Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2df1fc92 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "mm-camera2:isp2: Avoid use after free buffer"

parents a0ba71ea 1214306b

drivers/media/platform/msm/camera_v2/isp/msm_isp40.c

+5 −1
Original line number Original line Diff line number Diff line
@@ -1053,15 +1053,18 @@ static int msm_vfe40_start_fetch_engine(struct vfe_device *vfe_dev, 
				fe_cfg->stream_id);

				fe_cfg->stream_id);

		vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;

		vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;





		mutex_lock(&vfe_dev->buf_mgr->lock);

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

		if (rc < 0 || !buf) {

		if (rc < 0 || !buf) {

			pr_err("%s: No fetch buffer rc= %d\n",

			pr_err("%s: No fetch buffer rc= %d\n",

				__func__, rc);

				__func__, rc);

			mutex_unlock(&vfe_dev->buf_mgr->lock);

			return -EINVAL;

			return -EINVAL;

		}

		}

		mapped_info = buf->mapped_info[0];

		mapped_info = buf->mapped_info[0];

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		mutex_unlock(&vfe_dev->buf_mgr->lock);

	} else {

	} else {

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

			&mapped_info, fe_cfg->fd);

			&mapped_info, fe_cfg->fd);
@@ -1113,14 +1116,15 @@ static int msm_vfe40_start_fetch_engine_multi_pass(struct vfe_device *vfe_dev, 
		mutex_lock(&vfe_dev->buf_mgr->lock);

		mutex_lock(&vfe_dev->buf_mgr->lock);

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

		mutex_unlock(&vfe_dev->buf_mgr->lock);

		if (rc < 0 || !buf) {

		if (rc < 0 || !buf) {

			pr_err("%s: No fetch buffer rc= %d buf= %pK\n",

			pr_err("%s: No fetch buffer rc= %d buf= %pK\n",

				__func__, rc, buf);

				__func__, rc, buf);

			mutex_unlock(&vfe_dev->buf_mgr->lock);

			return -EINVAL;

			return -EINVAL;

		}

		}

		mapped_info = buf->mapped_info[0];

		mapped_info = buf->mapped_info[0];

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		mutex_unlock(&vfe_dev->buf_mgr->lock);

	} else {

	} else {

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

			&mapped_info, fe_cfg->fd);

			&mapped_info, fe_cfg->fd);

drivers/media/platform/msm/camera_v2/isp/msm_isp44.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -883,13 +883,14 @@ static int msm_vfe44_fetch_engine_start(struct vfe_device *vfe_dev, 
		mutex_lock(&vfe_dev->buf_mgr->lock);

		mutex_lock(&vfe_dev->buf_mgr->lock);

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

		mutex_unlock(&vfe_dev->buf_mgr->lock);

		if (rc < 0) {

		if (rc < 0) {

			pr_err("%s: No fetch buffer\n", __func__);

			pr_err("%s: No fetch buffer\n", __func__);

			mutex_unlock(&vfe_dev->buf_mgr->lock);

			return -EINVAL;

			return -EINVAL;

		}

		}

		mapped_info = buf->mapped_info[0];

		mapped_info = buf->mapped_info[0];

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		mutex_unlock(&vfe_dev->buf_mgr->lock);

	} else {

	} else {

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

			&mapped_info, fe_cfg->fd);

			&mapped_info, fe_cfg->fd);

drivers/media/platform/msm/camera_v2/isp/msm_isp46.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -827,14 +827,15 @@ static int msm_vfe46_start_fetch_engine(struct vfe_device *vfe_dev, 
		mutex_lock(&vfe_dev->buf_mgr->lock);

		mutex_lock(&vfe_dev->buf_mgr->lock);

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

		mutex_unlock(&vfe_dev->buf_mgr->lock);

		if (rc < 0 || !buf) {

		if (rc < 0 || !buf) {

			pr_err("%s: No fetch buffer rc= %d buf= %pK\n",

			pr_err("%s: No fetch buffer rc= %d buf= %pK\n",

				__func__, rc, buf);

				__func__, rc, buf);

			mutex_unlock(&vfe_dev->buf_mgr->lock);

			return -EINVAL;

			return -EINVAL;

		}

		}

		mapped_info = buf->mapped_info[0];

		mapped_info = buf->mapped_info[0];

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		mutex_unlock(&vfe_dev->buf_mgr->lock);

	} else {

	} else {

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

			&mapped_info, fe_cfg->fd);

			&mapped_info, fe_cfg->fd);

drivers/media/platform/msm/camera_v2/isp/msm_isp47.c

+5 −1
Original line number Original line Diff line number Diff line
@@ -1055,15 +1055,18 @@ int msm_vfe47_start_fetch_engine(struct vfe_device *vfe_dev, 
			fe_cfg->stream_id);

			fe_cfg->stream_id);

		vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;

		vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;





		mutex_lock(&vfe_dev->buf_mgr->lock);

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

		if (rc < 0 || !buf) {

		if (rc < 0 || !buf) {

			pr_err("%s: No fetch buffer rc= %d buf= %pK\n",

			pr_err("%s: No fetch buffer rc= %d buf= %pK\n",

				__func__, rc, buf);

				__func__, rc, buf);

			mutex_unlock(&vfe_dev->buf_mgr->lock);

			return -EINVAL;

			return -EINVAL;

		}

		}

		mapped_info = buf->mapped_info[0];

		mapped_info = buf->mapped_info[0];

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		mutex_unlock(&vfe_dev->buf_mgr->lock);

	} else {

	} else {

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

			&mapped_info, fe_cfg->fd);

			&mapped_info, fe_cfg->fd);
@@ -1116,14 +1119,15 @@ int msm_vfe47_start_fetch_engine_multi_pass(struct vfe_device *vfe_dev, 
		mutex_lock(&vfe_dev->buf_mgr->lock);

		mutex_lock(&vfe_dev->buf_mgr->lock);

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

		rc = vfe_dev->buf_mgr->ops->get_buf_by_index(

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

			vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);

		mutex_unlock(&vfe_dev->buf_mgr->lock);

		if (rc < 0 || !buf) {

		if (rc < 0 || !buf) {

			pr_err("%s: No fetch buffer rc= %d buf= %pK\n",

			pr_err("%s: No fetch buffer rc= %d buf= %pK\n",

				__func__, rc, buf);

				__func__, rc, buf);

			mutex_unlock(&vfe_dev->buf_mgr->lock);

			return -EINVAL;

			return -EINVAL;

		}

		}

		mapped_info = buf->mapped_info[0];

		mapped_info = buf->mapped_info[0];

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;

		mutex_unlock(&vfe_dev->buf_mgr->lock);

	} else {

	} else {

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

		rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,

			&mapped_info, fe_cfg->fd);

			&mapped_info, fe_cfg->fd);

drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c

+5 −1
Original line number Original line Diff line number Diff line
@@ -3760,10 +3760,12 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg) 
				&update_cmd->update_info[i];

				&update_cmd->update_info[i];

			stream_info = &axi_data->stream_info[HANDLE_TO_IDX(

			stream_info = &axi_data->stream_info[HANDLE_TO_IDX(

				update_info->stream_handle)];

				update_info->stream_handle)];

			mutex_lock(&vfe_dev->buf_mgr->lock);

			rc = msm_isp_request_frame(vfe_dev, stream_info,

			rc = msm_isp_request_frame(vfe_dev, stream_info,

				update_info->user_stream_id,

				update_info->user_stream_id,

				update_info->frame_id,

				update_info->frame_id,

				MSM_ISP_INVALID_BUF_INDEX);

				MSM_ISP_INVALID_BUF_INDEX);

			mutex_unlock(&vfe_dev->buf_mgr->lock);

			if (rc)

			if (rc)

				pr_err("%s failed to request frame!\n",

				pr_err("%s failed to request frame!\n",

					__func__);

					__func__);
@@ -3835,10 +3837,12 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg) 
		}

		}

		stream_info = &axi_data->stream_info[HANDLE_TO_IDX(

		stream_info = &axi_data->stream_info[HANDLE_TO_IDX(

				req_frm->stream_handle)];

				req_frm->stream_handle)];

		mutex_lock(&vfe_dev->buf_mgr->lock);

		rc = msm_isp_request_frame(vfe_dev, stream_info,

		rc = msm_isp_request_frame(vfe_dev, stream_info,

			req_frm->user_stream_id,

			req_frm->user_stream_id,

			req_frm->frame_id,

			req_frm->frame_id,

			req_frm->buf_index);

			req_frm->buf_index);

		mutex_unlock(&vfe_dev->buf_mgr->lock);

		if (rc)

		if (rc)

			pr_err("%s failed to request frame!\n",

			pr_err("%s failed to request frame!\n",

				__func__);

				__func__);