Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit baf9b0ea authored by Srinu Gorle's avatar Srinu Gorle
Browse files

msm: vidc: protect instance while accessing instance properties 



If video instance deletion and inst_info_read read happens parallel,
page faults are observed while referring deleted instance properties.
Protect instance with get_inst() and put_inst() to avoid above concurrency.

CRs-Fixed: 1009450
Change-Id: I04d0f4fba7419f067b53c3f228dfe4f789fb910b
Signed-off-by: default avatarSrinu Gorle <sgorle@codeaurora.org>
parent d3fdca6f

drivers/media/platform/msm/vidc/msm_vidc_common.c

+2 −2
Original line number Diff line number Diff line
@@ -680,7 +680,7 @@ static void handle_sys_init_done(enum hal_command_response cmd, void *data) 
	return;

}



static void put_inst(struct msm_vidc_inst *inst)

void put_inst(struct msm_vidc_inst *inst)

{

	void put_inst_helper(struct kref *kref)

	{
@@ -696,7 +696,7 @@ static void put_inst(struct msm_vidc_inst *inst) 
	kref_put(&inst->kref, put_inst_helper);

}



static struct msm_vidc_inst *get_inst(struct msm_vidc_core *core,

struct msm_vidc_inst *get_inst(struct msm_vidc_core *core,

		void *session_id)

{

	struct msm_vidc_inst *inst = NULL;

drivers/media/platform/msm/vidc/msm_vidc_common.h

+2 −0
Original line number Diff line number Diff line
@@ -96,4 +96,6 @@ int msm_comm_ctrl_deinit(struct msm_vidc_inst *inst); 
void msm_comm_cleanup_internal_buffers(struct msm_vidc_inst *inst);

int msm_vidc_comm_s_parm(struct msm_vidc_inst *inst, struct v4l2_streamparm *a);

bool msm_comm_turbo_session(struct msm_vidc_inst *inst);

struct msm_vidc_inst *get_inst(struct msm_vidc_core *core, void *session_id);

void put_inst(struct msm_vidc_inst *inst);

#endif

drivers/media/platform/msm/vidc/msm_vidc_debug.c

+11 −3
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
 */



#define CREATE_TRACE_POINTS

#include "msm_vidc_common.h"

#include "msm_vidc_debug.h"

#include "vidc_hfi_api.h"
@@ -266,11 +267,18 @@ static ssize_t inst_info_read(struct file *file, char __user *buf, 
		size_t count, loff_t *ppos)

{

	struct msm_vidc_inst *inst = file->private_data;

	struct msm_vidc_core *core = inst ? inst->core : NULL;

	int i, j;

	if (!inst) {

		dprintk(VIDC_ERR, "Invalid params, core: %p\n", inst);

	if (!inst || !core) {

		dprintk(VIDC_ERR, "Invalid params, core: %p inst %p\n",

				core, inst);

		return 0;

	}

	if (!get_inst(core, inst)) {

		dprintk(VIDC_ERR, "%s inactive session\n", __func__);

		return 0;

	}



	INIT_DBG_BUF(dbg_buf);

	write_str(&dbg_buf, "===============================\n");

	write_str(&dbg_buf, "INSTANCE: %p (%s)\n", inst,
@@ -327,7 +335,7 @@ static ssize_t inst_info_read(struct file *file, char __user *buf, 
	write_str(&dbg_buf, "FBD Count: %d\n", inst->count.fbd);



	publish_unreleased_reference(inst);



	put_inst(inst);

	return simple_read_from_buffer(buf, count, ppos,

		dbg_buf.ptr, dbg_buf.filled_size);

}