Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1ab07e44 authored by Vishalsingh Hajeri's avatar Vishalsingh Hajeri Committed by Pavan Kumar Chilamkurthi
Browse files

msm: camera: sensor: Avoid race condition for register settings 



Register settings were dereferenced after being destroyed.
Added null pointer checks before its  dereferencing.

Change-Id: I560eeda4c754eaf6de953f1c9fd17a056b33e6ff
Signed-off-by: default avatarvhajeri <vhajeri@codeaurora.org>
parent c092e59f

drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c

+10 −8
Original line number Diff line number Diff line 
/* Copyright (c) 2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -191,12 +191,14 @@ static int32_t cam_sensor_i2c_pkt_parse(struct cam_sensor_ctrl_t *s_ctrl, 
			CAM_ERR(CAM_SENSOR,

				"Already some pkt in offset req : %lld",

				csl_packet->header.request_id);

			rc = delete_request(i2c_reg_settings);

			if (rc < 0) {

				CAM_ERR(CAM_SENSOR,

				"Failed in Deleting the err: %d", rc);

				return rc;

			}

			/*

			 * Update req mgr even in case of failure.

			 * This will help not to wait indefinitely

			 * and freeze. If this log is triggered then

			 * fix it.

			 */

			cam_sensor_update_req_mgr(s_ctrl, csl_packet);

			return 0;

		}

		break;

	}

drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_io/cam_sensor_io.c

+11 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -98,6 +98,11 @@ int32_t camera_io_dev_write(struct camera_io_master *io_master_info, 
		return -EINVAL;

	}



	if (!write_setting->reg_setting) {

		CAM_ERR(CAM_SENSOR, "Invalid Register Settings");

		return -EINVAL;

	}



	if (io_master_info->master_type == CCI_MASTER) {

		return cam_cci_i2c_write_table(io_master_info,

			write_setting);
@@ -125,6 +130,11 @@ int32_t camera_io_dev_write_continuous(struct camera_io_master *io_master_info, 
		return -EINVAL;

	}



	if (!write_setting->reg_setting) {

		CAM_ERR(CAM_SENSOR, "Invalid Register Settings");

		return -EINVAL;

	}



	if (io_master_info->master_type == CCI_MASTER) {

		return cam_cci_i2c_write_continuous_table(io_master_info,

			write_setting, cam_sensor_i2c_write_flag);

drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_cmn_header.h

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -26,7 +26,7 @@ 
#define MAX_REGULATOR 5

#define MAX_POWER_CONFIG 12



#define MAX_PER_FRAME_ARRAY 8

#define MAX_PER_FRAME_ARRAY 32



#define CAM_SENSOR_NAME    "cam-sensor"

#define CAM_ACTUATOR_NAME  "cam-actuator"