Merge "msm: sde: avoid request dereference with cached sequence id" (ea5c48de) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/media/platform/msm/sde/rotator/sde_rotator_dev.c

+9 −11

Original line number	Diff line number	Diff line
		@@ -1162,7 +1162,6 @@ static void sde_rotator_update_retire_sequence(
		struct sde_rotator_request *request)
		{
		struct sde_rotator_ctx *ctx;
		struct sde_rot_entry_container *req;

		if (!request \|\| !request->ctx) {
		SDEROT_ERR("invalid parameters\n");
		@@ -1170,11 +1169,7 @@ static void sde_rotator_update_retire_sequence(
		}

		ctx = request->ctx;
		req = request->req;

		if (req && req->entries && req->count)
		ctx->retired_sequence_id =
		req->entries[req->count - 1].item.sequence_id;
		ctx->retired_sequence_id = request->sequence_id;

		wake_up(&ctx->wait_queue);

		@@ -1199,6 +1194,7 @@ static void sde_rotator_retire_request(struct sde_rotator_request *request)
		ctx = request->ctx;

		request->req = NULL;
		request->sequence_id = 0;
		request->committed = false;
		spin_lock(&ctx->list_lock);
		list_del_init(&request->list);
		@@ -1216,17 +1212,14 @@ static void sde_rotator_retire_request(struct sde_rotator_request *request)
		static bool sde_rotator_is_request_retired(struct sde_rotator_request *request)
		{
		struct sde_rotator_ctx *ctx;
		struct sde_rot_entry_container *req;
		u32 sequence_id;
		s32 retire_delta;

		if (!request \|\| !request->ctx \|\| !request->req \|\|
		!request->req->entries \|\| !request->req->count)
		if (!request \|\| !request->ctx)
		return true;

		ctx = request->ctx;
		req = request->req;
		sequence_id = req->entries[req->count - 1].item.sequence_id;
		sequence_id = request->sequence_id;

		retire_delta = (s32) (ctx->retired_sequence_id - sequence_id);

		@@ -1643,6 +1636,7 @@ int sde_rotator_inline_commit(void handle, struct sde_rotator_inline_cmd cmd,
		}

		request->req = req;
		request->sequence_id = req->entries[0].item.sequence_id;

		spin_lock(&ctx->list_lock);
		list_del_init(&request->list);
		@@ -3000,6 +2994,8 @@ static int sde_rotator_process_buffers(struct sde_rotator_ctx *ctx,

		sde_rotator_queue_request(rot_dev->mgr, ctx->private, req);
		request->req = req;
		request->sequence_id = item.sequence_id;
		request->committed = true;

		return 0;
		error_handle_request:
		@@ -3008,6 +3004,8 @@ static int sde_rotator_process_buffers(struct sde_rotator_ctx *ctx,
		error_fence_wait:
		error_null_buffer:
		request->req = NULL;
		request->sequence_id = 0;
		request->committed = false;
		return ret;
		}

drivers/media/platform/msm/sde/rotator/sde_rotator_dev.h

+5 −1

Original line number	Diff line number	Diff line
		@@ -90,9 +90,12 @@ struct sde_rotator_vbinfo {
		* @list: list head for submit/retire list
		* @submit_work: submit work structure
		* @retire_work: retire work structure
		* @request: Pointer to core layer rotator manager request
		* @req: Pointer to core layer rotator manager request
		* Request can be freed by core layer during sde_rotator_stop_streaming.
		* Avoid dereference in dev layer if possible.
		* @ctx: Pointer to parent context
		* @committed: true if request committed to hardware
		* @sequence_id: sequence identifier of this request
		*/
		struct sde_rotator_request {
		struct list_head list;
		@@ -101,6 +104,7 @@ struct sde_rotator_request {
		struct sde_rot_entry_container *req;
		struct sde_rotator_ctx *ctx;
		bool committed;
		u32 sequence_id;
		};

		/*