Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1313b044 authored by Alok Pandey's avatar Alok Pandey
Browse files

msm: camera: icp: Avoid accessing released memory in abort/destroy 



In abort and destroy functions there are chances of accessing released
memory if timeout happens and work is not scheduled. To handle this,
removed the workqueue and submitted command directly to FW.

Change-Id: I2eccb47d5db29fe0cb5fb8426812b33c961f365b
Signed-off-by: default avatarAlok Pandey <akumarpa@codeaurora.org>
parent 0bb03714

drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+4 −26
Original line number Diff line number Diff line
@@ -2260,13 +2260,7 @@ static int cam_icp_mgr_abort_handle( 
	unsigned long rem_jiffies;

	size_t packet_size;

	int timeout = 100;

	struct hfi_cmd_work_data *task_data;

	struct hfi_cmd_ipebps_async *abort_cmd;

	struct crm_workq_task *task;



	task = cam_req_mgr_workq_get_task(icp_hw_mgr.cmd_work);

	if (!task)

		return -ENOMEM;



	packet_size =

		sizeof(struct hfi_cmd_ipebps_async) +
@@ -2292,13 +2286,7 @@ static int cam_icp_mgr_abort_handle( 
	abort_cmd->user_data1 = (uint64_t)ctx_data;

	abort_cmd->user_data2 = (uint64_t)0x0;



	task_data = (struct hfi_cmd_work_data *)task->payload;

	task_data->data = (void *)abort_cmd;

	task_data->request_id = 0;

	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;

	task->process_cb = cam_icp_mgr_process_cmd;

	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,

		CRM_TASK_PRIORITY_0);

	rc = hfi_write_cmd(abort_cmd);

	if (rc) {

		kfree(abort_cmd);

		return rc;
@@ -2312,6 +2300,7 @@ static int cam_icp_mgr_abort_handle( 
		CAM_ERR(CAM_ICP, "FW timeout/err in abort handle command");

	}



	kfree(abort_cmd);

	return rc;

}
@@ -2322,13 +2311,7 @@ static int cam_icp_mgr_destroy_handle( 
	int timeout = 100;

	unsigned long rem_jiffies;

	size_t packet_size;

	struct hfi_cmd_work_data *task_data;

	struct hfi_cmd_ipebps_async *destroy_cmd;

	struct crm_workq_task *task;



	task = cam_req_mgr_workq_get_task(icp_hw_mgr.cmd_work);

	if (!task)

		return -ENOMEM;



	packet_size =

		sizeof(struct hfi_cmd_ipebps_async) +
@@ -2355,13 +2338,7 @@ static int cam_icp_mgr_destroy_handle( 
	memcpy(destroy_cmd->payload.direct, &ctx_data->temp_payload,

		sizeof(uint64_t));



	task_data = (struct hfi_cmd_work_data *)task->payload;

	task_data->data = (void *)destroy_cmd;

	task_data->request_id = 0;

	task_data->type = ICP_WORKQ_TASK_CMD_TYPE;

	task->process_cb = cam_icp_mgr_process_cmd;

	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,

		CRM_TASK_PRIORITY_0);

	rc = hfi_write_cmd(destroy_cmd);

	if (rc) {

		kfree(destroy_cmd);

		return rc;
@@ -2378,6 +2355,7 @@ static int cam_icp_mgr_destroy_handle( 
			HFI_DEBUG_MODE_QUEUE)

			cam_icp_mgr_process_dbg_buf();

	}

	kfree(destroy_cmd);

	return rc;

}