media/platform/msm/cvp/msm_cvp.c +++ b/drivers/media/platform/msm/cvp/msm_cvp.c @@ -274,7 +274,7 @@ static bool cvp_fence_wait(struct cvp_fence_queue *q, f = list_first_entry(&q->wait_list, struct cvp_fence_command, list); list_del_init(&f->list); - list_add_tail(&q->sched_list, &f->list); + list_add_tail(&f->list, &q->sched_list); mutex_unlock(&q->lock); *fence = f; @@ -293,7 +293,7 @@ static int cvp_fence_proc(struct msm_cvp_inst *inst, struct cvp_hfi_device *hdev; struct cvp_session_queue *sq; u32 hfi_err = HFI_ERR_NONE; - struct cvp_hfi_msg_session_hdr *hdr; + struct cvp_hfi_msg_session_hdr hdr; dprintk(CVP_SYNX, "%s %s\n", current->comm, __func__); @@ -317,9 +317,8 @@ static int cvp_fence_proc(struct msm_cvp_inst *inst, timeout = msecs_to_jiffies(CVP_MAX_WAIT_TIME); rc = cvp_wait_process_message(inst, sq, &ktid, timeout, - (struct cvp_kmd_hfi_packet *)pkt); - hdr = (struct cvp_hfi_msg_session_hdr *)pkt; - hfi_err = hdr->error_type; + (struct cvp_kmd_hfi_packet *)&hdr); + hfi_err = hdr.error_type; if (rc) { dprintk(CVP_ERR, "%s %s: cvp_wait_process_message rc %d\n", current->comm, __func__, rc);