Merge "msm: vidc: Check for sanity of size while mapping buffers" (5727dc38) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/media/platform/msm/vidc/msm_smem.c

+15 −5

Original line number	Diff line number	Diff line
		@@ -74,6 +74,14 @@ static int get_device_address(struct smem_client *smem_client,
		goto mem_map_failed;
		}

		/* Check if the dmabuf size matches expected size */
		if (buf->size < *buffer_size) {
		rc = -EINVAL;
		dprintk(VIDC_ERR,
		"Size mismatch! Dmabuf size: %zu Expected Size: %lu",
		buf->size, *buffer_size);
		goto mem_buf_size_mismatch;
		}
		/* Prepare a dma buf for dma on the given device */
		attach = dma_buf_attach(buf, cb->dev);
		if (IS_ERR_OR_NULL(attach)) {
		@@ -151,6 +159,7 @@ static int get_device_address(struct smem_client *smem_client,
		dma_buf_unmap_attachment(attach, table, DMA_BIDIRECTIONAL);
		mem_map_table_failed:
		dma_buf_detach(buf, attach);
		mem_buf_size_mismatch:
		mem_buf_attach_failed:
		dma_buf_put(buf);
		mem_map_failed:
		@@ -201,12 +210,12 @@ static void put_device_address(struct smem_client *smem_client,
		}
		}

		static int ion_user_to_kernel(struct smem_client *client, int fd, u32 offset,
		static int ion_user_to_kernel(struct smem_client *client, int fd, u32 size,
		struct msm_smem *mem, enum hal_buffer buffer_type)
		{
		struct ion_handle *hndl = NULL;
		ion_phys_addr_t iova = 0;
		unsigned long buffer_size = 0;
		unsigned long buffer_size = size;
		int rc = 0;
		unsigned long align = SZ_4K;
		unsigned long ion_flags = 0;
		@@ -217,10 +226,11 @@ static int ion_user_to_kernel(struct smem_client *client, int fd, u32 offset,
		dprintk(VIDC_DBG, "%s ion handle: %pK\n", __func__, hndl);
		if (IS_ERR_OR_NULL(hndl)) {
		dprintk(VIDC_ERR, "Failed to get handle: %pK, %d, %d, %pK\n",
		client, fd, offset, hndl);
		client, fd, size, hndl);
		rc = -ENOMEM;
		goto fail_import_fd;
		}

		mem->kvaddr = NULL;
		rc = ion_handle_get_flags(client->clnt, hndl, &ion_flags);
		if (rc) {
		@@ -441,7 +451,7 @@ static void ion_delete_client(struct smem_client *client)
		ion_client_destroy(client->clnt);
		}

		struct msm_smem msm_smem_user_to_kernel(void clt, int fd, u32 offset,
		struct msm_smem msm_smem_user_to_kernel(void clt, int fd, u32 size,
		enum hal_buffer buffer_type)
		{
		struct smem_client *client = clt;
		@@ -459,7 +469,7 @@ struct msm_smem msm_smem_user_to_kernel(void clt, int fd, u32 offset,
		}
		switch (client->mem_type) {
		case SMEM_ION:
		rc = ion_user_to_kernel(clt, fd, offset, mem, buffer_type);
		rc = ion_user_to_kernel(clt, fd, size, mem, buffer_type);
		break;
		default:
		dprintk(VIDC_ERR, "Mem type not supported\n");

drivers/media/platform/msm/vidc/msm_vidc.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -534,7 +534,7 @@ static struct msm_smem map_buffer(struct msm_vidc_inst inst,

		handle = msm_comm_smem_user_to_kernel(inst,
		p->reserved[0],
		p->reserved[1],
		p->length,
		buffer_type);
		if (!handle) {
		dprintk(VIDC_ERR,
		@@ -605,8 +605,10 @@ int map_and_register_buf(struct msm_vidc_inst inst, struct v4l2_buffer b)
		goto exit;
		}

		dprintk(VIDC_DBG, "[MAP] Create binfo = %pK fd = %d type = %d\n",
		binfo, b->m.planes[0].reserved[0], b->type);
		dprintk(VIDC_DBG,
		"[MAP] Create binfo = %pK fd = %d size = %d type = %d\n",
		binfo, b->m.planes[0].reserved[0],
		b->m.planes[0].length, b->type);

		for (i = 0; i < b->length; ++i) {
		rc = 0;

drivers/media/platform/msm/vidc/msm_vidc_common.c

+3 −4

Original line number	Diff line number	Diff line
		@@ -1166,12 +1166,12 @@ static int wait_for_sess_signal_receipt(struct msm_vidc_inst *inst,
		if (!rc) {
		dprintk(VIDC_ERR, "Wait interrupted or timed out: %d\n",
		SESSION_MSG_INDEX(cmd));
		msm_comm_kill_session(inst);
		call_hfi_op(hdev, flush_debug_queue, hdev->hfi_device_data);
		dprintk(VIDC_ERR,
		"sess resp timeout can potentially crash the system\n");
		msm_comm_print_debug_info(inst);
		msm_vidc_handle_hw_error(inst->core);
		msm_comm_kill_session(inst);
		rc = -EIO;
		} else {
		rc = 0;
		@@ -4245,14 +4245,13 @@ int msm_comm_try_get_prop(struct msm_vidc_inst *inst, enum hal_property ptype,
		__func__, inst,
		SESSION_MSG_INDEX(HAL_SESSION_PROPERTY_INFO));
		inst->state = MSM_VIDC_CORE_INVALID;
		msm_comm_kill_session(inst);
		call_hfi_op(hdev, flush_debug_queue, hdev->hfi_device_data);
		dprintk(VIDC_ERR,
		"SESS_PROP timeout can potentially crash the system\n");
		if (inst->core->resources.debug_timeout)
		msm_comm_print_debug_info(inst);

		msm_vidc_handle_hw_error(inst->core);
		msm_comm_kill_session(inst);
		rc = -ETIMEDOUT;
		goto exit;
		} else {

drivers/media/platform/msm/vidc/msm_vidc_debug.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -186,7 +186,7 @@ static inline void msm_vidc_handle_hw_error(struct msm_vidc_core *core)
		{
		bool enable_fatal;

		enable_fatal = core->resources.debug_timeout;
		enable_fatal = msm_vidc_debug_timeout;

		/* Video driver can decide FATAL handling of HW errors
		* based on multiple factors. This condition check will

drivers/media/platform/msm/vidc/msm_vidc_res_parse.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -969,7 +969,7 @@ int read_platform_resources_from_dt(
		res->debug_timeout = of_property_read_bool(pdev->dev.of_node,
		"qcom,debug-timeout");

		res->debug_timeout \|= msm_vidc_debug_timeout;
		msm_vidc_debug_timeout \|= res->debug_timeout;

		of_property_read_u32(pdev->dev.of_node,
		"qcom,pm-qos-latency-us", &res->pm_qos_latency_us);