Merge "msm: cvp: add session type check for buffer" (4a937de5) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/media/platform/msm/cvp/msm_cvp.c

+19 −5

Original line number	Diff line number	Diff line
		@@ -20,10 +20,10 @@ void print_internal_buffer(u32 tag, const char *str,
		return;

		dprintk(tag,
		"%s: %x : idx %2d fd %d off %d %s size %d flags 0x%x",
		"%s: %x : idx %2d fd %d off %d %s size %d flags %#x iova %#x",
		str, hash32_ptr(inst->session), cbuf->buf.index, cbuf->buf.fd,
		cbuf->buf.offset, cbuf->smem.dma_buf->name, cbuf->buf.size,
		cbuf->buf.flags);
		cbuf->buf.flags, cbuf->smem.device_addr);
		}

		static enum hal_buffer get_hal_buftype(const char *str, unsigned int type)
		@@ -387,10 +387,9 @@ static int msm_cvp_map_buf_cpu(struct msm_cvp_inst *inst,
		if (in_buf->fd > 0) {
		dma_buf = msm_cvp_smem_get_dma_buf(in_buf->fd);
		if (!dma_buf) {
		rc = -EINVAL;
		dprintk(CVP_ERR, "%s: Invalid fd=%d", __func__,
		in_buf->fd);
		goto exit;
		return -EINVAL;
		}
		in_buf->dbuf = dma_buf;
		msm_cvp_smem_put_dma_buf(dma_buf);
		@@ -414,7 +413,7 @@ static int msm_cvp_map_buf_cpu(struct msm_cvp_inst *inst,
		cbuf->smem.fd = cbuf->buf.fd;
		cbuf->smem.size = cbuf->buf.size;
		cbuf->smem.flags = 0;
		cbuf->smem.offset = 0;
		cbuf->smem.offset = in_buf->offset;
		cbuf->smem.dma_buf = in_buf->dbuf;

		rc = msm_cvp_smem_map_dma_buf(inst, &cbuf->smem);
		@@ -675,6 +674,21 @@ static int msm_cvp_map_buf(struct msm_cvp_inst *inst,
		if (version >= 1) {
		new_buf = (struct cvp_buf_type *)buf_ptr;

		/*
		* Make sure fd or dma_buf field doesn't have any
		* garbage value.
		*/
		if (inst->session_type == MSM_CVP_USER) {
		new_buf->dbuf = 0;
		} else if (inst->session_type == MSM_CVP_KERNEL) {
		new_buf->fd = -1;
		} else if (inst->session_type >= MSM_CVP_UNKNOWN) {
		dprintk(CVP_ERR,
		"%s: unknown session type %d\n",
		__func__, inst->session_type);
		return -EINVAL;
		}

		if (new_buf->fd <= 0 && !new_buf->dbuf)
		continue;

drivers/media/platform/msm/cvp/msm_cvp_common.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1267,7 +1267,7 @@ int msm_cvp_comm_try_state(struct msm_cvp_inst *inst, int state)
		case MSM_CVP_CORE_INVALID:
		dprintk(CVP_INFO, "Sending core uninit\n");
		rc = msm_cvp_deinit_core(inst);
		if (rc \|\| state == get_flipped_state(inst->state, state))
		if (rc \|\| state <= get_flipped_state(inst->state, state))
		break;
		default:
		dprintk(CVP_ERR, "State not recognized\n");

drivers/media/platform/msm/cvp/msm_cvp_core.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -446,7 +446,10 @@ int msm_cvp_close(void *instance)
		}

		msm_cvp_cleanup_instance(inst);

		if (inst->session_type != MSM_CVP_BOOT)
		msm_cvp_session_deinit(inst);

		rc = msm_cvp_comm_try_state(inst, MSM_CVP_CORE_UNINIT);
		if (rc) {
		dprintk(CVP_ERR,

drivers/media/platform/msm/cvp/msm_cvp_core.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -86,6 +86,7 @@ enum core_id {
		enum session_type {
		MSM_CVP_USER = 1,
		MSM_CVP_KERNEL,
		MSM_CVP_BOOT,
		MSM_CVP_UNKNOWN,
		MSM_CVP_MAX_DEVICES = MSM_CVP_UNKNOWN,
		};

drivers/media/platform/msm/cvp/msm_smem.c

+15 −5

Original line number	Diff line number	Diff line
		@@ -197,13 +197,12 @@ int msm_cvp_smem_map_dma_buf(struct msm_cvp_inst *inst,
		if (!inst \|\| !smem) {
		dprintk(CVP_ERR, "%s: Invalid params: %pK %pK\n",
		__func__, inst, smem);
		rc = -EINVAL;
		goto exit;
		return -EINVAL;
		}

		if (smem->refcount) {
		smem->refcount++;
		goto exit;
		return rc;
		}

		if (smem->fd > 0) {
		@@ -212,7 +211,7 @@ int msm_cvp_smem_map_dma_buf(struct msm_cvp_inst *inst,
		rc = -EINVAL;
		dprintk(CVP_ERR, "%s: Invalid fd=%d", __func__,
		smem->fd);
		goto exit;
		return rc;
		}
		smem->dma_buf = dbuf;
		} else {
		@@ -232,6 +231,13 @@ int msm_cvp_smem_map_dma_buf(struct msm_cvp_inst *inst,
		smem->flags \|= SMEM_SECURE;

		buffer_size = smem->size;
		if (smem->offset > dbuf->size - 1 \|\|
		smem->offset + buffer_size > dbuf->size) {
		dprintk(CVP_WARN, "%s: invalid offset %d or size %d\n",
		__func__, smem->offset, buffer_size);
		rc = -EINVAL;
		goto exit;
		}

		/* Ignore the buffer_type from user space. Only use ion flags */
		rc = msm_dma_get_device_address(dbuf, align, &iova, &buffer_size,
		@@ -249,9 +255,13 @@ int msm_cvp_smem_map_dma_buf(struct msm_cvp_inst *inst,
		}

		smem->device_addr = (u32)iova;

		smem->refcount++;

		return rc;
		exit:
		dma_buf_put(dbuf);
		smem->device_addr = 0x0;
		smem->dma_buf = NULL;
		return rc;
		}