Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f8d331db authored by Arun Menon's avatar Arun Menon
Browse files

msm: vidc: fix memory leak issue in dynamic buffer mode 



While flushing output buffers held in v4l2 video
driver, i.e, with ref count equal to 2, the driver
was freeing the binfo structure. This would leak
the mapped output buffer memory. By avoiding
freeing of the binfo structure, the driver waits
for the release reference event from the firmware
to free and unmap the output buffer. Also move
initialization of dequeued flag for buffers to be
held in driver, till the time we queue this buffer
to firmware. By not doing so, the video driver can
enter a race condition, whereby, a output buffer could
be unmapped and freed before v4l2 client has called
dequeue on the buffer.

Change-Id: Ic95f13b9f4426574012539a76c0b87bedb8e805a
Signed-off-by: default avatarArun Menon <avmenon@codeaurora.org>
parent a260c9b2

drivers/media/platform/msm/vidc/msm_vidc.c

+1 −1
Original line number Diff line number Diff line
@@ -341,7 +341,6 @@ static inline void populate_buf_info(struct buffer_info *binfo, 
	binfo->num_planes = b->length;

	binfo->memory = b->memory;

	binfo->v4l2_index = b->index;

	binfo->dequeued = false;

	binfo->timestamp.tv_sec = b->timestamp.tv_sec;

	binfo->timestamp.tv_usec = b->timestamp.tv_usec;

	dprintk(VIDC_DBG, "%s: fd[%d] = %d b->index = %d",
@@ -358,6 +357,7 @@ static inline void repopulate_v4l2_buffer(struct v4l2_buffer *b, 
	b->index = binfo->v4l2_index;

	b->timestamp.tv_sec = binfo->timestamp.tv_sec;

	b->timestamp.tv_usec = binfo->timestamp.tv_usec;

	binfo->dequeued = false;

	for (i = 0; i < binfo->num_planes; ++i) {

		b->m.planes[i].reserved[0] = binfo->fd[i];

		b->m.planes[i].reserved[1] = binfo->buff_off[i];

drivers/media/platform/msm/vidc/msm_vidc_common.c

+1 −4
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2013, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -3078,9 +3078,6 @@ void msm_comm_flush_dynamic_buffers(struct msm_vidc_inst *inst) 
				dprintk(VIDC_DBG,

					"released buffer held in driver before issuing flush: 0x%x fd[0]: %d\n",

					binfo->device_addr[0], binfo->fd[0]);

				/*delete this buffer info from registered list*/

				list_del(&binfo->list);

				kfree(binfo);

				/*send event to client*/

				v4l2_event_queue_fh(&inst->event_handler,

					&buf_event);