From 691ddd437ff6f2ce33a43e6c2133bd7db08609de Mon Sep 17 00:00:00 2001 From: Tejas Prajapati Date: Wed, 29 Dec 2021 11:05:49 +0530 Subject: [PATCH] msm: camera: reqmgr: reader writer locks to avoid memory faults Shared memory is initialized by CRM and used by other drivers; with CRM not active other drivers would fail to access the shared memory if memory manager is deinit. Reader Writer locks can prevent the open/close/ioctl calls from other drivers if CRM open/close is already being processed. Issue observed with the below sequence if drivers are opened from UMD directly without this change. CRM Open successful,ICP open successful, CRM close in progress, ICP open successful, mem mgr deinit and CRM close successful, ICP tries to access HFI memory and result in crash. This change helps to serialze the calls and prevents issue. CRs-Fixed: 3019488 Change-Id: I464411576a5a04f5d0b402c403ce8a1d4df7dad0 Signed-off-by: Tejas Prajapati --- drivers/cam_core/cam_subdev.c | 2 + drivers/cam_fd/cam_fd_dev.c | 5 ++ drivers/cam_icp/cam_icp_subdev.c | 13 +--- drivers/cam_isp/cam_isp_dev.c | 4 ++ drivers/cam_jpeg/cam_jpeg_dev.c | 3 + drivers/cam_lrme/cam_lrme_dev.c | 5 ++ drivers/cam_ope/cam_ope_subdev.c | 3 + drivers/cam_req_mgr/cam_mem_mgr.c | 65 +++++++------------ drivers/cam_req_mgr/cam_mem_mgr.h | 6 ++ drivers/cam_req_mgr/cam_req_mgr_dev.c | 30 +++++++++ drivers/cam_req_mgr/cam_req_mgr_util.c | 9 +++ drivers/cam_req_mgr/cam_subdev.h | 14 ++++ .../cam_actuator/cam_actuator_core.c | 5 ++ .../cam_csiphy/cam_csiphy_core.c | 6 ++ .../cam_eeprom/cam_eeprom_core.c | 4 ++ .../cam_flash/cam_flash_dev.c | 5 ++ .../cam_sensor_module/cam_ois/cam_ois_core.c | 4 ++ .../cam_sensor/cam_sensor_core.c | 5 ++ 18 files changed, 138 insertions(+), 50 deletions(-) diff --git a/drivers/cam_core/cam_subdev.c b/drivers/cam_core/cam_subdev.c index cbe1b4ca3336..c1f345fabf1a 100644 --- a/drivers/cam_core/cam_subdev.c +++ b/drivers/cam_core/cam_subdev.c @@ -55,8 +55,10 @@ static long cam_subdev_ioctl(struct v4l2_subdev *sd, unsigned int cmd, switch (cmd) { case VIDIOC_CAM_CONTROL: + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK); rc = cam_node_handle_ioctl(node, (struct cam_control *) arg); + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK); break; case CAM_SD_SHUTDOWN: if (!cam_req_mgr_is_shutdown()) { diff --git a/drivers/cam_fd/cam_fd_dev.c b/drivers/cam_fd/cam_fd_dev.c index a58db056f6fb..e34c9bcc1e0b 100644 --- a/drivers/cam_fd/cam_fd_dev.c +++ b/drivers/cam_fd/cam_fd_dev.c @@ -44,8 +44,11 @@ static int cam_fd_dev_open(struct v4l2_subdev *sd, { struct cam_fd_dev *fd_dev = &g_fd_dev; + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK); + if (!fd_dev->probe_done) { CAM_ERR(CAM_FD, "FD Dev not initialized, fd_dev=%pK", fd_dev); + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK); return -ENODEV; } @@ -54,6 +57,8 @@ static int cam_fd_dev_open(struct v4l2_subdev *sd, CAM_DBG(CAM_FD, "FD Subdev open count %d", fd_dev->open_cnt); mutex_unlock(&fd_dev->lock); + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK); + return 0; } diff --git a/drivers/cam_icp/cam_icp_subdev.c b/drivers/cam_icp/cam_icp_subdev.c index 8a69ff7c1e8f..a15c726a963d 100644 --- a/drivers/cam_icp/cam_icp_subdev.c +++ b/drivers/cam_icp/cam_icp_subdev.c @@ -20,7 +20,6 @@ #include #include #include -#include "cam_mem_mgr.h" #include "cam_req_mgr_dev.h" #include "cam_subdev.h" #include "cam_node.h" @@ -74,6 +73,8 @@ static int cam_icp_subdev_open(struct v4l2_subdev *sd, struct cam_node *node = v4l2_get_subdevdata(sd); int rc = 0; + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK); + mutex_lock(&g_icp_dev.icp_lock); if (g_icp_dev.open_cnt >= 1) { CAM_ERR(CAM_ICP, "ICP subdev is already opened"); @@ -87,23 +88,16 @@ static int cam_icp_subdev_open(struct v4l2_subdev *sd, goto end; } - - rc = cam_mem_mgr_init(); - if (rc) { - CAM_ERR(CAM_CRM, "mem mgr init failed"); - goto end; - } - hw_mgr_intf = &node->hw_mgr_intf; rc = hw_mgr_intf->hw_open(hw_mgr_intf->hw_mgr_priv, NULL); if (rc < 0) { CAM_ERR(CAM_ICP, "FW download failed"); - cam_mem_mgr_deinit(); goto end; } g_icp_dev.open_cnt++; end: mutex_unlock(&g_icp_dev.icp_lock); + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK); return rc; } @@ -139,7 +133,6 @@ int cam_icp_subdev_close_internal(struct v4l2_subdev *sd, goto end; } - cam_mem_mgr_deinit(); end: mutex_unlock(&g_icp_dev.icp_lock); return rc; diff --git a/drivers/cam_isp/cam_isp_dev.c b/drivers/cam_isp/cam_isp_dev.c index 9409c1015c6c..d2f8720541e6 100644 --- a/drivers/cam_isp/cam_isp_dev.c +++ b/drivers/cam_isp/cam_isp_dev.c @@ -64,10 +64,14 @@ static const struct of_device_id cam_isp_dt_match[] = { static int cam_isp_subdev_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh) { + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK); + mutex_lock(&g_isp_dev.isp_mutex); g_isp_dev.open_cnt++; mutex_unlock(&g_isp_dev.isp_mutex); + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK); + return 0; } diff --git a/drivers/cam_jpeg/cam_jpeg_dev.c b/drivers/cam_jpeg/cam_jpeg_dev.c index a47476a06144..166db14e75ce 100644 --- a/drivers/cam_jpeg/cam_jpeg_dev.c +++ b/drivers/cam_jpeg/cam_jpeg_dev.c @@ -48,11 +48,14 @@ static const struct of_device_id cam_jpeg_dt_match[] = { static int cam_jpeg_subdev_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh) { + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK); mutex_lock(&g_jpeg_dev.jpeg_mutex); g_jpeg_dev.open_cnt++; mutex_unlock(&g_jpeg_dev.jpeg_mutex); + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK); + return 0; } diff --git a/drivers/cam_lrme/cam_lrme_dev.c b/drivers/cam_lrme/cam_lrme_dev.c index 5055444c3d8a..f46bb25362fe 100644 --- a/drivers/cam_lrme/cam_lrme_dev.c +++ b/drivers/cam_lrme/cam_lrme_dev.c @@ -59,9 +59,12 @@ static int cam_lrme_dev_open(struct v4l2_subdev *sd, { struct cam_lrme_dev *lrme_dev = g_lrme_dev; + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK); + if (!lrme_dev) { CAM_ERR(CAM_LRME, "LRME Dev not initialized, dev=%pK", lrme_dev); + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK); return -ENODEV; } @@ -69,6 +72,8 @@ static int cam_lrme_dev_open(struct v4l2_subdev *sd, lrme_dev->open_cnt++; mutex_unlock(&lrme_dev->lock); + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK); + return 0; } diff --git a/drivers/cam_ope/cam_ope_subdev.c b/drivers/cam_ope/cam_ope_subdev.c index a04abe3bcf8c..e4007cbabac0 100644 --- a/drivers/cam_ope/cam_ope_subdev.c +++ b/drivers/cam_ope/cam_ope_subdev.c @@ -69,6 +69,8 @@ static int cam_ope_subdev_open(struct v4l2_subdev *sd, struct cam_node *node = v4l2_get_subdevdata(sd); int rc = 0; + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_LOCK); + mutex_lock(&g_ope_dev.ope_lock); if (g_ope_dev.open_cnt >= 1) { CAM_ERR(CAM_OPE, "OPE subdev is already opened"); @@ -92,6 +94,7 @@ static int cam_ope_subdev_open(struct v4l2_subdev *sd, CAM_DBG(CAM_OPE, "OPE HW open success: %d", rc); end: mutex_unlock(&g_ope_dev.ope_lock); + cam_req_mgr_rwsem_read_op(CAM_SUBDEV_UNLOCK); return rc; } diff --git a/drivers/cam_req_mgr/cam_mem_mgr.c b/drivers/cam_req_mgr/cam_mem_mgr.c index 9c8a404dbfe5..b928c7da46c7 100644 --- a/drivers/cam_req_mgr/cam_mem_mgr.c +++ b/drivers/cam_req_mgr/cam_mem_mgr.c @@ -19,11 +19,8 @@ #include "cam_trace.h" #include "cam_common_util.h" -static struct cam_mem_table tbl = { - .m_lock = __MUTEX_INITIALIZER(tbl.m_lock), -}; - -static atomic_t cam_mem_mgr_refcnt = ATOMIC_INIT(0); +static struct cam_mem_table tbl; +static atomic_t cam_mem_mgr_state = ATOMIC_INIT(CAM_MEM_MGR_UNINITIALIZED); static void cam_mem_mgr_print_tbl(void) { @@ -167,16 +164,6 @@ int cam_mem_mgr_init(void) int i; int bitmap_size; - mutex_lock(&tbl.m_lock); - - if (atomic_inc_return(&cam_mem_mgr_refcnt) > 1) { - CAM_DBG(CAM_MEM, - "Mem mgr refcnt: %d", - atomic_read(&cam_mem_mgr_refcnt)); - mutex_unlock(&tbl.m_lock); - return 0; - } - memset(tbl.bufq, 0, sizeof(tbl.bufq)); if (cam_smmu_need_force_alloc_cached(&tbl.force_cache_allocs)) { @@ -186,13 +173,8 @@ int cam_mem_mgr_init(void) bitmap_size = BITS_TO_LONGS(CAM_MEM_BUFQ_MAX) * sizeof(long); tbl.bitmap = kzalloc(bitmap_size, GFP_KERNEL); - if (!tbl.bitmap) { - atomic_dec(&cam_mem_mgr_refcnt); - CAM_DBG(CAM_MEM, "Mem mgr refcnt: %d", - atomic_read(&cam_mem_mgr_refcnt)); - mutex_unlock(&tbl.m_lock); + if (!tbl.bitmap) return -ENOMEM; - } tbl.bits = bitmap_size * BITS_PER_BYTE; bitmap_zero(tbl.bitmap, tbl.bits); @@ -203,8 +185,9 @@ int cam_mem_mgr_init(void) tbl.bufq[i].fd = -1; tbl.bufq[i].buf_handle = -1; } + mutex_init(&tbl.m_lock); - mutex_unlock(&tbl.m_lock); + atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_INITIALIZED); cam_mem_mgr_create_debug_fs(); @@ -251,7 +234,7 @@ int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle, *len_ptr = 0; - if (!atomic_read(&cam_mem_mgr_refcnt)) { + if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); return -EINVAL; } @@ -302,7 +285,12 @@ int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr, size_t *len) { int idx; - if (!atomic_read(&cam_mem_mgr_refcnt)) { + if (!atomic_read(&cam_mem_mgr_state)) { + CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); + return -EINVAL; + } + + if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); return -EINVAL; } @@ -345,7 +333,7 @@ int cam_mem_mgr_cache_ops(struct cam_mem_cache_ops_cmd *cmd) uint32_t cache_dir; unsigned long dmabuf_flag = 0; - if (!atomic_read(&cam_mem_mgr_refcnt)) { + if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); return -EINVAL; } @@ -671,7 +659,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) uintptr_t kvaddr = 0; size_t klen; - if (!atomic_read(&cam_mem_mgr_refcnt)) { + if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); return -EINVAL; } @@ -823,7 +811,7 @@ int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd *cmd) size_t len = 0; bool is_internal = false; - if (!atomic_read(&cam_mem_mgr_refcnt)) { + if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); return -EINVAL; } @@ -1010,6 +998,7 @@ static int cam_mem_mgr_cleanup_table(void) { int i; + mutex_lock(&tbl.m_lock); for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) { if (!tbl.bufq[i].active) { CAM_DBG(CAM_MEM, @@ -1045,27 +1034,23 @@ static int cam_mem_mgr_cleanup_table(void) bitmap_zero(tbl.bitmap, tbl.bits); /* We need to reserve slot 0 because 0 is invalid */ set_bit(0, tbl.bitmap); + mutex_unlock(&tbl.m_lock); return 0; } void cam_mem_mgr_deinit(void) { - mutex_lock(&tbl.m_lock); - if (!atomic_dec_and_test(&cam_mem_mgr_refcnt)) { - CAM_DBG(CAM_MEM, "Mem mgr refcnt: %d", - atomic_read(&cam_mem_mgr_refcnt)); - mutex_unlock(&tbl.m_lock); - return; - } - + atomic_set(&cam_mem_mgr_state, CAM_MEM_MGR_UNINITIALIZED); cam_mem_mgr_cleanup_table(); debugfs_remove_recursive(tbl.dentry); + mutex_lock(&tbl.m_lock); bitmap_zero(tbl.bitmap, tbl.bits); kfree(tbl.bitmap); tbl.bitmap = NULL; tbl.dbg_buf_idx = -1; mutex_unlock(&tbl.m_lock); + mutex_destroy(&tbl.m_lock); } static int cam_mem_util_unmap(int32_t idx, @@ -1163,7 +1148,7 @@ int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd) int idx; int rc; - if (!atomic_read(&cam_mem_mgr_refcnt)) { + if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); return -EINVAL; } @@ -1216,7 +1201,7 @@ int cam_mem_mgr_request_mem(struct cam_mem_mgr_request_desc *inp, enum cam_smmu_region_id region = CAM_SMMU_REGION_SHARED; - if (!atomic_read(&cam_mem_mgr_refcnt)) { + if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); return -EINVAL; } @@ -1342,7 +1327,7 @@ int cam_mem_mgr_release_mem(struct cam_mem_mgr_memory_desc *inp) int32_t idx; int rc; - if (!atomic_read(&cam_mem_mgr_refcnt)) { + if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); return -EINVAL; } @@ -1395,7 +1380,7 @@ int cam_mem_mgr_reserve_memory_region(struct cam_mem_mgr_request_desc *inp, int32_t smmu_hdl = 0; int32_t num_hdl = 0; - if (!atomic_read(&cam_mem_mgr_refcnt)) { + if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); return -EINVAL; } @@ -1490,7 +1475,7 @@ int cam_mem_mgr_free_memory_region(struct cam_mem_mgr_memory_desc *inp) int rc; int32_t smmu_hdl; - if (!atomic_read(&cam_mem_mgr_refcnt)) { + if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); return -EINVAL; } diff --git a/drivers/cam_req_mgr/cam_mem_mgr.h b/drivers/cam_req_mgr/cam_mem_mgr.h index 9cf7a74b07cf..26ab9cb75319 100644 --- a/drivers/cam_req_mgr/cam_mem_mgr.h +++ b/drivers/cam_req_mgr/cam_mem_mgr.h @@ -11,6 +11,12 @@ #include #include "cam_mem_mgr_api.h" +/* Enum for possible mem mgr states */ +enum cam_mem_mgr_state { + CAM_MEM_MGR_UNINITIALIZED, + CAM_MEM_MGR_INITIALIZED, +}; + /*Enum for possible SMMU operations */ enum cam_smmu_mapping_client { CAM_SMMU_MAPPING_USER, diff --git a/drivers/cam_req_mgr/cam_req_mgr_dev.c b/drivers/cam_req_mgr/cam_req_mgr_dev.c index 350c9ea171bf..63e61d160391 100644 --- a/drivers/cam_req_mgr/cam_req_mgr_dev.c +++ b/drivers/cam_req_mgr/cam_req_mgr_dev.c @@ -8,6 +8,7 @@ #include #include #include +#include #include @@ -35,6 +36,8 @@ static struct cam_req_mgr_device g_dev; struct kmem_cache *g_cam_req_mgr_timer_cachep; static struct list_head cam_req_mgr_ordered_sd_list; +DECLARE_RWSEM(rwsem_lock); + static struct device_attribute camera_debug_sysfs_attr = __ATTR(debug_node, 0600, NULL, cam_debug_sysfs_node_store); @@ -103,10 +106,29 @@ static void cam_v4l2_device_cleanup(void) g_dev.v4l2_dev = NULL; } + +void cam_req_mgr_rwsem_read_op(enum cam_subdev_rwsem lock) +{ + if (lock == CAM_SUBDEV_LOCK) + down_read(&rwsem_lock); + else if (lock == CAM_SUBDEV_UNLOCK) + up_read(&rwsem_lock); +} + +static void cam_req_mgr_rwsem_write_op(enum cam_subdev_rwsem lock) +{ + if (lock == CAM_SUBDEV_LOCK) + down_write(&rwsem_lock); + else if (lock == CAM_SUBDEV_UNLOCK) + up_write(&rwsem_lock); +} + static int cam_req_mgr_open(struct file *filep) { int rc; + cam_req_mgr_rwsem_write_op(CAM_SUBDEV_LOCK); + mutex_lock(&g_dev.cam_lock); if (g_dev.open_cnt >= 1) { rc = -EALREADY; @@ -133,12 +155,14 @@ static int cam_req_mgr_open(struct file *filep) } mutex_unlock(&g_dev.cam_lock); + cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK); return rc; mem_mgr_init_fail: v4l2_fh_release(filep); end: mutex_unlock(&g_dev.cam_lock); + cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK); return rc; } @@ -168,10 +192,14 @@ static int cam_req_mgr_close(struct file *filep) CAM_WARN(CAM_CRM, "release invoked associated userspace process has died, open_cnt: %d", g_dev.open_cnt); + + cam_req_mgr_rwsem_write_op(CAM_SUBDEV_LOCK); + mutex_lock(&g_dev.cam_lock); if (g_dev.open_cnt <= 0) { mutex_unlock(&g_dev.cam_lock); + cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK); return -EINVAL; } @@ -203,6 +231,8 @@ static int cam_req_mgr_close(struct file *filep) cam_mem_mgr_deinit(); mutex_unlock(&g_dev.cam_lock); + cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK); + return 0; } diff --git a/drivers/cam_req_mgr/cam_req_mgr_util.c b/drivers/cam_req_mgr/cam_req_mgr_util.c index 4faba1d006b6..3c44058d2813 100644 --- a/drivers/cam_req_mgr/cam_req_mgr_util.c +++ b/drivers/cam_req_mgr/cam_req_mgr_util.c @@ -15,6 +15,7 @@ #include "cam_req_mgr_util.h" #include "cam_debug_util.h" #include "cam_context.h" +#include "cam_subdev.h" static struct cam_req_mgr_util_hdl_tbl *hdl_tbl; static DEFINE_SPINLOCK(hdl_tbl_lock); @@ -163,6 +164,14 @@ int32_t cam_create_device_hdl(struct cam_create_dev_hdl *hdl_data) int idx; int rand = 0; int32_t handle; + bool crm_active; + + crm_active = cam_req_mgr_is_open(CAM_CRM); + if (!crm_active) { + CAM_ERR(CAM_CRM, "CRM is not ACTIVE"); + spin_unlock_bh(&hdl_tbl_lock); + return -EINVAL; + } spin_lock_bh(&hdl_tbl_lock); if (!hdl_tbl) { diff --git a/drivers/cam_req_mgr/cam_subdev.h b/drivers/cam_req_mgr/cam_subdev.h index e37d7177c8a3..1e994bc69e33 100644 --- a/drivers/cam_req_mgr/cam_subdev.h +++ b/drivers/cam_req_mgr/cam_subdev.h @@ -28,6 +28,11 @@ enum cam_subdev_close_seq_priority { CAM_SD_CLOSE_LOW_PRIORITY }; +enum cam_subdev_rwsem { + CAM_SUBDEV_LOCK = 1, + CAM_SUBDEV_UNLOCK, +}; + /** * struct cam_subdev - describes a camera sub-device * @@ -130,6 +135,15 @@ int cam_register_subdev(struct cam_subdev *sd); */ int cam_unregister_subdev(struct cam_subdev *sd); +/** + * cam_req_mgr_rwsem_read_op() + * + * @brief : API to acquire read semaphore lock to platform framework. + * + * @lock : value indicates to lock or unlock the read lock + */ +void cam_req_mgr_rwsem_read_op(enum cam_subdev_rwsem lock); + /** * cam_req_mgr_is_open() * diff --git a/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c b/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c index 9c0d7abd043d..722f91e334b3 100644 --- a/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c +++ b/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c @@ -859,6 +859,11 @@ int32_t cam_actuator_driver_cmd(struct cam_actuator_ctrl_t *a_ctrl, actuator_acq_dev.device_handle = cam_create_device_hdl(&bridge_params); + if (actuator_acq_dev.device_handle <= 0) { + rc = -EFAULT; + CAM_ERR(CAM_ACTUATOR, "Can not create device handle"); + goto release_mutex; + } a_ctrl->bridge_intf.device_hdl = actuator_acq_dev.device_handle; a_ctrl->bridge_intf.session_hdl = actuator_acq_dev.session_handle; diff --git a/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c b/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c index 210179307a9e..06c02c1932f1 100644 --- a/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c +++ b/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c @@ -1182,6 +1182,12 @@ int32_t cam_csiphy_core_cfg(void *phy_dev, index = csiphy_dev->acquire_count; csiphy_acq_dev.device_handle = cam_create_device_hdl(&bridge_params); + if (csiphy_acq_dev.device_handle <= 0) { + rc = -EFAULT; + CAM_ERR(CAM_CSIPHY, "Can not create device handle"); + goto release_mutex; + } + csiphy_dev->csiphy_info[index].hdl_data.device_hdl = csiphy_acq_dev.device_handle; csiphy_dev->csiphy_info[index].hdl_data.session_hdl = diff --git a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c index 8e4270373331..78130f6a66de 100644 --- a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c +++ b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c @@ -360,6 +360,10 @@ static int32_t cam_eeprom_get_dev_handle(struct cam_eeprom_ctrl_t *e_ctrl, eeprom_acq_dev.device_handle = cam_create_device_hdl(&bridge_params); + if (eeprom_acq_dev.device_handle <= 0) { + CAM_ERR(CAM_EEPROM, "Can not create device handle"); + return -EFAULT; + } e_ctrl->bridge_intf.device_hdl = eeprom_acq_dev.device_handle; e_ctrl->bridge_intf.session_hdl = eeprom_acq_dev.session_handle; diff --git a/drivers/cam_sensor_module/cam_flash/cam_flash_dev.c b/drivers/cam_sensor_module/cam_flash/cam_flash_dev.c index 197502ff5896..cc57a7124ae9 100644 --- a/drivers/cam_sensor_module/cam_flash/cam_flash_dev.c +++ b/drivers/cam_sensor_module/cam_flash/cam_flash_dev.c @@ -68,6 +68,11 @@ static int32_t cam_flash_driver_cmd(struct cam_flash_ctrl *fctrl, flash_acq_dev.device_handle = cam_create_device_hdl(&bridge_params); + if (flash_acq_dev.device_handle <= 0) { + rc = -EFAULT; + CAM_ERR(CAM_FLASH, "Can not create device handle"); + goto release_mutex; + } fctrl->bridge_intf.device_hdl = flash_acq_dev.device_handle; fctrl->bridge_intf.session_hdl = diff --git a/drivers/cam_sensor_module/cam_ois/cam_ois_core.c b/drivers/cam_sensor_module/cam_ois/cam_ois_core.c index 543f7a9f3eb2..b8cc002edb91 100644 --- a/drivers/cam_sensor_module/cam_ois/cam_ois_core.c +++ b/drivers/cam_sensor_module/cam_ois/cam_ois_core.c @@ -86,6 +86,10 @@ static int cam_ois_get_dev_handle(struct cam_ois_ctrl_t *o_ctrl, ois_acq_dev.device_handle = cam_create_device_hdl(&bridge_params); + if (ois_acq_dev.device_handle <= 0) { + CAM_ERR(CAM_OIS, "Can not create device handle"); + return -EFAULT; + } o_ctrl->bridge_intf.device_hdl = ois_acq_dev.device_handle; o_ctrl->bridge_intf.session_hdl = ois_acq_dev.session_handle; diff --git a/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c b/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c index 38846433fd0a..8298f9f81bc6 100644 --- a/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c +++ b/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c @@ -839,6 +839,11 @@ int32_t cam_sensor_driver_cmd(struct cam_sensor_ctrl_t *s_ctrl, sensor_acq_dev.device_handle = cam_create_device_hdl(&bridge_params); + if (sensor_acq_dev.device_handle <= 0) { + rc = -EFAULT; + CAM_ERR(CAM_SENSOR, "Can not create device handle"); + goto release_mutex; + } s_ctrl->bridge_intf.device_hdl = sensor_acq_dev.device_handle; s_ctrl->bridge_intf.session_hdl = sensor_acq_dev.session_handle;