Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e50e53a authored by Chandan Kumar Jha's avatar Chandan Kumar Jha
Browse files

msm: camera: memmgr: fix the concurrency issue while accessing the list 



In corner cases, There is possibility of concurrent access of mapping
info list during alloc and map the buffer.

To protect that, added mutex lock before accessing the list.

CRs-Fixed: 2751906
Change-Id: I6d390a0650095c1056d7e538d28c8c7d530f50d4
Signed-off-by: default avatarChandan Kumar Jha <cjha@codeaurora.org>
parent 03528467

drivers/cam_req_mgr/cam_mem_mgr.c

+6 −1
Original line number Diff line number Diff line
@@ -657,6 +657,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) 
		goto slot_fail;

	}



	mutex_lock(&tbl.m_lock);

	if ((cmd->flags & CAM_MEM_FLAG_HW_READ_WRITE) ||

		(cmd->flags & CAM_MEM_FLAG_HW_SHARED_ACCESS) ||

		(cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)) {
@@ -686,10 +687,11 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) 
				"Failed in map_hw_va, len=%llu, flags=0x%x, fd=%d, region=%d, num_hdl=%d, rc=%d",

				cmd->len, cmd->flags, fd, region,

				cmd->num_hdl, rc);

			mutex_unlock(&tbl.m_lock);

			goto map_hw_fail;

		}

	}



	mutex_unlock(&tbl.m_lock);

	mutex_lock(&tbl.bufq[idx].q_lock);

	tbl.bufq[idx].fd = fd;

	tbl.bufq[idx].dma_buf = NULL;
@@ -773,6 +775,7 @@ int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd *cmd) 
		return -EINVAL;

	}



	mutex_lock(&tbl.m_lock);

	if ((cmd->flags & CAM_MEM_FLAG_HW_READ_WRITE) ||

		(cmd->flags & CAM_MEM_FLAG_PROTECTED_MODE)) {

		rc = cam_mem_util_map_hw_va(cmd->flags,
@@ -787,9 +790,11 @@ int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd *cmd) 
				"Failed in map_hw_va, flags=0x%x, fd=%d, region=%d, num_hdl=%d, rc=%d",

				cmd->flags, cmd->fd, CAM_SMMU_REGION_IO,

				cmd->num_hdl, rc);

			mutex_unlock(&tbl.m_lock);

			goto map_fail;

		}

	}

	mutex_unlock(&tbl.m_lock);



	idx = cam_mem_get_slot();

	if (idx < 0) {