Merge "msm: vidc: fix msm_comm_get_vidc_buffer fd race issue" (de132331) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/media/platform/msm/vidc/msm_vidc_common.c

+17 −19

Original line number	Diff line number	Diff line
		@@ -6508,25 +6508,24 @@ struct msm_vidc_buffer msm_comm_get_vidc_buffer(struct msm_vidc_inst inst,
		struct vb2_v4l2_buffer *vbuf;
		struct vb2_buffer *vb;
		unsigned long dma_planes[VB2_MAX_PLANES] = {0};
		struct msm_vidc_buffer *mbuf;
		struct msm_vidc_buffer *mbuf = NULL;
		bool found = false;
		int i;
		int i = 0, planes = 0;

		if (!inst \|\| !vb2) {
		dprintk(VIDC_ERR, "%s: invalid params\n", __func__);
		return NULL;
		}

		for (i = 0; i < vb2->num_planes; i++) {
		for (planes = 0; planes < vb2->num_planes; planes++) {
		/*
		* always compare dma_buf addresses which is guaranteed
		* to be same across the processes (duplicate fds).
		*/
		dma_planes[i] = (unsigned long)msm_smem_get_dma_buf(
		vb2->planes[i].m.fd);
		if (!dma_planes[i])
		return NULL;
		msm_smem_put_dma_buf((struct dma_buf *)dma_planes[i]);
		dma_planes[planes] = (unsigned long)msm_smem_get_dma_buf(
		vb2->planes[planes].m.fd);
		if (!dma_planes[planes])
		goto put_ref;
		}

		mutex_lock(&inst->registeredbufs.lock);
		@@ -6614,22 +6613,21 @@ struct msm_vidc_buffer msm_comm_get_vidc_buffer(struct msm_vidc_inst inst,
		if (!found)
		list_add_tail(&mbuf->list, &inst->registeredbufs.list);

		mutex_unlock(&inst->registeredbufs.lock);
		exit:
		if (rc == -EEXIST) {
		print_vidc_buffer(VIDC_DBG, "qbuf upon rbr", inst, mbuf);
		return ERR_PTR(rc);
		}

		return mbuf;

		exit:
		} else if (rc) {
		dprintk(VIDC_ERR, "%s: rc %d\n", __func__, rc);
		msm_comm_unmap_vidc_buffer(inst, mbuf);
		if (!found)
		kref_put_mbuf(mbuf);
		}
		mutex_unlock(&inst->registeredbufs.lock);
		put_ref:
		while (planes)
		msm_smem_put_dma_buf((struct dma_buf *)dma_planes[--planes]);

		return ERR_PTR(rc);
		return rc ? ERR_PTR(rc) : mbuf;
		}

		void msm_comm_put_vidc_buffer(struct msm_vidc_inst *inst,