Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 31f9f56c authored by Aditya Jonnalagadda's avatar Aditya Jonnalagadda
Browse files

msm: camera: check buffer validity in isp buf mgr 



When someone asks for buffer from isp_buf_mgr, check
if buffer is valid. This is done by verifying if it is
present in the list of buffers for this session.

This will potentially avoid few kinds of page faults.

Change-Id: I2a8c701b38316f8bebb8731f72ad238332936618
Signed-off-by: default avatarAditya Jonnalagadda <ajonnala@codeaurora.org>
parent 9dc22ca5

drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c

+46 −5
Original line number Diff line number Diff line
@@ -309,6 +309,9 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id, 
	struct msm_isp_buffer *temp_buf_info;

	struct msm_isp_bufq *bufq = NULL;

	struct vb2_buffer *vb2_buf = NULL;

	struct buffer_cmd *buf_pending = NULL;

	struct msm_isp_buffer_mapped_info *mped_info_tmp1;

	struct msm_isp_buffer_mapped_info *mped_info_tmp2;

	bufq = msm_isp_get_bufq(buf_mgr, bufq_handle);

	if (!bufq) {

		pr_err("%s: Invalid bufq\n", __func__);
@@ -349,21 +352,59 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id, 
		list_for_each_entry(temp_buf_info, &bufq->head, list) {

			if (temp_buf_info->state ==

					MSM_ISP_BUFFER_STATE_QUEUED) {



					list_for_each_entry(buf_pending,

						&buf_mgr->buffer_q, list) {

					if (!buf_pending)

						break;

					mped_info_tmp1 =

						buf_pending->mapped_info;

					mped_info_tmp2 =

						&temp_buf_info->mapped_info[0];



					if (mped_info_tmp1 == mped_info_tmp2

						&& (mped_info_tmp1->len ==

							mped_info_tmp2->len)

						&& (mped_info_tmp1->paddr ==

						mped_info_tmp2->paddr)) {

						/* found one buf */

				list_del_init(&temp_buf_info->list);

						list_del_init(

							&temp_buf_info->list);

						*buf_info = temp_buf_info;

						break;

					}

				}

				break;

			}

		}

		break;

	case MSM_ISP_BUFFER_SRC_HAL:

		vb2_buf = buf_mgr->vb2_ops->get_buf(

			bufq->session_id, bufq->stream_id);

		if (vb2_buf) {

			if (vb2_buf->v4l2_buf.index < bufq->num_bufs) {



				list_for_each_entry(buf_pending,

						&buf_mgr->buffer_q, list) {

					if (!buf_pending)

						break;

					mped_info_tmp1 =

						buf_pending->mapped_info;

					mped_info_tmp2 =

					&bufq->bufs[vb2_buf->v4l2_buf.index]

						.mapped_info[0];



					if (mped_info_tmp1 == mped_info_tmp2

						&& (mped_info_tmp1->len ==

							mped_info_tmp2->len)

						&& (mped_info_tmp1->paddr ==

						mped_info_tmp2->paddr)) {

						*buf_info =

					&bufq->bufs[vb2_buf->v4l2_buf.index];

						(*buf_info)->vb2_buf = vb2_buf;

						break;

					}

				}

			} else {

				pr_err("%s: Incorrect buf index %d\n",

					__func__, vb2_buf->v4l2_buf.index);