Browse Source

video: driver: fix invalid ptr dereference issue with print_vidc_buffer

Release cmd + RO sent to firmware for entries present in
&inst->buffers.release.list. After issuing release cmd before
getting release done, driver removed excessive mapping entries
which holds mapping refcount as 1. So last refcount on underlying
dmabuf reaches zero.

RO & release list doesnot take dma ref_count using dma_buf_get().
Dmabuf ptr willbe obsolete when its last ref was last. So removed
print_vidc_buffer in msm_vdec_handle_release_buffer() to avoid
NULL ptr dereferrence inside print_vidc_buffer.

Change-Id: I0bdac5e2a398f67b4aac95fa78eaf6f2b816a315
Signed-off-by: Govindaraj Rajagopal <[email protected]>
Govindaraj Rajagopal 3 năm trước cách đây
mục cha
commit
dd9dfba57a
1 tập tin đã thay đổi với 13 bổ sung2 xóa
  1. 13 2
      driver/vidc/src/msm_vdec.c

+ 13 - 2
driver/vidc/src/msm_vdec.c

@@ -2082,8 +2082,19 @@ int msm_vdec_handle_release_buffer(struct msm_vidc_inst *inst,
 		d_vpr_e("%s: invalid params\n", __func__);
 		return -EINVAL;
 	}
-
-	print_vidc_buffer(VIDC_LOW, "low ", "release done", inst, buf);
+	/**
+	 * RO & release list doesnot take dma ref_count using dma_buf_get().
+	 * Dmabuf ptr willbe obsolete when its last ref was last.
+	 * Use direct api to print logs instead of calling print_vidc_buffer()
+	 * api, which will attempt to dereferrence dmabuf ptr.
+	 */
+	i_vpr_l(inst,
+		"release done: %s: idx %2d fd %3d off %d daddr %#llx size %8d filled %8d flags %#x ts %8lld attr %#x counts(etb ebd ftb fbd) %4llu %4llu %4llu %4llu\n",
+		buf_name(buf->type),
+		buf->index, buf->fd, buf->data_offset,
+		buf->device_addr, buf->buffer_size, buf->data_size,
+		buf->flags, buf->timestamp, buf->attr, inst->debug_count.etb,
+		inst->debug_count.ebd, inst->debug_count.ftb, inst->debug_count.fbd);
 	/* delete the buffer from release list */
 	list_del(&buf->list);
 	msm_memory_free(inst, buf);