samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: smmu: Fix free sequence of buffer tracker

Browse Source 
Add a goto label to fine-grain situations where
buffer tracker list is to be freed, and when it
doesn't, where the submitted packet request id
is less than or equal to request that was last
flushed, as this call will cause null pointer
access.

CRs-Fixed: 3507867
Change-Id: I1b909473baf7a227bbd649e4c883daa485602cd9
Signed-off-by: Li Sha Lim <quic_lishlim@quicinc.com>
This commit is contained in:
Li Sha Lim
2023-05-23 11:16:10 -07:00
committed by Camera Software Integration
parent 1c59934ed7
commit 02b2cddbba
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/cam_isp/cam_isp_context.c
View File

@@ -6633,7 +6633,7 @@ static int __cam_isp_ctx_config_dev_in_top_state(
CAM_ERR(CAM_ISP, "Prepare config packet failed in HW layer, ctx: %u, link: 0x%x",
ctx->ctx_id, ctx->link_hdl);
rc = -EFAULT;
goto free_req;
goto free_req_and_buf_tracker_list;
}
req_isp->num_cfg = cfg.num_hw_update_entries;
@@ -6740,8 +6740,9 @@ put_ref:
CAM_ERR(CAM_CTXT, "Failed to put ref of fence %d, ctx_idx: %u, link: 0x%x",
req_isp->fence_map_out[i].sync_id, ctx->ctx_id, ctx->link_hdl);
}
free_req:
free_req_and_buf_tracker_list:
cam_smmu_buffer_tracker_putref(&req->buf_tracker);
free_req:
spin_lock_bh(&ctx->lock);
list_add_tail(&req->list, &ctx->free_req_list);
spin_unlock_bh(&ctx->lock);