Merge "msm: vidc: Add checks before accessing variables" (ae8c2398) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/vidc/hfi_response_handler.c

+15 −19

Original line number	Diff line number	Diff line
		@@ -402,8 +402,9 @@ static inline void copy_cap_prop(
		struct vidc_hal_session_init_done *sess_init_done)
		{
		struct hal_capability_supported *out = NULL;
		if (!in) {
		dprintk(VIDC_ERR, "Invalid input for supported capabilties\n");
		if (!in \|\| !sess_init_done) {
		dprintk(VIDC_ERR, "%s Invalid input parameter\n",
		__func__);
		return;
		}
		switch (in->capability_type) {
		@@ -1089,9 +1090,8 @@ static void hfi_process_session_start_done(msm_vidc_callback callback,

		if (!pkt \|\| pkt->size !=
		sizeof(struct hfi_msg_session_start_done_packet)) {
		dprintk(VIDC_ERR,
		"hal_process_session_start_done: bad packet/packet size: %d\n",
		pkt->size);
		dprintk(VIDC_ERR, "%s: bad packet/packet size\n",
		__func__);
		return;
		}

		@@ -1113,9 +1113,8 @@ static void hfi_process_session_stop_done(msm_vidc_callback callback,

		if (!pkt \|\| pkt->size !=
		sizeof(struct hfi_msg_session_stop_done_packet)) {
		dprintk(VIDC_ERR,
		"hal_process_session_stop_done: bad packet/packet size: %d\n",
		pkt->size);
		dprintk(VIDC_ERR, "%s: bad packet/packet size\n",
		__func__);
		return;
		}

		@@ -1138,9 +1137,8 @@ static void hfi_process_session_rel_res_done(msm_vidc_callback callback,

		if (!pkt \|\| pkt->size !=
		sizeof(struct hfi_msg_session_release_resources_done_packet)) {
		dprintk(VIDC_ERR,
		"hal_process_session_rel_res_done: bad packet/packet size: %d\n",
		pkt->size);
		dprintk(VIDC_ERR, "%s: bad packet/packet size\n",
		__func__);
		return;
		}

		@@ -1161,7 +1159,7 @@ static void hfi_process_session_rel_buf_done(msm_vidc_callback callback,
		if (!pkt \|\| pkt->size !=
		sizeof(struct
		hfi_msg_session_release_buffers_done_packet)) {
		dprintk(VIDC_ERR, "bad packet/packet size: 0x%x\n", pkt->size);
		dprintk(VIDC_ERR, "bad packet/packet size\n");
		return;
		}
		dprintk(VIDC_DBG, "RECEIVED:SESSION_RELEASE_BUFFER_DONE[%p]\n",
		@@ -1190,9 +1188,7 @@ static void hfi_process_session_end_done(msm_vidc_callback callback,

		if (!pkt \|\| pkt->size !=
		sizeof(struct hfi_msg_sys_session_end_done_packet)) {
		dprintk(VIDC_ERR,
		"hal_process_session_end_done: bad packet/packet size: %d\n",
		pkt->size);
		dprintk(VIDC_ERR, "%s: bad packet/packet size\n", __func__);
		return;
		}

		@@ -1235,7 +1231,8 @@ static void hfi_process_session_get_seq_hdr_done(msm_vidc_callback callback,
		if (!pkt \|\| pkt->size !=
		sizeof(struct
		hfi_msg_session_get_sequence_header_done_packet)) {
		dprintk(VIDC_ERR, "bad packet/packet size: %d\n", pkt->size);
		dprintk(VIDC_ERR, "%s: bad packet/packet size\n",
		__func__);
		return;
		}
		dprintk(VIDC_DBG, "RECEIVED:SESSION_GET_SEQ_HDR_DONE[%p]\n", session);
		@@ -1339,9 +1336,8 @@ u32 hfi_process_msg_packet(msm_vidc_callback callback, u32 device_id,
		sys_pkt_func_def sys_pkt_func = NULL;

		if (!callback \|\| !msg_hdr \|\| msg_hdr->size < VIDC_IFACEQ_MIN_PKT_SIZE) {
		dprintk(VIDC_ERR,
		"hal_process_msg_packet: bad packet/packet size: %d\n",
		msg_hdr->size);
		dprintk(VIDC_ERR, "%s: bad packet/packet size\n",
		__func__);
		rc = -EINVAL;
		return rc;
		}

drivers/media/platform/msm/vidc/msm_vdec.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -759,7 +759,7 @@ int msm_vdec_release_buf(struct msm_vidc_inst *inst,
		{
		int rc = 0;
		struct vidc_buffer_addr_info buffer_info;
		struct msm_vidc_core *core = inst->core;
		struct msm_vidc_core *core;
		int extra_idx = 0;
		int i;
		struct hfi_device *hdev;
		@@ -768,7 +768,7 @@ int msm_vdec_release_buf(struct msm_vidc_inst *inst,
		dprintk(VIDC_ERR, "%s invalid parameters\n", __func__);
		return -EINVAL;
		}

		core = inst->core;
		hdev = inst->core->device;

		if (inst->state == MSM_VIDC_CORE_INVALID \|\|
		@@ -1619,12 +1619,13 @@ static void msm_vdec_buf_queue(struct vb2_buffer *vb)
		int msm_vdec_cmd(struct msm_vidc_inst inst, struct v4l2_decoder_cmd dec)
		{
		int rc = 0;
		struct msm_vidc_core *core = inst->core;
		struct msm_vidc_core *core;

		if (!dec \|\| !inst \|\| !inst->core) {
		dprintk(VIDC_ERR, "%s invalid params\n", __func__);
		return -EINVAL;
		}
		core = inst->core;
		switch (dec->cmd) {
		case V4L2_DEC_QCOM_CMD_FLUSH:
		if (core->state != VIDC_CORE_INVALID &&

drivers/media/platform/msm/vidc/msm_venc.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2865,7 +2865,7 @@ int msm_venc_s_fmt(struct msm_vidc_inst inst, struct v4l2_format f)
		fmt = msm_comm_get_pixel_fmt_fourcc(venc_formats,
		ARRAY_SIZE(venc_formats), f->fmt.pix_mp.pixelformat,
		OUTPUT_PORT);
		if (fmt && fmt->type != OUTPUT_PORT) {
		if (!fmt \|\| fmt->type != OUTPUT_PORT) {
		dprintk(VIDC_ERR,
		"Format: %d not supported on OUTPUT port\n",
		f->fmt.pix_mp.pixelformat);

drivers/media/platform/msm/vidc/msm_vidc_common.c

+45 −17

Original line number	Diff line number	Diff line
		@@ -37,6 +37,8 @@
		(__height / 16) * (__width / 16) * __fps; \
		})

		#define IS_CMD_VALID(cmd) ((cmd - SESSION_MSG_START) <= SESSION_MSG_END)

		struct getprop_buf {
		struct list_head list;
		void *data;
		@@ -298,7 +300,9 @@ struct msm_vidc_core *get_vidc_core(int core_id)
		}
		mutex_lock(&vidc_driver->lock);
		list_for_each_entry(core, &vidc_driver->cores, list) {
		if (core && core->id == core_id) {
		if (!core)
		return NULL;
		if (core->id == core_id) {
		found = 1;
		break;
		}
		@@ -432,8 +436,13 @@ static void handle_session_release_buf_done(enum command_response cmd,
		}

		if (!buf_found)
		dprintk(VIDC_ERR, "invalid buffer received from firmware\n");
		dprintk(VIDC_ERR, "invalid buffer received from firmware");
		if (IS_CMD_VALID(cmd)) {
		complete(&inst->completions[SESSION_MSG_INDEX(cmd)]);
		} else {
		dprintk(VIDC_ERR, "Invalid inst cmd response: %d\n", cmd);
		return;
		}
		}

		static void handle_sys_release_res_done(
		@@ -451,7 +460,12 @@ static void handle_sys_release_res_done(
		dprintk(VIDC_ERR, "Wrong device_id received\n");
		return;
		}
		if (IS_CMD_VALID(cmd)) {
		complete(&core->completions[SYS_MSG_INDEX(cmd)]);
		} else {
		dprintk(VIDC_ERR, "Invalid core cmd response: %d\n", cmd);
		return;
		}
		}

		static void change_inst_state(struct msm_vidc_inst *inst,
		@@ -482,7 +496,12 @@ static int signal_session_msg_receipt(enum command_response cmd,
		dprintk(VIDC_ERR, "Invalid(%p) instance id\n", inst);
		return -EINVAL;
		}
		if (IS_CMD_VALID(cmd)) {
		complete(&inst->completions[SESSION_MSG_INDEX(cmd)]);
		} else {
		dprintk(VIDC_ERR, "Invalid inst cmd response: %d\n", cmd);
		return -EINVAL;
		}
		return 0;
		}

		@@ -490,13 +509,16 @@ static int wait_for_sess_signal_receipt(struct msm_vidc_inst *inst,
		enum command_response cmd)
		{
		int rc = 0;

		if (!IS_CMD_VALID(cmd)) {
		dprintk(VIDC_ERR, "Invalid inst cmd response: %d\n", cmd);
		return -EINVAL;
		}
		rc = wait_for_completion_timeout(
		&inst->completions[SESSION_MSG_INDEX(cmd)],
		msecs_to_jiffies(msm_vidc_hw_rsp_timeout));
		if (!rc) {
		dprintk(VIDC_ERR,
		"%s: Wait interrupted or timed out [%p]: %d\n",
		__func__, inst, SESSION_MSG_INDEX(cmd));
		dprintk(VIDC_ERR, "Wait interrupted or timedout: %d\n", rc);
		msm_comm_kill_session(inst);
		rc = -EIO;
		} else {
		@@ -702,10 +724,8 @@ static void handle_event_change(enum command_response cmd, void *data)
		inst->prop.width[CAPTURE_PORT] = event_notify->width;
		}
		rc = msm_vidc_check_session_supported(inst);
		if (!rc) {
		if (!rc)
		msm_vidc_queue_v4l2_event(inst, event);
		}

		return;
		} else {
		dprintk(VIDC_ERR,
		@@ -757,8 +777,7 @@ static void handle_load_resource_done(enum command_response cmd, void *data)
		response->status);
		msm_comm_generate_session_error(inst);
		}
		}
		else
		} else
		dprintk(VIDC_ERR,
		"Failed to get valid response for load resource\n");
		}
		@@ -2436,12 +2455,20 @@ int msm_comm_qbuf(struct vb2_buffer *vb)
		struct hfi_device *hdev;
		int extra_idx = 0;

		if (!vb \|\| !vb->vb2_queue) {
		dprintk(VIDC_ERR, "%s: Invalid input: %p\n",
		__func__, vb);
		return -EINVAL;
		}

		q = vb->vb2_queue;
		inst = q->drv_priv;
		if (!inst \|\| !vb) {
		dprintk(VIDC_ERR, "Invalid input: %p, %p\n", inst, vb);
		if (!inst) {
		dprintk(VIDC_ERR, "%s: Invalid input: %p\n",
		__func__, vb);
		return -EINVAL;
		}

		core = inst->core;
		if (!core) {
		dprintk(VIDC_ERR,
		@@ -2450,7 +2477,8 @@ int msm_comm_qbuf(struct vb2_buffer *vb)
		}
		hdev = core->device;
		if (!hdev) {
		dprintk(VIDC_ERR, "Invalid input: %p\n", hdev);
		dprintk(VIDC_ERR, "%s: Invalid input: %p\n",
		__func__, hdev);
		return -EINVAL;
		}