Merge "msm: camera: check buffer validity in isp buf mgr" (8cd92729) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c

+46 −5

Original line number	Diff line number	Diff line
		@@ -309,6 +309,9 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id,
		struct msm_isp_buffer *temp_buf_info;
		struct msm_isp_bufq *bufq = NULL;
		struct vb2_buffer *vb2_buf = NULL;
		struct buffer_cmd *buf_pending = NULL;
		struct msm_isp_buffer_mapped_info *mped_info_tmp1;
		struct msm_isp_buffer_mapped_info *mped_info_tmp2;
		bufq = msm_isp_get_bufq(buf_mgr, bufq_handle);
		if (!bufq) {
		pr_err("%s: Invalid bufq\n", __func__);
		@@ -349,21 +352,59 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id,
		list_for_each_entry(temp_buf_info, &bufq->head, list) {
		if (temp_buf_info->state ==
		MSM_ISP_BUFFER_STATE_QUEUED) {

		list_for_each_entry(buf_pending,
		&buf_mgr->buffer_q, list) {
		if (!buf_pending)
		break;
		mped_info_tmp1 =
		buf_pending->mapped_info;
		mped_info_tmp2 =
		&temp_buf_info->mapped_info[0];

		if (mped_info_tmp1 == mped_info_tmp2
		&& (mped_info_tmp1->len ==
		mped_info_tmp2->len)
		&& (mped_info_tmp1->paddr ==
		mped_info_tmp2->paddr)) {
		/* found one buf */
		list_del_init(&temp_buf_info->list);
		list_del_init(
		&temp_buf_info->list);
		*buf_info = temp_buf_info;
		break;
		}
		}
		break;
		}
		}
		break;
		case MSM_ISP_BUFFER_SRC_HAL:
		vb2_buf = buf_mgr->vb2_ops->get_buf(
		bufq->session_id, bufq->stream_id);
		if (vb2_buf) {
		if (vb2_buf->v4l2_buf.index < bufq->num_bufs) {

		list_for_each_entry(buf_pending,
		&buf_mgr->buffer_q, list) {
		if (!buf_pending)
		break;
		mped_info_tmp1 =
		buf_pending->mapped_info;
		mped_info_tmp2 =
		&bufq->bufs[vb2_buf->v4l2_buf.index]
		.mapped_info[0];

		if (mped_info_tmp1 == mped_info_tmp2
		&& (mped_info_tmp1->len ==
		mped_info_tmp2->len)
		&& (mped_info_tmp1->paddr ==
		mped_info_tmp2->paddr)) {
		*buf_info =
		&bufq->bufs[vb2_buf->v4l2_buf.index];
		(*buf_info)->vb2_buf = vb2_buf;
		break;
		}
		}
		} else {
		pr_err("%s: Incorrect buf index %d\n",
		__func__, vb2_buf->v4l2_buf.index);