Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit be985ae7 authored by Chandan Kumar Jha's avatar Chandan Kumar Jha
Browse files

msm:camera:lrme: Fix LRME context Ref Count leak 



LRME ref count is not done properly. It will lead to context ref
count leak.

This change prevents ref count leak by checking refcount value before
decrementing the ref count. It is making sure the ref count never goes
below zero.

Change-Id: Ie6927eb7465ec656cdc959a39fbefe79dcc511fa
Signed-off-by: default avatarChandan Kumar Jha <cjha@codeaurora.org>
parent 0fbb6a6a

drivers/media/platform/msm/camera/cam_core/cam_context.c

+7 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -500,7 +500,12 @@ int cam_context_deinit(struct cam_context *ctx) 


void cam_context_putref(struct cam_context *ctx)

{

	if (atomic_read(&(ctx->refcount.refcount)))

		kref_put(&ctx->refcount, cam_node_put_ctxt_to_free_list);

	else

		WARN(1, "ctx %s %d state %d devhdl %X\n", ctx->dev_name,

			ctx->ctx_id, ctx->state, ctx->dev_hdl);



	CAM_DBG(CAM_CORE,

		"ctx device hdl %ld, ref count %d, dev_name %s",

		ctx->dev_hdl, atomic_read(&(ctx->refcount.refcount)),

drivers/media/platform/msm/camera/cam_sync/cam_sync.c

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -156,7 +156,7 @@ int cam_sync_deregister_callback(sync_callback cb_func, 
			"Error: accessing an uninitialized sync obj = %d",

			sync_obj);

		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);

		return -EINVAL;

		return 0;

	}



	CAM_DBG(CAM_SYNC, "deregistered callback for sync object:%d",