msm: camera: smmu: Fix free sequence of buffer tracker

Add a goto label to fine-grain situations where
buffer tracker list is to be freed, and when it
doesn't, where the submitted packet request id
is less than or equal to request that was last
flushed, as this call will cause null pointer
access.

CRs-Fixed: 3507867
Change-Id: I1b909473baf7a227bbd649e4c883daa485602cd9
Signed-off-by: Li Sha Lim <[email protected]>

drivers/cam_core/cam_context_utils.c

@@ -529,6 +529,7 @@ int32_t cam_context_prepare_dev_to_hw(struct cam_context *ctx,
 		return -ENOMEM;
 	}
 
+	INIT_LIST_HEAD(&req->buf_tracker);
 	INIT_LIST_HEAD(&req->list);
 	req->ctx = ctx;
 	req->num_hw_update_entries  = 0;
@@ -574,8 +575,6 @@ int32_t cam_context_prepare_dev_to_hw(struct cam_context *ctx,
 	memset(req->out_map_entries, 0, sizeof(struct cam_hw_fence_map_entry)
 		* ctx->max_out_map_entries);
 
-	INIT_LIST_HEAD(cfg.buf_tracker);
-
 	rc = ctx->hw_mgr_intf->hw_prepare_update(
 		ctx->hw_mgr_intf->hw_mgr_priv, &cfg);
 	if (rc != 0) {

drivers/cam_isp/cam_isp_context.c

@@ -6633,7 +6633,7 @@ static int __cam_isp_ctx_config_dev_in_top_state(
 		CAM_ERR(CAM_ISP, "Prepare config packet failed in HW layer, ctx: %u, link: 0x%x",
 			ctx->ctx_id, ctx->link_hdl);
 		rc = -EFAULT;
-		goto free_req;
+		goto free_req_and_buf_tracker_list;
 	}
 
 	req_isp->num_cfg = cfg.num_hw_update_entries;
@@ -6740,8 +6740,9 @@ put_ref:
 			CAM_ERR(CAM_CTXT, "Failed to put ref of fence %d, ctx_idx: %u, link: 0x%x",
 				req_isp->fence_map_out[i].sync_id, ctx->ctx_id, ctx->link_hdl);
 	}
-free_req:
+free_req_and_buf_tracker_list:
 	cam_smmu_buffer_tracker_putref(&req->buf_tracker);
+free_req:
 	spin_lock_bh(&ctx->lock);
 	list_add_tail(&req->list, &ctx->free_req_list);
 	spin_unlock_bh(&ctx->lock);