Merge "msm: vidc: fix corruption of registered buffer list" (20d4a554) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/vidc/hfi_response_handler.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -283,7 +283,9 @@ static void hfi_process_event_notify(
		break;
		case HFI_EVENT_RELEASE_BUFFER_REFERENCE:
		dprintk(VIDC_INFO, "HFI_EVENT_RELEASE_BUFFER_REFERENCE\n");
		hfi_process_evt_release_buffer_ref(callback, device_id, pkt);
		if (!validate_session_pkt(sessions, sess, session_lock))
		hfi_process_evt_release_buffer_ref(callback,
		device_id, pkt);
		break;
		default:
		dprintk(VIDC_WARN,

+25 −13

Original line number	Diff line number	Diff line
		@@ -732,6 +732,8 @@ int msm_vidc_release_buffers(void *instance, int buffer_type)
		return -EINVAL;

		list_for_each_safe(ptr, next, &inst->registered_bufs) {
		bool release_buf = false;
		mutex_lock(&inst->lock);
		bi = list_entry(ptr, struct buffer_info, list);
		if (bi->type == buffer_type) {
		buffer_info.type = bi->type;
		@@ -749,6 +751,11 @@ int msm_vidc_release_buffers(void *instance, int buffer_type)
		buffer_info.m.planes[i].length);
		}
		buffer_info.length = bi->num_planes;
		release_buf = true;
		}
		mutex_unlock(&inst->lock);
		if (!release_buf)
		continue;
		if (inst->session_type == MSM_VIDC_DECODER)
		rc = msm_vdec_release_buf(instance,
		&buffer_info);
		@@ -761,7 +768,11 @@ int msm_vidc_release_buffers(void *instance, int buffer_type)
		buffer_info.m.planes[0].reserved[0],
		buffer_info.m.planes[0].reserved[1],
		buffer_info.m.planes[0].length);

		}
		mutex_lock(&inst->lock);
		list_for_each_safe(ptr, next, &inst->registered_bufs) {
		bi = list_entry(ptr, struct buffer_info, list);
		if (bi->type == buffer_type) {
		list_del(&bi->list);
		for (i = 0; i < bi->num_planes; i++) {
		if (bi->handle[i] && bi->mapped[i]) {
		@@ -777,6 +788,7 @@ int msm_vidc_release_buffers(void *instance, int buffer_type)
		kfree(bi);
		}
		}
		mutex_unlock(&inst->lock);
		return rc;
		}
		EXPORT_SYMBOL(msm_vidc_release_buffers);

+11 −1

Original line number	Diff line number	Diff line
		@@ -524,6 +524,14 @@ static void handle_event_change(enum command_response cmd, void *data)
		event_notify->packet_buffer,
		event_notify->exra_data_buffer);

		if (inst->state == MSM_VIDC_CORE_INVALID \|\|
		inst->core->state ==
		VIDC_CORE_INVALID) {
		dprintk(VIDC_DBG,
		"Event release buf ref received in invalid state - discard\n");
		return;
		}

		/*
		* Get the buffer_info entry for the
		* device address.
		@@ -3107,6 +3115,9 @@ int msm_comm_flush(struct msm_vidc_inst *inst, u32 flags)
		dprintk(VIDC_INFO, "Input only flush not supported\n");
		return 0;
		}
		mutex_lock(&inst->sync_lock);
		msm_comm_flush_dynamic_buffers(inst);
		mutex_unlock(&inst->sync_lock);
		if (inst->state == MSM_VIDC_CORE_INVALID \|\|
		core->state == VIDC_CORE_INVALID) {
		dprintk(VIDC_ERR,
		@@ -3117,7 +3128,6 @@ int msm_comm_flush(struct msm_vidc_inst *inst, u32 flags)
		}

		mutex_lock(&inst->sync_lock);
		msm_comm_flush_dynamic_buffers(inst);
		if (inst->in_reconfig && !ip_flush && op_flush) {
		if (!list_empty(&inst->pendingq)) {
		/*Execution can never reach here since port reconfig