Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ddf48ce authored by Alan Kwong's avatar Alan Kwong
Browse files

msm: sde: avoid request dereference with cached sequence id 



Reference id is used by retire handler to signal completion
status. Reference id is currently retrieved directly from
core layer request structure; however, this structure can
be freed during stop streaming by core layer. To avoid
dereferencing core request structure, cache sequence id
during core request creation, and use the cached value to
update retire sequence.

Change-Id: I73be2c43b7375832be4463002441a02b1a426b2e
Signed-off-by: default avatarAlan Kwong <akwong@codeaurora.org>
parent 003ee1e0

drivers/media/platform/msm/sde/rotator/sde_rotator_dev.c

+9 −11
Original line number Original line Diff line number Diff line
@@ -1162,7 +1162,6 @@ static void sde_rotator_update_retire_sequence( 
		struct sde_rotator_request *request)

		struct sde_rotator_request *request)

{

{

	struct sde_rotator_ctx *ctx;

	struct sde_rotator_ctx *ctx;

	struct sde_rot_entry_container *req;





	if (!request || !request->ctx) {

	if (!request || !request->ctx) {

		SDEROT_ERR("invalid parameters\n");

		SDEROT_ERR("invalid parameters\n");
@@ -1170,11 +1169,7 @@ static void sde_rotator_update_retire_sequence( 
	}

	}





	ctx = request->ctx;

	ctx = request->ctx;

	req = request->req;

	ctx->retired_sequence_id = request->sequence_id;



	if (req && req->entries && req->count)

		ctx->retired_sequence_id =

				req->entries[req->count - 1].item.sequence_id;





	wake_up(&ctx->wait_queue);

	wake_up(&ctx->wait_queue);
@@ -1199,6 +1194,7 @@ static void sde_rotator_retire_request(struct sde_rotator_request *request) 
	ctx = request->ctx;

	ctx = request->ctx;





	request->req = NULL;

	request->req = NULL;

	request->sequence_id = 0;

	request->committed = false;

	request->committed = false;

	spin_lock(&ctx->list_lock);

	spin_lock(&ctx->list_lock);

	list_del_init(&request->list);

	list_del_init(&request->list);
@@ -1216,17 +1212,14 @@ static void sde_rotator_retire_request(struct sde_rotator_request *request) 
static bool sde_rotator_is_request_retired(struct sde_rotator_request *request)

static bool sde_rotator_is_request_retired(struct sde_rotator_request *request)

{

{

	struct sde_rotator_ctx *ctx;

	struct sde_rotator_ctx *ctx;

	struct sde_rot_entry_container *req;

	u32 sequence_id;

	u32 sequence_id;

	s32 retire_delta;

	s32 retire_delta;





	if (!request || !request->ctx || !request->req ||

	if (!request || !request->ctx)

			!request->req->entries || !request->req->count)

		return true;

		return true;





	ctx = request->ctx;

	ctx = request->ctx;

	req = request->req;

	sequence_id = request->sequence_id;

	sequence_id = req->entries[req->count - 1].item.sequence_id;





	retire_delta = (s32) (ctx->retired_sequence_id - sequence_id);

	retire_delta = (s32) (ctx->retired_sequence_id - sequence_id);
@@ -1643,6 +1636,7 @@ int sde_rotator_inline_commit(void *handle, struct sde_rotator_inline_cmd *cmd, 
		}

		}





		request->req = req;

		request->req = req;

		request->sequence_id = req->entries[0].item.sequence_id;





		spin_lock(&ctx->list_lock);

		spin_lock(&ctx->list_lock);

		list_del_init(&request->list);

		list_del_init(&request->list);
@@ -3000,6 +2994,8 @@ static int sde_rotator_process_buffers(struct sde_rotator_ctx *ctx, 




	sde_rotator_queue_request(rot_dev->mgr, ctx->private, req);

	sde_rotator_queue_request(rot_dev->mgr, ctx->private, req);

	request->req = req;

	request->req = req;

	request->sequence_id = item.sequence_id;

	request->committed = true;





	return 0;

	return 0;

error_handle_request:

error_handle_request:
@@ -3008,6 +3004,8 @@ static int sde_rotator_process_buffers(struct sde_rotator_ctx *ctx, 
error_fence_wait:

error_fence_wait:

error_null_buffer:

error_null_buffer:

	request->req = NULL;

	request->req = NULL;

	request->sequence_id = 0;

	request->committed = false;

	return ret;

	return ret;

}

}

drivers/media/platform/msm/sde/rotator/sde_rotator_dev.h

+5 −1
Original line number Original line Diff line number Diff line
@@ -90,9 +90,12 @@ struct sde_rotator_vbinfo { 
 * @list: list head for submit/retire list

 * @list: list head for submit/retire list

 * @submit_work: submit work structure

 * @submit_work: submit work structure

 * @retire_work: retire work structure

 * @retire_work: retire work structure

 * @request: Pointer to core layer rotator manager request

 * @req: Pointer to core layer rotator manager request

 *	 Request can be freed by core layer during sde_rotator_stop_streaming.

 *	 Avoid dereference in dev layer if possible.

 * @ctx: Pointer to parent context

 * @ctx: Pointer to parent context

 * @committed: true if request committed to hardware

 * @committed: true if request committed to hardware

 * @sequence_id: sequence identifier of this request

 */

 */

struct sde_rotator_request {

struct sde_rotator_request {

	struct list_head list;

	struct list_head list;
@@ -101,6 +104,7 @@ struct sde_rotator_request { 
	struct sde_rot_entry_container *req;

	struct sde_rot_entry_container *req;

	struct sde_rotator_ctx *ctx;

	struct sde_rotator_ctx *ctx;

	bool committed;

	bool committed;

	u32 sequence_id;

};

};





/*

/*