samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
複製 0
程式碼 問題管理 合併請求 Actions Packages Projects 版本發佈 Wiki Activity

msm: camera: memmgr: Add missing calls of put buf to avoid leak

瀏覽代碼 
This change add missing calls to put cpu buf in few scenarios.

CRs-Fixed: 3578162
Change-Id: Iab6aa0324b5072390b38df296c7acee00f5102a1
Signed-off-by: Vikram Sharma <quic_vikramsa@quicinc.com>
This commit is contained in:
Vikram Sharma
2023-08-30 17:41:43 +05:30
父節點 8a04130f3b
當前提交 ec8012559c
共有 18 個文件被更改，包括 261 次插入 和 59 次删除
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c
查看文件

@@ -527,6 +527,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
cmd_buf = (uint32_t *)generic_ptr;
if (!cmd_buf) {
CAM_ERR(CAM_ACTUATOR, "invalid cmd buf");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
rc = -EINVAL;
goto end;
}
@@ -535,6 +536,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
sizeof(struct common_header)))) {
CAM_ERR(CAM_ACTUATOR,
"Invalid length for sensor cmd");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
rc = -EINVAL;
goto end;
}
@@ -551,6 +553,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
if (rc < 0) {
CAM_ERR(CAM_ACTUATOR,
"Failed to parse slave info: %d", rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
goto end;
}
break;
@@ -566,6 +569,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
CAM_ERR(CAM_ACTUATOR,
"Failed:parse power settings: %d",
rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
goto end;
}
break;
@@ -586,6 +590,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
CAM_ERR(CAM_ACTUATOR,
"Failed:parse init settings: %d",
rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
goto end;
}
break;

14
drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
查看文件

@@ -659,7 +659,6 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
uintptr_t generic_ptr;
uint32_t *cmd_buf = NULL;
size_t len;
rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
&generic_ptr, &len);
if (rc < 0) {
@@ -673,6 +672,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
index = cam_csiphy_get_instance_offset(csiphy_dev, dev_handle);
if (index < 0 || index >= csiphy_dev->session_max_device_support) {
CAM_ERR(CAM_CSIPHY, "index in invalid: %d", index);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return -EINVAL;
}
@@ -684,6 +684,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
CAM_ERR(CAM_CSIPHY,
"Not enough buffer provided for cam_csiphy_info");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return rc;
}
@@ -693,6 +694,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
if (rc) {
CAM_ERR(CAM_CSIPHY, "Wrong configuration lane_cnt: %u",
cam_cmd_csiphy_info_v2->lane_cnt);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return rc;
}
@@ -721,6 +723,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
CAM_ERR(CAM_CSIPHY,
"Not enough buffer provided for cam_csiphy_info");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return rc;
}
@@ -730,6 +733,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
if (rc) {
CAM_ERR(CAM_CSIPHY, "Wrong configuration lane_cnt: %u",
cam_cmd_csiphy_info->lane_cnt);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return rc;
}
@@ -763,6 +767,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
"Cannot support %s combo mode with differnt preamble settings",
(csiphy_dev->csiphy_info[index].csiphy_3phase ?
"CPHY" : "DPHY"));
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return -EINVAL;
}
@@ -955,6 +960,7 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
CAM_ERR(CAM_CSIPHY,
"Inval cam_packet strut size: %zu, len_of_buff: %zu",
sizeof(struct cam_packet), len);
cam_mem_put_cpu_buf(cfg_dev->packet_handle);
rc = -EINVAL;
return rc;
}
@@ -966,6 +972,7 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
if (cam_packet_util_validate_packet(csl_packet,
remain_len)) {
CAM_ERR(CAM_CSIPHY, "Invalid packet params");
cam_mem_put_cpu_buf(cfg_dev->packet_handle);
rc = -EINVAL;
return rc;
}
@@ -976,6 +983,7 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
csl_packet->cmd_buf_offset / 4);
else {
CAM_ERR(CAM_CSIPHY, "num_cmd_buffer = %d", csl_packet->num_cmd_buf);
cam_mem_put_cpu_buf(cfg_dev->packet_handle);
rc = -EINVAL;
return rc;
}
@@ -985,8 +993,10 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
for (i = 0; i < csl_packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
if (rc) {
cam_mem_put_cpu_buf(cfg_dev->packet_handle);
return rc;
}
cmd_buf_type = cmd_desc[i].meta_data;

11
drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
查看文件

@@ -1104,6 +1104,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
}
if (buf_size <= io_cfg->offsets[0]) {
CAM_ERR(CAM_EEPROM, "Not enough buffer");
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
rc = -EINVAL;
return rc;
}
@@ -1116,6 +1117,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
if (!read_buffer) {
CAM_ERR(CAM_EEPROM,
"invalid buffer to copy data");
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
rc = -EINVAL;
return rc;
}
@@ -1124,6 +1126,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
if (remain_len < e_ctrl->cal_data.num_data) {
CAM_ERR(CAM_EEPROM,
"failed to copy, Invalid size");
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
rc = -EINVAL;
return rc;
}
@@ -1239,6 +1242,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
"Inval cam_packet strut size: %zu, len_of_buff: %zu",
sizeof(struct cam_packet), pkt_len);
rc = -EINVAL;
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1249,6 +1253,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
if (cam_packet_util_validate_packet(csl_packet,
remain_len)) {
CAM_ERR(CAM_EEPROM, "Invalid packet params");
cam_mem_put_cpu_buf(dev_config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1260,6 +1265,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
e_ctrl->soc_info.dev->of_node, e_ctrl);
if (rc < 0) {
CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
rc = cam_eeprom_get_cal_data(e_ctrl, csl_packet);
@@ -1278,6 +1284,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
if (rc) {
CAM_ERR(CAM_EEPROM,
"Failed in parsing the pkt");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1339,6 +1346,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
csl_packet, e_ctrl);
if (rc < 0) {
CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1360,6 +1368,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
e_ctrl->eebin_info.size);
if (rc < 0) {
CAM_ERR(CAM_EEPROM, "Failed in erase : %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1369,6 +1378,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
rc = cam_eeprom_write(e_ctrl);
if (rc < 0) {
CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1393,6 +1403,7 @@ power_down:
memdata_free:
vfree(e_ctrl->cal_data.mapdata);
error:
cam_mem_put_cpu_buf(dev_config.packet_handle);
kfree(power_info->power_setting);
kfree(power_info->power_down_setting);
power_info->power_setting = NULL;

82
drivers/cam_sensor_module/cam_flash/cam_flash_core.c
查看文件

@@ -974,6 +974,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"Inval cam_packet strut size: %zu, len_of_buff: %zu",
sizeof(struct cam_packet), len_of_buffer);
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -984,6 +985,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (cam_packet_util_validate_packet(csl_packet,
remain_len)) {
CAM_ERR(CAM_FLASH, "Invalid packet params");
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -994,6 +996,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_DBG(CAM_FLASH,
"reject request %lld, last request to flush %lld",
csl_packet->header.request_id, fctrl->last_flush_req);
cam_mem_put_cpu_buf(config.packet_handle);
return -EBADR;
}
@@ -1015,12 +1018,15 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
&generic_ptr, &len_of_buffer);
if (rc < 0) {
cam_mem_put_cpu_buf(config.packet_handle);
CAM_ERR(CAM_FLASH, "Failed to get cpu buf");
return rc;
}
cmd_buf = (uint32_t *)generic_ptr;
if (!cmd_buf) {
CAM_ERR(CAM_FLASH, "invalid cmd buf");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -1028,6 +1034,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
(cmd_desc[i].offset >
(len_of_buffer -
sizeof(struct common_header)))) {
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
CAM_ERR(CAM_FLASH, "invalid cmd buf length");
return -EINVAL;
}
@@ -1044,6 +1052,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (len_of_buffer <
sizeof(struct cam_flash_init)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -1057,6 +1067,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"Failed parsing slave info: rc: %d",
rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
break;
@@ -1071,6 +1083,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Failed update power settings");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
break;
@@ -1089,6 +1103,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_FLASH,
"pkt parsing failed: %d", rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
break;
@@ -1098,6 +1114,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
power_info = &fctrl->power_info;
if (!power_info) {
CAM_ERR(CAM_FLASH, "Power_info is NULL");
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -1109,6 +1126,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"failed to fill vreg params for power up rc:%d",
rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1121,6 +1139,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"failed to fill vreg params power down rc:%d",
rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1128,12 +1147,14 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Enable Regulator Failed rc = %d", rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
rc = fctrl->func_tbl.apply_setting(fctrl, 0);
if (rc) {
CAM_ERR(CAM_FLASH, "cannot apply settings rc = %d", rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1163,6 +1184,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Failed in parsing i2c packets");
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
break;
@@ -1181,6 +1203,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Failed in Deleting the err: %d", rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
}
@@ -1194,12 +1217,14 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Failed in parsing i2c NRT packets");
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
rc = fctrl->func_tbl.apply_setting(fctrl, 0);
if (rc)
CAM_ERR(CAM_FLASH,
"Apply setting failed: %d", rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
case CAM_PKT_NOP_OPCODE: {
@@ -1211,6 +1236,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
MAX_PER_FRAME_ARRAY;
fctrl->i2c_data.per_frame[frm_offset].is_settings_valid
= false;
cam_mem_put_cpu_buf(config.packet_handle);
return 0;
}
@@ -1221,6 +1247,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
default:
CAM_ERR(CAM_FLASH, "Wrong Opcode : %d",
(csl_packet->header.op_code & 0xFFFFFF));
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
update_req_mgr:
@@ -1251,6 +1278,7 @@ update_req_mgr:
CAM_ERR(CAM_FLASH,
"Failed in adding request: %llu to request manager",
csl_packet->header.request_id);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
CAM_DBG(CAM_FLASH,
@@ -1258,7 +1286,6 @@ update_req_mgr:
add_req.req_id, add_req.trigger_eof);
}
}
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1318,6 +1345,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"Inval cam_packet strut size: %zu, len_of_buff: %zu",
sizeof(struct cam_packet), len_of_buffer);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1329,6 +1357,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (cam_packet_util_validate_packet(csl_packet,
remain_len)) {
CAM_ERR(CAM_FLASH, "Invalid packet params");
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1340,6 +1369,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_WARN(CAM_FLASH,
"reject request %lld, last request to flush %d",
csl_packet->header.request_id, fctrl->last_flush_req);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1356,12 +1386,15 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
&cmd_buf_ptr, &len_of_buffer);
if (rc) {
cam_mem_put_cpu_buf(config.packet_handle);
CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
return rc;
}
if ((len_of_buffer < sizeof(struct cam_flash_init)) ||
(cmd_desc->offset >
(len_of_buffer - sizeof(struct cam_flash_init)))) {
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
return rc;
@@ -1393,6 +1426,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (remain_len < sizeof(struct cam_flash_set_on_off)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1401,12 +1436,16 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (!flash_operation_info) {
CAM_ERR(CAM_FLASH,
"flash_operation_info Null");
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
if (flash_operation_info->count >
CAM_FLASH_MAX_LED_TRIGGERS) {
CAM_ERR(CAM_FLASH, "led count out of limit");
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1433,6 +1472,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d",
cam_flash_info->cmd_type);
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1461,6 +1502,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH, "Fail in get buffer: 0x%x",
cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1468,6 +1510,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
(cmd_desc->offset >
(len_of_buffer - sizeof(struct common_header)))) {
CAM_ERR(CAM_FLASH, "not enough buffer");
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1493,6 +1537,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (remain_len < sizeof(struct cam_flash_set_on_off)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1502,11 +1548,15 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"flash_operation_info Null");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
if (flash_operation_info->count >
CAM_FLASH_MAX_LED_TRIGGERS) {
CAM_ERR(CAM_FLASH, "led count out of limit");
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1541,6 +1591,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
default:
CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d",
cmn_hdr->cmd_type);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1556,6 +1608,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
&cmd_buf_ptr, &len_of_buffer);
if (rc) {
cam_mem_put_cpu_buf(config.packet_handle);
CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
return rc;
}
@@ -1565,6 +1618,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
(len_of_buffer - sizeof(struct common_header)))) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
remain_len = len_of_buffer - cmd_desc->offset;
@@ -1578,6 +1633,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (remain_len < sizeof(struct cam_flash_set_on_off)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
flash_operation_info =
@@ -1586,12 +1643,16 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"flash_operation_info Null");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
if (flash_operation_info->count >
CAM_FLASH_MAX_LED_TRIGGERS) {
CAM_ERR(CAM_FLASH, "led count out of limit");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1611,6 +1672,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc)
CAM_ERR(CAM_FLASH, "Apply setting failed: %d",
rc);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
case CAMERA_SENSOR_FLASH_CMD_TYPE_QUERYCURR: {
@@ -1619,6 +1682,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (remain_len < sizeof(struct cam_flash_query_curr)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
flash_query_info =
@@ -1638,6 +1703,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Query current failed with rc=%d", rc);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
flash_query_info->query_current_ma = query_curr_ma;
@@ -1647,6 +1714,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (remain_len < sizeof(struct cam_flash_set_rer)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
flash_rer_info = (struct cam_flash_set_rer *)cmd_buf;
@@ -1654,12 +1723,16 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"flash_rer_info Null");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
if (flash_rer_info->count >
CAM_FLASH_MAX_LED_TRIGGERS) {
CAM_ERR(CAM_FLASH, "led count out of limit");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1683,11 +1756,15 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc)
CAM_ERR(CAM_FLASH, "apply_setting failed: %d",
rc);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
default:
CAM_ERR(CAM_FLASH, "Wrong cmd_type : %d",
cmn_hdr->cmd_type);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1704,6 +1781,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
"Rxed NOP packets without linking");
fctrl->per_frame[frm_offset].cmn_attr.is_settings_valid
= false;
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -1718,6 +1796,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH, "Wrong Opcode : %d",
(csl_packet->header.op_code & 0xFFFFFF));
rc = -EINVAL;
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1754,6 +1833,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"Failed in adding request: %llu to request manager",
csl_packet->header.request_id);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
CAM_DBG(CAM_FLASH,

42
drivers/cam_sensor_module/cam_ois/cam_ois_core.c
查看文件

@@ -1080,6 +1080,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_ERR(CAM_OIS,
"Inval cam_packet strut size: %zu, len_of_buff: %zu",
sizeof(struct cam_packet), pkt_len);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return -EINVAL;
}
@@ -1090,6 +1091,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (cam_packet_util_validate_packet(csl_packet,
remain_len)) {
CAM_ERR(CAM_OIS, "Invalid packet params");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return -EINVAL;
}
@@ -1113,11 +1115,14 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS, "Failed to get cpu buf : 0x%x",
cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
cmd_buf = (uint32_t *)generic_ptr;
if (!cmd_buf) {
CAM_ERR(CAM_OIS, "invalid cmd buf");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return -EINVAL;
}
@@ -1126,6 +1131,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
sizeof(struct common_header)))) {
CAM_ERR(CAM_OIS,
"Invalid length for sensor cmd");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return -EINVAL;
}
remain_len = len_of_buff - cmd_desc[i].offset;
@@ -1141,6 +1148,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Failed in parsing slave info");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1155,6 +1164,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc) {
CAM_ERR(CAM_OIS,
"Failed: parse power settings");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1167,6 +1178,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc) {
CAM_ERR(CAM_OIS,
"Failed: parse fw info settings");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1185,6 +1198,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"init parsing failed: %d", rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
} else if ((o_ctrl->is_ois_calib != 0) &&
@@ -1202,6 +1217,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Calib parsing failed: %d", rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
} else if (o_ctrl->i2c_fwinit_data.is_settings_valid == 0) {
@@ -1228,6 +1245,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
rc = cam_ois_power_up(o_ctrl);
if (rc) {
CAM_ERR(CAM_OIS, " OIS Power up failed");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
}
@@ -1358,6 +1376,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_WARN(CAM_OIS,
"Not in right state to control OIS: %d",
o_ctrl->cam_ois_state);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
offset = (uint32_t *)&csl_packet->payload;
@@ -1371,12 +1390,14 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
cmd_desc, 1, NULL);
if (rc < 0) {
CAM_ERR(CAM_OIS, "OIS pkt parsing failed: %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
rc = cam_ois_apply_settings(o_ctrl, i2c_reg_settings);
if (rc < 0) {
CAM_ERR(CAM_OIS, "Cannot apply mode settings");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1384,6 +1405,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Fail deleting Mode data: rc: %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1399,6 +1421,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_WARN(CAM_OIS,
"Not in right state to read OIS: %d",
o_ctrl->cam_ois_state);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
CAM_DBG(CAM_OIS, "number of I/O configs: %d:",
@@ -1406,6 +1429,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (csl_packet->num_io_configs == 0) {
CAM_ERR(CAM_OIS, "No I/O configs to process");
rc = -EINVAL;
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1419,6 +1443,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (io_cfg == NULL) {
CAM_ERR(CAM_OIS, "I/O config is invalid(NULL)");
rc = -EINVAL;
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1432,12 +1457,14 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
cmd_desc, 1, &io_cfg[0]);
if (rc < 0) {
CAM_ERR(CAM_OIS, "OIS read pkt parsing failed: %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
rc = cam_sensor_util_get_current_qtimer_ns(&qtime_ns);
if (rc < 0) {
CAM_ERR(CAM_OIS, "failed to get qtimer rc:%d");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1447,6 +1474,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS, "cannot read data rc: %d", rc);
delete_request(&i2c_read_settings);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1457,6 +1485,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_ERR(CAM_OIS,
"write qtimer failed rc: %d", rc);
delete_request(&i2c_read_settings);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
}
@@ -1465,6 +1494,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Failed in deleting the read settings");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1477,6 +1507,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_ERR(CAM_OIS,
"Not in right state to write time to OIS: %d",
o_ctrl->cam_ois_state);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
offset = (uint32_t *)&csl_packet->payload;
@@ -1490,6 +1521,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
cmd_desc, 1, NULL);
if (rc < 0) {
CAM_ERR(CAM_OIS, "OIS pkt parsing failed: %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1501,12 +1533,14 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
rc = cam_ois_update_time(i2c_reg_settings, CAM_ENDIANNESS_LITTLE);
if (rc < 0) {
CAM_ERR(CAM_OIS, "Cannot update time");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
rc = cam_ois_apply_settings(o_ctrl, i2c_reg_settings);
if (rc < 0) {
CAM_ERR(CAM_OIS, "Cannot apply mode settings");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1514,6 +1548,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Fail deleting Mode data: rc: %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1521,13 +1556,16 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
default:
CAM_ERR(CAM_OIS, "Invalid Opcode: %d",
(csl_packet->header.op_code & 0xFFFFFF));
cam_mem_put_cpu_buf(dev_config.packet_handle);
return -EINVAL;
}
cam_mem_put_cpu_buf(dev_config.packet_handle);
if (!rc)
if (!rc) {
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
pwr_dwn:
cam_mem_put_cpu_buf(dev_config.packet_handle);
cam_ois_power_down(o_ctrl);
return rc;
}

3
drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c
查看文件

@@ -866,6 +866,7 @@ int32_t cam_handle_mem_ptr(uint64_t handle, uint32_t cmd,
if (cmd_desc[i].offset >= len) {
CAM_ERR(CAM_SENSOR,
"offset past length of buffer");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
rc = -EINVAL;
goto end;
}
@@ -873,6 +874,7 @@ int32_t cam_handle_mem_ptr(uint64_t handle, uint32_t cmd,
if (cmd_desc[i].length > remain_len) {
CAM_ERR(CAM_SENSOR,
"Not enough buffer provided for cmd");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
rc = -EINVAL;
goto end;
}
@@ -886,6 +888,7 @@ int32_t cam_handle_mem_ptr(uint64_t handle, uint32_t cmd,
if (rc < 0) {
CAM_ERR(CAM_SENSOR,
"Failed to parse the command Buffer Header");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
goto end;
}
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);

8
drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
查看文件

@@ -391,6 +391,7 @@ static int32_t cam_sensor_get_io_buffer(
CAM_ERR(CAM_SENSOR_UTIL,
"invalid size:io_cfg->offsets[0]: %d, buf_size: %d",
io_cfg->offsets[0], buf_size);
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
return -EINVAL;
}
i2c_settings->read_buff =
@@ -402,7 +403,6 @@ static int32_t cam_sensor_get_io_buffer(
io_cfg->direction);
rc = -EINVAL;
}
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
return rc;
}
@@ -436,6 +436,7 @@ int32_t cam_sensor_util_write_qtimer_to_io_buffer(
CAM_ERR(CAM_SENSOR_UTIL,
"invalid size:io_cfg->offsets[0]: %d, buf_size: %d",
io_cfg->offsets[0], buf_size);
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
return -EINVAL;
}
@@ -446,17 +447,18 @@ int32_t cam_sensor_util_write_qtimer_to_io_buffer(
CAM_ERR(CAM_SENSOR_UTIL,
"not enough size for qtimer, target_size:%d",
target_size);
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
return -EINVAL;
}
memcpy((void *)target_buf, &qtime_ns, sizeof(uint64_t));
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
} else {
CAM_ERR(CAM_SENSOR_UTIL, "Invalid direction: %d",
io_cfg->direction);
rc = -EINVAL;
}
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
return rc;
}
@@ -645,6 +647,7 @@ int cam_sensor_i2c_command_parser(
(cmd_desc[i].offset >
(len_of_buff - sizeof(struct common_header)))) {
CAM_ERR(CAM_SENSOR_UTIL, "buffer provided too small");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
return -EINVAL;
}
cmd_buf = (uint32_t *)generic_ptr;
@@ -653,6 +656,7 @@ int cam_sensor_i2c_command_parser(
remain_len -= cmd_desc[i].offset;
if (remain_len < cmd_desc[i].length) {
CAM_ERR(CAM_SENSOR_UTIL, "buffer provided too small");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
return -EINVAL;
}

2
drivers/cam_sensor_module/cam_tpg/cam_tpg_core.c
查看文件

@@ -480,6 +480,7 @@ static int cam_tpg_validate_cmd_descriptor(
*cmd_addr = (uintptr_t)cmd_header;
end:
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return rc;
}
@@ -678,6 +679,7 @@ static int cam_tpg_packet_parse(
break;
}
end:
cam_mem_put_cpu_buf(config->packet_handle);
return rc;
}