Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac8cc583 authored by Adrian Salido-Moreno's avatar Adrian Salido-Moreno
Browse files

msm: mdss: fix double sync fence put in buf sync function 



If an error occurs after setting acquire fds, the list of sync fences
will be put for cleanup. However if mdss_fb_wait_for_fence() is called
this will also wait and clear the list of fences, since we are relying
on local variable for cleanup, it may not reflect the state after the
function call. Fix this by maintaining the proper state of the list.

CRs-fixed: 548042
Change-Id: I4885eb393ac9bd2b4818292b9a60f53fb4baacc8
Signed-off-by: default avatarAdrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: default avatarMayank Chopra <makchopra@codeaurora.org>
parent 66619aa7

drivers/video/msm/mdss/mdss_fb.c

+3 −4
Original line number Original line Diff line number Diff line
@@ -1718,7 +1718,7 @@ static int mdss_fb_set_lut(struct fb_info *info, void __user *p) 
static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data,

static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data,

				 struct mdp_buf_sync *buf_sync)

				 struct mdp_buf_sync *buf_sync)

{

{

	int i, fence_cnt = 0, ret = 0;

	int i, ret = 0;

	int acq_fen_fd[MDP_MAX_FENCE_FD];

	int acq_fen_fd[MDP_MAX_FENCE_FD];

	struct sync_fence *fence;

	struct sync_fence *fence;
@@ -1745,10 +1745,9 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data, 
		}

		}

		sync_pt_data->acq_fen[i] = fence;

		sync_pt_data->acq_fen[i] = fence;

	}

	}

	fence_cnt = i;

	sync_pt_data->acq_fen_cnt = i;

	if (ret)

	if (ret)

		goto buf_sync_err_1;

		goto buf_sync_err_1;

	sync_pt_data->acq_fen_cnt = fence_cnt;





	if (buf_sync->flags & MDP_BUF_SYNC_FLAG_WAIT)

	if (buf_sync->flags & MDP_BUF_SYNC_FLAG_WAIT)

		mdss_fb_wait_for_fence(sync_pt_data);

		mdss_fb_wait_for_fence(sync_pt_data);
@@ -1799,7 +1798,7 @@ buf_sync_err_2: 
	sync_pt_data->cur_rel_fence = NULL;

	sync_pt_data->cur_rel_fence = NULL;

	sync_pt_data->cur_rel_fen_fd = 0;

	sync_pt_data->cur_rel_fen_fd = 0;

buf_sync_err_1:

buf_sync_err_1:

	for (i = 0; i < fence_cnt; i++)

	for (i = 0; i < sync_pt_data->acq_fen_cnt; i++)

		sync_fence_put(sync_pt_data->acq_fen[i]);

		sync_fence_put(sync_pt_data->acq_fen[i]);

	sync_pt_data->acq_fen_cnt = 0;

	sync_pt_data->acq_fen_cnt = 0;

	mutex_unlock(&sync_pt_data->sync_mutex);

	mutex_unlock(&sync_pt_data->sync_mutex);