Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9d40d66e authored by Jeyaprakash Soundrapandian's avatar Jeyaprakash Soundrapandian Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: camera: sync: Protect sync destroy against race condition" into dev/msm-4.9-camx

parents 5ae29410 e55fd33c

drivers/media/platform/msm/camera/cam_sync/cam_sync.c

+4 −0
Original line number Diff line number Diff line
@@ -343,15 +343,19 @@ int cam_sync_destroy(int32_t sync_obj) 
	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0)

		return -EINVAL;



	spin_lock_bh(&sync_dev->row_spinlocks[sync_obj]);

	row = sync_dev->sync_table + sync_obj;

	if (row->state == CAM_SYNC_STATE_INVALID) {

		CAM_ERR(CAM_SYNC,

			"Error: accessing an uninitialized sync obj: idx = %d",

			sync_obj);

		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);

		return -EINVAL;

	}



	cam_sync_deinit_object(sync_dev->sync_table, sync_obj);

	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);



	return 0;

}

drivers/media/platform/msm/camera/cam_sync/cam_sync_util.c

+4 −3
Original line number Diff line number Diff line
@@ -205,7 +205,6 @@ int cam_sync_deinit_object(struct sync_table_row *table, uint32_t idx) 
	if (!table || idx <= 0 || idx >= CAM_SYNC_MAX_OBJS)

		return -EINVAL;



	spin_lock_bh(&sync_dev->row_spinlocks[idx]);

	clear_bit(idx, sync_dev->bitmap);

	list_for_each_entry_safe(child_info, temp_child,

				&row->children_list, list) {
@@ -233,7 +232,6 @@ int cam_sync_deinit_object(struct sync_table_row *table, uint32_t idx) 


	row->state = CAM_SYNC_STATE_INVALID;

	memset(row, 0, sizeof(*row));

	spin_unlock_bh(&sync_dev->row_spinlocks[idx]);



	return 0;

}
@@ -244,11 +242,14 @@ void cam_sync_util_cb_dispatch(struct work_struct *cb_dispatch_work) 
		struct sync_callback_info,

		cb_dispatch_work);



	spin_lock_bh(&sync_dev->row_spinlocks[cb_info->sync_obj]);

	list_del_init(&cb_info->list);

	spin_unlock_bh(&sync_dev->row_spinlocks[cb_info->sync_obj]);



	cb_info->callback_func(cb_info->sync_obj,

		cb_info->status,

		cb_info->cb_data);



	list_del_init(&cb_info->list);

	kfree(cb_info);

}