Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18fd0cce authored by Philipp Zabel's avatar Philipp Zabel Committed by Mauro Carvalho Chehab
Browse files

[media] coda: fix timestamp list handling 



Lock modification of the timestamp list with bitstream_mutex and do not
try to remove a timestamp element if the list is empty. This can happen
if the userspace feeds us garbage or multiple encoded frames in a single
buffer.

Signed-off-by: default avatarMichael Olbrich <m.olbrich@pengutronix.de>
Signed-off-by: default avatarPhilipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: default avatarKamil Debski <k.debski@samsung.com>
Signed-off-by: default avatarMauro Carvalho Chehab <m.chehab@samsung.com>
parent 68fc31c5

drivers/media/platform/coda/coda-bit.c

+19 −9
Original line number Original line Diff line number Diff line
@@ -1699,18 +1699,28 @@ static void coda_finish_decode(struct coda_ctx *ctx) 
		v4l2_err(&dev->v4l2_dev,

		v4l2_err(&dev->v4l2_dev,

			 "decoded frame index out of range: %d\n", decoded_idx);

			 "decoded frame index out of range: %d\n", decoded_idx);

	} else {

	} else {

		val = coda_read(dev, CODA_RET_DEC_PIC_FRAME_NUM) - 1;

		val -= ctx->sequence_offset;

		mutex_lock(&ctx->bitstream_mutex);

		if (!list_empty(&ctx->timestamp_list)) {

			ts = list_first_entry(&ctx->timestamp_list,

			ts = list_first_entry(&ctx->timestamp_list,

					      struct coda_timestamp, list);

					      struct coda_timestamp, list);

			list_del(&ts->list);

			list_del(&ts->list);

		val = coda_read(dev, CODA_RET_DEC_PIC_FRAME_NUM) - 1;

		val -= ctx->sequence_offset;

			if (val != (ts->sequence & 0xffff)) {

			if (val != (ts->sequence & 0xffff)) {

				v4l2_err(&dev->v4l2_dev,

				v4l2_err(&dev->v4l2_dev,

					 "sequence number mismatch (%d(%d) != %d)\n",

					 "sequence number mismatch (%d(%d) != %d)\n",

				 val, ctx->sequence_offset, ts->sequence);

					 val, ctx->sequence_offset,

					 ts->sequence);

			}

			}

			ctx->frame_timestamps[decoded_idx] = *ts;

			ctx->frame_timestamps[decoded_idx] = *ts;

			kfree(ts);

			kfree(ts);

		} else {

			v4l2_err(&dev->v4l2_dev, "empty timestamp list!\n");

			memset(&ctx->frame_timestamps[decoded_idx], 0,

			       sizeof(struct coda_timestamp));

			ctx->frame_timestamps[decoded_idx].sequence = val;

		}

		mutex_unlock(&ctx->bitstream_mutex);





		val = coda_read(dev, CODA_RET_DEC_PIC_TYPE) & 0x7;

		val = coda_read(dev, CODA_RET_DEC_PIC_TYPE) & 0x7;

		if (val == 0)

		if (val == 0)

drivers/media/platform/coda/coda-common.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -1116,12 +1116,14 @@ static void coda_stop_streaming(struct vb2_queue *q) 
	if (!ctx->streamon_out && !ctx->streamon_cap) {

	if (!ctx->streamon_out && !ctx->streamon_cap) {

		struct coda_timestamp *ts;

		struct coda_timestamp *ts;





		mutex_lock(&ctx->bitstream_mutex);

		while (!list_empty(&ctx->timestamp_list)) {

		while (!list_empty(&ctx->timestamp_list)) {

			ts = list_first_entry(&ctx->timestamp_list,

			ts = list_first_entry(&ctx->timestamp_list,

					      struct coda_timestamp, list);

					      struct coda_timestamp, list);

			list_del(&ts->list);

			list_del(&ts->list);

			kfree(ts);

			kfree(ts);

		}

		}

		mutex_unlock(&ctx->bitstream_mutex);

		kfifo_init(&ctx->bitstream_fifo,

		kfifo_init(&ctx->bitstream_fifo,

			ctx->bitstream.vaddr, ctx->bitstream.size);

			ctx->bitstream.vaddr, ctx->bitstream.size);

		ctx->runcounter = 0;

		ctx->runcounter = 0;