msm: camera: ope: Avoid submitting NULL request to CDM

In corner case, there is a chance that userspace can submit
request while flush is ongoing. In some cases submitted request
can get flushed and corresponding data structures  memory gets
freed.

Add a logic to check for pending request before submitting request
to cdm hw.

CRs-Fixed: 2815901
Change-Id: I74096201e204f204c4f15d14698b4e9af6435f55
Signed-off-by: Alok Chauhan <[email protected]>

drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c

@@ -81,6 +81,11 @@ end:
 	return rsc_idx;
 }
 
+static bool cam_ope_is_pending_request(struct cam_ope_ctx *ctx_data)
+{
+	return !bitmap_empty(ctx_data->bitmap, CAM_CTX_REQ_MAX);
+}
+
 static int cam_ope_mgr_process_cmd(void *priv, void *data)
 {
 	int rc;
@@ -96,14 +101,16 @@ static int cam_ope_mgr_process_cmd(void *priv, void *data)
 
 	ctx_data = priv;
 	task_data = (struct ope_cmd_work_data *)data;
+
+	mutex_lock(&hw_mgr->hw_mgr_mutex);
 	cdm_cmd = task_data->data;
 
 	if (!cdm_cmd) {
 		CAM_ERR(CAM_OPE, "Invalid params%pK", cdm_cmd);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
 		return -EINVAL;
 	}
 
-	mutex_lock(&hw_mgr->hw_mgr_mutex);
 	if (ctx_data->ctx_state != OPE_CTX_STATE_ACQUIRED) {
 		mutex_unlock(&hw_mgr->hw_mgr_mutex);
 		CAM_ERR(CAM_OPE, "ctx id :%u is not in use",
@@ -119,6 +126,13 @@ static int cam_ope_mgr_process_cmd(void *priv, void *data)
 		return -EINVAL;
 	}
 
+	if (!cam_ope_is_pending_request(ctx_data)) {
+		CAM_WARN(CAM_OPE, "no pending req, req %lld last flush %lld",
+			task_data->req_id, ctx_data->last_flush_req);
+		mutex_unlock(&hw_mgr->hw_mgr_mutex);
+		return -EINVAL;
+	}
+
 	CAM_DBG(CAM_OPE,
 		"cam_cdm_submit_bls: handle 0x%x, ctx_id %d req %d cookie %d",
 		ctx_data->ope_cdm.cdm_handle, ctx_data->ctx_id,
@@ -256,11 +270,6 @@ static int cam_ope_mgr_reapply_config(struct cam_ope_hw_mgr *hw_mgr,
 	return rc;
 }
 
-static bool cam_ope_is_pending_request(struct cam_ope_ctx *ctx_data)
-{
-	return !bitmap_empty(ctx_data->bitmap, CAM_CTX_REQ_MAX);
-}
-
 static int cam_get_valid_ctx_id(void)
 {
 	struct cam_ope_hw_mgr *hw_mgr = ope_hw_mgr;