Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 01697ba5 authored by qctecmdr Service's avatar qctecmdr Service Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: npu: Prevent network from being used after free"

parents 0beb2dcd 08520107

drivers/media/platform/msm/npu/npu_dev.c

+5 −5
Original line number Diff line number Diff line
@@ -957,7 +957,7 @@ static int npu_load_network(struct npu_client *client, 


	ret = npu_host_load_network(client, &req);

	if (ret) {

		pr_err("network load failed: %d\n", ret);

		pr_err("npu_host_load_network failed %d\n", ret);

		return ret;

	}
@@ -1014,7 +1014,7 @@ static int npu_load_network_v2(struct npu_client *client, 


	kfree(patch_info);

	if (ret) {

		pr_err("network load failed: %d\n", ret);

		pr_err("npu_host_load_network_v2 failed %d\n", ret);

		return ret;

	}
@@ -1046,7 +1046,7 @@ static int npu_unload_network(struct npu_client *client, 
	ret = npu_host_unload_network(client, &req);



	if (ret) {

		pr_err("npu_host_unload_network failed\n");

		pr_err("npu_host_unload_network failed %d\n", ret);

		return ret;

	}
@@ -1084,7 +1084,7 @@ static int npu_exec_network(struct npu_client *client, 
	ret = npu_host_exec_network(client, &req);



	if (ret) {

		pr_err("npu_host_exec_network failed\n");

		pr_err("npu_host_exec_network failed %d\n", ret);

		return ret;

	}
@@ -1143,7 +1143,7 @@ static int npu_exec_network_v2(struct npu_client *client, 


	kfree(patch_buf_info);

	if (ret) {

		pr_err("npu_host_exec_network failed\n");

		pr_err("npu_host_exec_network_v2 failed %d\n", ret);

		return ret;

	}

drivers/media/platform/msm/npu/npu_mgr.c

+363 −104

File changed.

Preview size limit exceeded, changes collapsed.

drivers/media/platform/msm/npu/npu_mgr.h

+3 −0
Original line number Diff line number Diff line
@@ -54,7 +54,10 @@ struct npu_network { 
	void *stats_buf;

	void __user *stats_buf_u;

	uint32_t stats_buf_size;

	uint32_t trans_id;

	atomic_t ref_cnt;

	bool is_valid;

	bool is_active;

	bool fw_error;

	bool cmd_pending;

	bool cmd_async;