From a4b0246d27818b388e7e6bbe28db3f4aab7c6aa9 Mon Sep 17 00:00:00 2001 From: Tejas Prajapati Date: Mon, 7 Mar 2022 17:18:33 +0530 Subject: [PATCH] msm: camera: memmgr: update correct length in bufq In a corner case, race condition to free the original ion buf allocated and new ion buffer with same fd but different size after freeing the origianl ion buf might result into mismatches in the real ion buf size assigned in bufq. To avoid this update length in bufq with local variable. CRs-Fixed: 3142221 Change-Id: I23d91445bd088bbde19ffa191e158256166f2053 Signed-off-by: Tejas Prajapati --- drivers/cam_req_mgr/cam_mem_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/cam_req_mgr/cam_mem_mgr.c b/drivers/cam_req_mgr/cam_mem_mgr.c index b928c7da46c7..ee227f943272 100644 --- a/drivers/cam_req_mgr/cam_mem_mgr.c +++ b/drivers/cam_req_mgr/cam_mem_mgr.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -758,7 +759,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) tbl.bufq[idx].kmdvaddr = kvaddr; tbl.bufq[idx].vaddr = hw_vaddr; tbl.bufq[idx].dma_buf = dmabuf; - tbl.bufq[idx].len = cmd->len; + tbl.bufq[idx].len = len; tbl.bufq[idx].num_hdl = cmd->num_hdl; memcpy(tbl.bufq[idx].hdls, cmd->mmu_hdls, sizeof(int32_t) * cmd->num_hdl);