Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae793b17 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: npu: Fix use after free issue"

parents b1a5020b 0579a241

drivers/media/platform/msm/npu_v2/npu_mgr.c

+14 −0
Original line number Diff line number Diff line
@@ -2556,6 +2556,13 @@ int32_t npu_host_unload_network(struct npu_client *client, 
		return -EINVAL;

	}



	if (network->is_unloading) {

		NPU_ERR("network is unloading\n");

		network_put(network);

		mutex_unlock(&host_ctx->lock);

		return -EINVAL;

	}



	if (!network->is_active) {

		NPU_ERR("network is not active\n");

		network_put(network);
@@ -2573,6 +2580,8 @@ int32_t npu_host_unload_network(struct npu_client *client, 
		goto free_network;

	}



	network->is_unloading = true;



	NPU_DBG("Unload network %lld\n", network->id);

	/* prepare IPC packet for UNLOAD */

	unload_packet.header.cmd_type = NPU_IPC_CMD_UNLOAD;
@@ -2703,6 +2712,11 @@ int32_t npu_host_exec_network_v2(struct npu_client *client, 
		return -EINVAL;

	}



	if (network->is_unloading) {

		NPU_ERR("network is unloading\n");

		ret = -EINVAL;

		goto exec_v2_done;

	}

	if (!network->is_active) {

		NPU_ERR("network is not active\n");

		ret = -EINVAL;

drivers/media/platform/msm/npu_v2/npu_mgr.h

+1 −0
Original line number Diff line number Diff line
@@ -91,6 +91,7 @@ struct npu_network { 
	atomic_t ref_cnt;

	bool is_valid;

	bool is_active;

	bool is_unloading;

	bool fw_error;

	struct npu_client *client;

	struct list_head cmd_list;