Merge "mm-camera2:isp2: Handle use after free buffer" (271f6cf2) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/media/platform/msm/camera_v2/isp/msm_isp40.c

+6 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1055,15 +1055,18 @@ static int msm_vfe40_start_fetch_engine(struct vfe_device *vfe_dev,
	fe_cfg->stream_id);		fe_cfg->stream_id);
	vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;		vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;

			mutex_lock(&vfe_dev->buf_mgr->lock);
	rc = vfe_dev->buf_mgr->ops->get_buf_by_index(		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
	vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);		vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
	if (rc < 0 \|\| !buf) {		if (rc < 0 \|\| !buf) {
	pr_err("%s: No fetch buffer rc= %d\n",		pr_err("%s: No fetch buffer rc= %d\n",
	__func__, rc);		__func__, rc);
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	return -EINVAL;		return -EINVAL;
	}		}
	mapped_info = buf->mapped_info[0];		mapped_info = buf->mapped_info[0];
	buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	} else {		} else {
	rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
	&mapped_info, fe_cfg->fd);		&mapped_info, fe_cfg->fd);
	@@ -1112,15 +1115,18 @@ static int msm_vfe40_start_fetch_engine_multi_pass(struct vfe_device *vfe_dev,
	fe_cfg->stream_id);		fe_cfg->stream_id);
	vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;		vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;

			mutex_lock(&vfe_dev->buf_mgr->lock);
	rc = vfe_dev->buf_mgr->ops->get_buf_by_index(		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
	vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);		vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
	if (rc < 0 \|\| !buf) {		if (rc < 0 \|\| !buf) {
	pr_err("%s: No fetch buffer rc= %d buf= %pK\n",		pr_err("%s: No fetch buffer rc= %d buf= %pK\n",
	__func__, rc, buf);		__func__, rc, buf);
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	return -EINVAL;		return -EINVAL;
	}		}
	mapped_info = buf->mapped_info[0];		mapped_info = buf->mapped_info[0];
	buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	} else {		} else {
	rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
	&mapped_info, fe_cfg->fd);		&mapped_info, fe_cfg->fd);

drivers/media/platform/msm/camera_v2/isp/msm_isp44.c

+5 −1

Original line number	Original line	Diff line number	Diff line
	/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.		/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
	*		*
	* This program is free software; you can redistribute it and/or modify		* This program is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License version 2 and		* it under the terms of the GNU General Public License version 2 and
	@@ -879,14 +879,18 @@ static int msm_vfe44_fetch_engine_start(struct vfe_device *vfe_dev,
	vfe_dev->buf_mgr, fe_cfg->session_id,		vfe_dev->buf_mgr, fe_cfg->session_id,
	fe_cfg->stream_id);		fe_cfg->stream_id);
	vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;		vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;

			mutex_lock(&vfe_dev->buf_mgr->lock);
	rc = vfe_dev->buf_mgr->ops->get_buf_by_index(		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
	vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);		vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
	if (rc < 0) {		if (rc < 0) {
	pr_err("%s: No fetch buffer\n", __func__);		pr_err("%s: No fetch buffer\n", __func__);
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	return -EINVAL;		return -EINVAL;
	}		}
	mapped_info = buf->mapped_info[0];		mapped_info = buf->mapped_info[0];
	buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	} else {		} else {
	rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
	&mapped_info, fe_cfg->fd);		&mapped_info, fe_cfg->fd);

drivers/media/platform/msm/camera_v2/isp/msm_isp46.c

+4 −1

Original line number	Original line	Diff line number	Diff line
	/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.		/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
	*		*
	* This program is free software; you can redistribute it and/or modify		* This program is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License version 2 and		* it under the terms of the GNU General Public License version 2 and
	@@ -824,15 +824,18 @@ static int msm_vfe46_start_fetch_engine(struct vfe_device *vfe_dev,
	fe_cfg->stream_id);		fe_cfg->stream_id);
	vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;		vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;

			mutex_lock(&vfe_dev->buf_mgr->lock);
	rc = vfe_dev->buf_mgr->ops->get_buf_by_index(		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
	vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);		vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
	if (rc < 0 \|\| !buf) {		if (rc < 0 \|\| !buf) {
	pr_err("%s: No fetch buffer rc= %d buf= %pK\n",		pr_err("%s: No fetch buffer rc= %d buf= %pK\n",
	__func__, rc, buf);		__func__, rc, buf);
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	return -EINVAL;		return -EINVAL;
	}		}
	mapped_info = buf->mapped_info[0];		mapped_info = buf->mapped_info[0];
	buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	} else {		} else {
	rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
	&mapped_info, fe_cfg->fd);		&mapped_info, fe_cfg->fd);

drivers/media/platform/msm/camera_v2/isp/msm_isp47.c

+7 −1

Original line number	Original line	Diff line number	Diff line
	/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.		/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
	*		*
	* This program is free software; you can redistribute it and/or modify		* This program is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License version 2 and		* it under the terms of the GNU General Public License version 2 and
	@@ -1055,15 +1055,18 @@ int msm_vfe47_start_fetch_engine(struct vfe_device *vfe_dev,
	fe_cfg->stream_id);		fe_cfg->stream_id);
	vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;		vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;

			mutex_lock(&vfe_dev->buf_mgr->lock);
	rc = vfe_dev->buf_mgr->ops->get_buf_by_index(		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
	vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);		vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
	if (rc < 0 \|\| !buf) {		if (rc < 0 \|\| !buf) {
	pr_err("%s: No fetch buffer rc= %d buf= %pK\n",		pr_err("%s: No fetch buffer rc= %d buf= %pK\n",
	__func__, rc, buf);		__func__, rc, buf);
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	return -EINVAL;		return -EINVAL;
	}		}
	mapped_info = buf->mapped_info[0];		mapped_info = buf->mapped_info[0];
	buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	} else {		} else {
	rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
	&mapped_info, fe_cfg->fd);		&mapped_info, fe_cfg->fd);
	@@ -1113,15 +1116,18 @@ int msm_vfe47_start_fetch_engine_multi_pass(struct vfe_device *vfe_dev,
	fe_cfg->stream_id);		fe_cfg->stream_id);
	vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;		vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;

			mutex_lock(&vfe_dev->buf_mgr->lock);
	rc = vfe_dev->buf_mgr->ops->get_buf_by_index(		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
	vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);		vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
	if (rc < 0 \|\| !buf) {		if (rc < 0 \|\| !buf) {
	pr_err("%s: No fetch buffer rc= %d buf= %pK\n",		pr_err("%s: No fetch buffer rc= %d buf= %pK\n",
	__func__, rc, buf);		__func__, rc, buf);
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	return -EINVAL;		return -EINVAL;
	}		}
	mapped_info = buf->mapped_info[0];		mapped_info = buf->mapped_info[0];
	buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	} else {		} else {
	rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
	&mapped_info, fe_cfg->fd);		&mapped_info, fe_cfg->fd);

drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -3757,10 +3757,12 @@ int msm_isp_update_axi_stream(struct vfe_device vfe_dev, void arg)
	&update_cmd->update_info[i];		&update_cmd->update_info[i];
	stream_info = &axi_data->stream_info[HANDLE_TO_IDX(		stream_info = &axi_data->stream_info[HANDLE_TO_IDX(
	update_info->stream_handle)];		update_info->stream_handle)];
			mutex_lock(&vfe_dev->buf_mgr->lock);
	rc = msm_isp_request_frame(vfe_dev, stream_info,		rc = msm_isp_request_frame(vfe_dev, stream_info,
	update_info->user_stream_id,		update_info->user_stream_id,
	update_info->frame_id,		update_info->frame_id,
	MSM_ISP_INVALID_BUF_INDEX);		MSM_ISP_INVALID_BUF_INDEX);
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	if (rc)		if (rc)
	pr_err("%s failed to request frame!\n",		pr_err("%s failed to request frame!\n",
	__func__);		__func__);
	@@ -3832,10 +3834,12 @@ int msm_isp_update_axi_stream(struct vfe_device vfe_dev, void arg)
	}		}
	stream_info = &axi_data->stream_info[HANDLE_TO_IDX(		stream_info = &axi_data->stream_info[HANDLE_TO_IDX(
	req_frm->stream_handle)];		req_frm->stream_handle)];
			mutex_lock(&vfe_dev->buf_mgr->lock);
	rc = msm_isp_request_frame(vfe_dev, stream_info,		rc = msm_isp_request_frame(vfe_dev, stream_info,
	req_frm->user_stream_id,		req_frm->user_stream_id,
	req_frm->frame_id,		req_frm->frame_id,
	req_frm->buf_index);		req_frm->buf_index);
			mutex_unlock(&vfe_dev->buf_mgr->lock);
	if (rc)		if (rc)
	pr_err("%s failed to request frame!\n",		pr_err("%s failed to request frame!\n",
	__func__);		__func__);