samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: memmgr: Add missing calls of put buf to avoid leak

Browse Source 
This change add missing calls to put cpu buf in few scenarios.

CRs-Fixed: 3578162
Change-Id: Iab6aa0324b5072390b38df296c7acee00f5102a1
Signed-off-by: Vikram Sharma <quic_vikramsa@quicinc.com>
This commit is contained in:
Vikram Sharma
2023-08-30 17:41:43 +05:30
parent 8a04130f3b
commit ec8012559c
18 changed files with 261 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/cam_core/cam_context_utils.c
View File

@@ -253,6 +253,7 @@ int cam_context_buf_done_from_hw(struct cam_context *ctx,
ctx->img_iommu_hdl, req->out_map_entries[j].resource_handle);
if (rc) {
CAM_ERR(CAM_CTXT, "Failed to retrieve image buffers rc:%d", rc);
cam_packet_util_put_packet_addr(req->pf_data.packet_handle);
return rc;
}
}
@@ -1855,7 +1856,7 @@ static void __cam_context_req_mini_dump(struct cam_ctx_request *req,
if (packet && packet->num_io_configs) {
bytes_required = packet->num_io_configs * sizeof(struct cam_buf_io_cfg);
if (start_addr + bytes_written + bytes_required > end_addr)
goto end;
goto exit;
io_cfg = (struct cam_buf_io_cfg *)((uint32_t *)&packet->payload +
packet->io_configs_offset / 4);
@@ -1864,7 +1865,7 @@ static void __cam_context_req_mini_dump(struct cam_ctx_request *req,
bytes_written += bytes_required;
req_md->num_io_cfg = packet->num_io_configs;
}
exit:
cam_packet_util_put_packet_addr(req->pf_data.packet_handle);
end:
*bytes_updated = bytes_written;

4
drivers/cam_cpas/cam_cpas_hw.c
View File

@@ -3560,6 +3560,7 @@ static int cam_cpas_dump_state_monitor_array_info(
if (buf_len <= dump_info->offset) {
CAM_WARN(CAM_CPAS, "Dump buffer overshoot len %zu offset %zu",
buf_len, dump_info->offset);
cam_mem_put_cpu_buf(dump_info->buf_handle);
return -ENOSPC;
}
@@ -3598,6 +3599,7 @@ static int cam_cpas_dump_state_monitor_array_info(
if (remain_len < min_len) {
CAM_WARN(CAM_CPAS, "Dump buffer exhaust remain %zu min %u",
remain_len, min_len);
cam_mem_put_cpu_buf(dump_info->buf_handle);
return -ENOSPC;
}
@@ -3614,6 +3616,7 @@ static int cam_cpas_dump_state_monitor_array_info(
&cpas_core->monitor_entries[index].identifier_string);
if (rc) {
CAM_ERR(CAM_CPAS, "Dump state info failed, rc: %d", rc);
cam_mem_put_cpu_buf(dump_info->buf_handle);
return rc;
}
@@ -3621,6 +3624,7 @@ static int cam_cpas_dump_state_monitor_array_info(
}
dump_info->offset = dump_args.offset;
cam_mem_put_cpu_buf(dump_info->buf_handle);
return rc;
}

2
drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
View File

@@ -667,7 +667,7 @@ static int cam_fd_mgr_util_prepare_io_buf_info(int32_t iommu_hdl,
"Invalid cpu buf %d %d %d",
io_cfg[i].direction,
io_cfg[i].resource_type, plane);
cam_mem_put_cpu_buf(io_cfg[i].mem_handle[plane];
cam_mem_put_cpu_buf(io_cfg[i].mem_handle[plane]);
rc = -EINVAL;
return rc;
}

9
drivers/cam_isp/cam_isp_context.c
View File

@@ -989,6 +989,7 @@ static int cam_isp_ctx_dump_req(
if (dump_to_buff) {
if (!cpu_addr || !offset || !buf_len) {
CAM_ERR(CAM_ISP, "Invalid args");
cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
break;
}
dump_info.src_start = buf_start;
@@ -999,8 +1000,10 @@ static int cam_isp_ctx_dump_req(
rc = cam_cdm_util_dump_cmd_bufs_v2(
&dump_info);
*offset = dump_info.dst_offset;
if (rc)
if (rc) {
cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
return rc;
}
} else
cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
cam_mem_put_cpu_buf(req_isp->cfg[i].handle);
@@ -1751,7 +1754,6 @@ static int __cam_isp_ctx_handle_buf_done_for_req_list(
req_isp->fence_map_out[i].sync_id,
CAM_SYNC_STATE_SIGNALED_ERROR,
CAM_SYNC_ISP_EVENT_BUBBLE);
list_add_tail(&req->list, &ctx->free_req_list);
CAM_DBG(CAM_REQ,
"Move active request %lld to free list(cnt = %d) [flushed], ctx %u, link: 0x%x",
@@ -5412,7 +5414,8 @@ hw_dump:
if (rc) {
CAM_ERR(CAM_ISP, "Invalid handle %u rc %d, ctx_idx: %u, link: 0x%x",
dump_info->buf_handle, rc, ctx->ctx_id, ctx->link_hdl);
goto end;
spin_unlock_bh(&ctx->lock);
return rc;
}
if (buf_len <= dump_info->offset) {
spin_unlock_bh(&ctx->lock);

9
drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.c
View File

@@ -4896,7 +4896,8 @@ static void cam_tfe_mgr_dump_pf_data(
pf_cmd_args = hw_cmd_args->u.pf_cmd_args;
rc = cam_packet_util_get_packet_addr(&packet,
pf_cmd_args->pf_req_info->packet_handle, pf_cmd_args->pf_req_info->packet_offset);
pf_cmd_args->pf_req_info->packet_handle,
pf_cmd_args->pf_req_info->packet_offset);
if (rc)
return;
ctx_found = &pf_cmd_args->pf_args->pf_context_info.ctx_found;
@@ -4925,6 +4926,7 @@ static void cam_tfe_mgr_dump_pf_data(
CAM_INFO(CAM_ISP,
"PID:%d is not matching with any TFE HW PIDs ctx id:%d",
pf_cmd_args->pf_args->pf_smmu_info->pid, ctx->ctx_index);
cam_packet_util_put_packet_addr(pf_cmd_args->pf_req_info->packet_handle);
return;
}
@@ -4939,6 +4941,7 @@ static void cam_tfe_mgr_dump_pf_data(
CAM_INFO(CAM_ISP,
"This context does not cause pf:pid:%d hw id:%d ctx_id:%d",
pf_cmd_args->pf_args->pf_smmu_info->pid, hw_id, ctx->ctx_index);
cam_packet_util_put_packet_addr(pf_cmd_args->pf_req_info->packet_handle);
return;
}
@@ -4946,7 +4949,6 @@ static void cam_tfe_mgr_dump_pf_data(
hw_mgr_res = &ctx->res_list_tfe_out[i];
if (!hw_mgr_res->hw_res[0])
continue;
break;
}
@@ -4954,6 +4956,7 @@ static void cam_tfe_mgr_dump_pf_data(
CAM_ERR(CAM_ISP,
"NO valid outport resources ctx id:%d req id:%lld",
ctx->ctx_index, packet->header.request_id);
cam_packet_util_put_packet_addr(pf_cmd_args->pf_req_info->packet_handle);
return;
}
@@ -4967,11 +4970,11 @@ static void cam_tfe_mgr_dump_pf_data(
hw_mgr_res->hw_res[0]->hw_intf->hw_priv,
cmd_update.cmd_type, &cmd_update,
sizeof(struct cam_isp_hw_get_cmd_update));
if (rc) {
CAM_ERR(CAM_ISP,
"getting mid port resource id failed ctx id:%d req id:%lld",
ctx->ctx_index, packet->header.request_id);
cam_packet_util_put_packet_addr(pf_cmd_args->pf_req_info->packet_handle);
return;
}
CAM_ERR(CAM_ISP,

2
drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
View File

@@ -1990,11 +1990,13 @@ static void cam_jpeg_mgr_dump_pf_data(
&jpeg_pid_mid_args, sizeof(jpeg_pid_mid_args));
if (rc) {
CAM_ERR(CAM_JPEG, "CAM_JPEG_CMD_MATCH_PID_MID failed %d", rc);
cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
return;
}
if (!jpeg_pid_mid_args.pid_match_found) {
CAM_INFO(CAM_JPEG, "This context data is not matched with pf pid and mid");
cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
return;
}
pf_args->pf_context_info.resource_type = jpeg_pid_mid_args.match_res;

10
drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c
View File

@@ -2229,8 +2229,6 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr,
ope_request->ope_kmd_buf.cpu_addr,
ope_request->ope_kmd_buf.iova_addr,
ope_request->ope_kmd_buf.iova_cdm_addr);
cam_mem_put_cpu_buf(cmd_buf->mem_handle);
break;
} else if (cmd_buf->cmd_buf_usage ==
OPE_CMD_BUF_DEBUG) {
ope_request->ope_debug_buf.cpu_addr =
@@ -2245,8 +2243,6 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr,
cmd_buf->offset;
CAM_DBG(CAM_OPE, "dbg buf = %x",
ope_request->ope_debug_buf.cpu_addr);
cam_mem_put_cpu_buf(cmd_buf->mem_handle);
break;
}
cam_mem_put_cpu_buf(cmd_buf->mem_handle);
break;
@@ -2310,8 +2306,8 @@ static int cam_ope_mgr_process_cmd_desc(struct cam_ope_hw_mgr *hw_mgr,
if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC ||
cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB)
continue;
rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle, &cpu_addr, &len);
rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
&cpu_addr, &len);
if (rc || !cpu_addr) {
CAM_ERR(CAM_OPE, "get cmd buf failed %x",
hw_mgr->iommu_hdl);
@@ -4212,6 +4208,7 @@ static void cam_ope_mgr_dump_pf_data(
CAM_INFO(CAM_OPE,
"PID:%d is not matching with any OPE HW PIDs ctx id:%d",
pf_args->pf_smmu_info->pid, ctx_data->ctx_id);
cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
return;
}
@@ -4224,6 +4221,7 @@ static void cam_ope_mgr_dump_pf_data(
if (rc) {
CAM_ERR(CAM_OPE,
"CAM_OPE_CMD_MATCH_PID_MID failed %d", rc);
cam_packet_util_put_packet_addr(pf_req_info->packet_handle);
return;
}

59
drivers/cam_req_mgr/cam_mem_mgr.c
View File

@@ -95,17 +95,15 @@ static void cam_mem_mgr_print_tbl(void)
CAM_GET_TIMESTAMP(current_ts);
CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
CAM_INFO(CAM_MEM, "***%llu:%llu:%llu:%llu Mem mgr table dump***",
hrs, min, sec, ms);
for (i = 1; i < CAM_MEM_BUFQ_MAX; i++) {
if (tbl.bufq[i].active) {
CAM_CONVERT_TIMESTAMP_FORMAT((tbl.bufq[i].timestamp), hrs, min, sec, ms);
CAM_INFO(CAM_MEM,
"%llu:%llu:%llu:%llu idx %d fd %d i_ino %lu size %llu",
"%llu:%llu:%llu:%llu idx %d fd %d i_ino %lu size %llu active %d buf_handle %d refCount %d buf_name %s",
hrs, min, sec, ms, i, tbl.bufq[i].fd, tbl.bufq[i].i_ino,
tbl.bufq[i].len);
}
tbl.bufq[i].len, tbl.bufq[i].active, tbl.bufq[i].buf_handle,
kref_read(&tbl.bufq[i].krefcount), tbl.bufq[i].buf_name);
}
}
@@ -338,6 +336,7 @@ static int32_t cam_mem_get_slot(void)
set_bit(idx, tbl.bitmap);
tbl.bufq[idx].active = true;
tbl.bufq[idx].release_deferred = false;
CAM_GET_TIMESTAMP((tbl.bufq[idx].timestamp));
mutex_init(&tbl.bufq[idx].q_lock);
mutex_unlock(&tbl.m_lock);
@@ -350,6 +349,7 @@ static void cam_mem_put_slot(int32_t idx)
mutex_lock(&tbl.m_lock);
mutex_lock(&tbl.bufq[idx].q_lock);
tbl.bufq[idx].active = false;
tbl.bufq[idx].release_deferred = false;
tbl.bufq[idx].is_internal = false;
memset(&tbl.bufq[idx].timestamp, 0, sizeof(struct timespec64));
mutex_unlock(&tbl.bufq[idx].q_lock);
@@ -1341,6 +1341,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd_v2 *cmd)
if (idx < 0) {
CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d", idx);
rc = -ENOMEM;
cam_mem_mgr_print_tbl();
goto slot_fail;
}
@@ -1417,6 +1418,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd_v2 *cmd)
tbl.bufq[idx].is_imported = false;
kref_init(&tbl.bufq[idx].krefcount);
tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_USER;
strscpy(tbl.bufq[idx].buf_name, cmd->buf_name, sizeof(tbl.bufq[idx].buf_name));
mutex_unlock(&tbl.bufq[idx].q_lock);
cmd->out.buf_handle = tbl.bufq[idx].buf_handle;
@@ -1502,6 +1504,7 @@ int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd_v2 *cmd)
CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d, fd=%d",
idx, cmd->fd);
rc = -ENOMEM;
cam_mem_mgr_print_tbl();
goto slot_fail;
}
@@ -1550,6 +1553,7 @@ int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd_v2 *cmd)
tbl.bufq[idx].is_internal = is_internal;
kref_init(&tbl.bufq[idx].krefcount);
tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_USER;
strscpy(tbl.bufq[idx].buf_name, cmd->buf_name, sizeof(tbl.bufq[idx].buf_name));
mutex_unlock(&tbl.bufq[idx].q_lock);
cmd->out.buf_handle = tbl.bufq[idx].buf_handle;
@@ -1688,6 +1692,7 @@ static int cam_mem_mgr_cleanup_table(void)
tbl.bufq[i].num_hdls = 0;
tbl.bufq[i].dma_buf = NULL;
tbl.bufq[i].active = false;
tbl.bufq[i].release_deferred = false;
tbl.bufq[i].is_internal = false;
memset(tbl.bufq[i].hdls_info, 0x0, tbl.max_hdls_info_size);
cam_mem_mgr_reset_presil_params(i);
@@ -1758,6 +1763,7 @@ static void cam_mem_util_unmap(struct kref *kref)
/* Deactivate the buffer queue to prevent multiple unmap */
mutex_lock(&tbl.bufq[idx].q_lock);
tbl.bufq[idx].active = false;
tbl.bufq[idx].release_deferred = false;
mutex_unlock(&tbl.bufq[idx].q_lock);
mutex_unlock(&tbl.m_lock);
@@ -1823,6 +1829,8 @@ static void cam_mem_util_unmap(struct kref *kref)
void cam_mem_put_cpu_buf(int32_t buf_handle)
{
int idx;
uint64_t ms, hrs, min, sec;
struct timespec64 current_ts;
if (!buf_handle) {
CAM_ERR(CAM_MEM, "Invalid buf_handle");
@@ -1846,11 +1854,25 @@ void cam_mem_put_cpu_buf(int32_t buf_handle)
return;
}
if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap))
if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap)) {
CAM_GET_TIMESTAMP(current_ts);
CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
CAM_DBG(CAM_MEM,
"Called unmap from here, buf_handle: %u, idx: %d",
buf_handle, idx);
"%llu:%llu:%llu:%llu Called unmap from here, buf_handle: %u, idx: %d",
hrs, min, sec, ms, buf_handle, idx);
} else if (tbl.bufq[idx].release_deferred) {
CAM_CONVERT_TIMESTAMP_FORMAT((tbl.bufq[idx].timestamp), hrs, min, sec, ms);
CAM_ERR(CAM_MEM,
"%llu:%llu:%llu:%llu idx %d fd %d i_ino %lu size %llu active %d buf_handle %d refCount %d buf_name %s",
hrs, min, sec, ms, idx, tbl.bufq[idx].fd, tbl.bufq[idx].i_ino,
tbl.bufq[idx].len, tbl.bufq[idx].active, tbl.bufq[idx].buf_handle,
kref_read(&tbl.bufq[idx].krefcount), tbl.bufq[idx].buf_name);
CAM_GET_TIMESTAMP(current_ts);
CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
CAM_ERR(CAM_MEM,
"%llu:%llu:%llu:%llu Not unmapping even after defer, buf_handle: %u, idx: %d",
hrs, min, sec, ms, buf_handle, idx);
}
}
EXPORT_SYMBOL(cam_mem_put_cpu_buf);
@@ -1859,6 +1881,8 @@ int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd)
{
int idx;
int rc = 0;
uint64_t ms, hrs, min, sec;
struct timespec64 current_ts;
if (!atomic_read(&cam_mem_mgr_state)) {
CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
@@ -1890,17 +1914,21 @@ int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd)
}
CAM_DBG(CAM_MEM, "Releasing hdl = %x, idx = %d", cmd->buf_handle, idx);
if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap)) {
CAM_DBG(CAM_MEM,
"Called unmap from here, buf_handle: %u, idx: %d",
cmd->buf_handle, idx);
} else {
rc = -EINVAL;
CAM_GET_TIMESTAMP(current_ts);
CAM_CONVERT_TIMESTAMP_FORMAT(current_ts, hrs, min, sec, ms);
CAM_CONVERT_TIMESTAMP_FORMAT((tbl.bufq[idx].timestamp), hrs, min, sec, ms);
CAM_ERR(CAM_MEM,
"Unbalanced release Called buf_handle: %u, idx: %d",
cmd->buf_handle, idx);
"%llu:%llu:%llu:%llu idx %d fd %d i_ino %lu size %llu active %d buf_handle %d refCount %d buf_name %s",
hrs, min, sec, ms, idx, tbl.bufq[idx].fd, tbl.bufq[idx].i_ino,
tbl.bufq[idx].len, tbl.bufq[idx].active, tbl.bufq[idx].buf_handle,
kref_read(&tbl.bufq[idx].krefcount), tbl.bufq[idx].buf_name);
tbl.bufq[idx].release_deferred = true;
}
return rc;
}
@@ -1992,6 +2020,7 @@ int cam_mem_mgr_request_mem(struct cam_mem_mgr_request_desc *inp,
if (idx < 0) {
CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d", idx);
rc = -ENOMEM;
cam_mem_mgr_print_tbl();
goto slot_fail;
}
@@ -2154,6 +2183,7 @@ int cam_mem_mgr_reserve_memory_region(struct cam_mem_mgr_request_desc *inp,
if (idx < 0) {
CAM_ERR(CAM_MEM, "Failed in getting mem slot, idx=%d", idx);
rc = -ENOMEM;
cam_mem_mgr_print_tbl();
goto slot_fail;
}
@@ -2251,6 +2281,7 @@ int cam_mem_mgr_dump_user(struct cam_dump_req_cmd *dump_req)
if (buf_len <= dump_req->offset) {
CAM_WARN(CAM_MEM, "Dump buffer overshoot len %zu offset %zu",
buf_len, dump_req->offset);
cam_mem_put_cpu_buf(dump_req->buf_handle);
return -ENOSPC;
}
@@ -2263,6 +2294,7 @@ int cam_mem_mgr_dump_user(struct cam_dump_req_cmd *dump_req)
if (remain_len < min_len) {
CAM_WARN(CAM_MEM, "Dump buffer exhaust remain %zu min %u",
remain_len, min_len);
cam_mem_put_cpu_buf(dump_req->buf_handle);
return -ENOSPC;
}
@@ -2292,6 +2324,7 @@ int cam_mem_mgr_dump_user(struct cam_dump_req_cmd *dump_req)
mutex_unlock(&tbl.m_lock);
dump_req->offset = dump_args.offset;
cam_mem_put_cpu_buf(dump_req->buf_handle);
return rc;
}

4
drivers/cam_req_mgr/cam_mem_mgr.h
View File

@@ -77,12 +77,14 @@ struct cam_mem_buf_hw_hdl_info {
* using the same indexing as SMMU
* @kmdvaddr: Kernel virtual address
* @active: state of the buffer
* @release_deferred: Buffer is deferred for release.
* @is_imported: Flag indicating if buffer is imported from an FD in user space
* @is_internal: Flag indicating kernel allocated buffer
* @timestamp: Timestamp at which this entry in tbl was made
* @krefcount: Reference counter to track whether the buffer is
* mapped and in use
* @smmu_mapping_client: Client buffer (User or kernel)
* @buf_name: Name associated with buffer.
* @presil_params: Parameters specific to presil environment
*/
struct cam_mem_buf_queue {
@@ -98,11 +100,13 @@ struct cam_mem_buf_queue {
int32_t num_hdls;
struct cam_mem_buf_hw_hdl_info *hdls_info;
bool active;
bool release_deferred;
bool is_imported;
bool is_internal;
struct timespec64 timestamp;
struct kref krefcount;
enum cam_smmu_mapping_client smmu_mapping_client;
char buf_name[CAM_DMA_BUF_NAME_LEN];
#ifdef CONFIG_CAM_PRESIL
struct cam_presil_dmabuf_params presil_params;

5
drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c
View File

@@ -527,6 +527,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
cmd_buf = (uint32_t *)generic_ptr;
if (!cmd_buf) {
CAM_ERR(CAM_ACTUATOR, "invalid cmd buf");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
rc = -EINVAL;
goto end;
}
@@ -535,6 +536,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
sizeof(struct common_header)))) {
CAM_ERR(CAM_ACTUATOR,
"Invalid length for sensor cmd");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
rc = -EINVAL;
goto end;
}
@@ -551,6 +553,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
if (rc < 0) {
CAM_ERR(CAM_ACTUATOR,
"Failed to parse slave info: %d", rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
goto end;
}
break;
@@ -566,6 +569,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
CAM_ERR(CAM_ACTUATOR,
"Failed:parse power settings: %d",
rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
goto end;
}
break;
@@ -586,6 +590,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
CAM_ERR(CAM_ACTUATOR,
"Failed:parse init settings: %d",
rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
goto end;
}
break;

14
drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
View File

@@ -659,7 +659,6 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
uintptr_t generic_ptr;
uint32_t *cmd_buf = NULL;
size_t len;
rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
&generic_ptr, &len);
if (rc < 0) {
@@ -673,6 +672,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
index = cam_csiphy_get_instance_offset(csiphy_dev, dev_handle);
if (index < 0 || index >= csiphy_dev->session_max_device_support) {
CAM_ERR(CAM_CSIPHY, "index in invalid: %d", index);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return -EINVAL;
}
@@ -684,6 +684,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
CAM_ERR(CAM_CSIPHY,
"Not enough buffer provided for cam_csiphy_info");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return rc;
}
@@ -693,6 +694,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
if (rc) {
CAM_ERR(CAM_CSIPHY, "Wrong configuration lane_cnt: %u",
cam_cmd_csiphy_info_v2->lane_cnt);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return rc;
}
@@ -721,6 +723,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
CAM_ERR(CAM_CSIPHY,
"Not enough buffer provided for cam_csiphy_info");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return rc;
}
@@ -730,6 +733,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
if (rc) {
CAM_ERR(CAM_CSIPHY, "Wrong configuration lane_cnt: %u",
cam_cmd_csiphy_info->lane_cnt);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return rc;
}
@@ -763,6 +767,7 @@ static int __cam_csiphy_parse_lane_info_cmd_buf(
"Cannot support %s combo mode with differnt preamble settings",
(csiphy_dev->csiphy_info[index].csiphy_3phase ?
"CPHY" : "DPHY"));
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return -EINVAL;
}
@@ -955,6 +960,7 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
CAM_ERR(CAM_CSIPHY,
"Inval cam_packet strut size: %zu, len_of_buff: %zu",
sizeof(struct cam_packet), len);
cam_mem_put_cpu_buf(cfg_dev->packet_handle);
rc = -EINVAL;
return rc;
}
@@ -966,6 +972,7 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
if (cam_packet_util_validate_packet(csl_packet,
remain_len)) {
CAM_ERR(CAM_CSIPHY, "Invalid packet params");
cam_mem_put_cpu_buf(cfg_dev->packet_handle);
rc = -EINVAL;
return rc;
}
@@ -976,6 +983,7 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
csl_packet->cmd_buf_offset / 4);
else {
CAM_ERR(CAM_CSIPHY, "num_cmd_buffer = %d", csl_packet->num_cmd_buf);
cam_mem_put_cpu_buf(cfg_dev->packet_handle);
rc = -EINVAL;
return rc;
}
@@ -985,8 +993,10 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
for (i = 0; i < csl_packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
if (rc) {
cam_mem_put_cpu_buf(cfg_dev->packet_handle);
return rc;
}
cmd_buf_type = cmd_desc[i].meta_data;

11
drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
View File

@@ -1104,6 +1104,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
}
if (buf_size <= io_cfg->offsets[0]) {
CAM_ERR(CAM_EEPROM, "Not enough buffer");
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
rc = -EINVAL;
return rc;
}
@@ -1116,6 +1117,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
if (!read_buffer) {
CAM_ERR(CAM_EEPROM,
"invalid buffer to copy data");
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
rc = -EINVAL;
return rc;
}
@@ -1124,6 +1126,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl,
if (remain_len < e_ctrl->cal_data.num_data) {
CAM_ERR(CAM_EEPROM,
"failed to copy, Invalid size");
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
rc = -EINVAL;
return rc;
}
@@ -1239,6 +1242,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
"Inval cam_packet strut size: %zu, len_of_buff: %zu",
sizeof(struct cam_packet), pkt_len);
rc = -EINVAL;
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1249,6 +1253,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
if (cam_packet_util_validate_packet(csl_packet,
remain_len)) {
CAM_ERR(CAM_EEPROM, "Invalid packet params");
cam_mem_put_cpu_buf(dev_config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1260,6 +1265,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
e_ctrl->soc_info.dev->of_node, e_ctrl);
if (rc < 0) {
CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
rc = cam_eeprom_get_cal_data(e_ctrl, csl_packet);
@@ -1278,6 +1284,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
if (rc) {
CAM_ERR(CAM_EEPROM,
"Failed in parsing the pkt");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1339,6 +1346,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
csl_packet, e_ctrl);
if (rc < 0) {
CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1360,6 +1368,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
e_ctrl->eebin_info.size);
if (rc < 0) {
CAM_ERR(CAM_EEPROM, "Failed in erase : %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1369,6 +1378,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
rc = cam_eeprom_write(e_ctrl);
if (rc < 0) {
CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1393,6 +1403,7 @@ power_down:
memdata_free:
vfree(e_ctrl->cal_data.mapdata);
error:
cam_mem_put_cpu_buf(dev_config.packet_handle);
kfree(power_info->power_setting);
kfree(power_info->power_down_setting);
power_info->power_setting = NULL;

82
drivers/cam_sensor_module/cam_flash/cam_flash_core.c
View File

@@ -974,6 +974,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"Inval cam_packet strut size: %zu, len_of_buff: %zu",
sizeof(struct cam_packet), len_of_buffer);
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -984,6 +985,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (cam_packet_util_validate_packet(csl_packet,
remain_len)) {
CAM_ERR(CAM_FLASH, "Invalid packet params");
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -994,6 +996,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_DBG(CAM_FLASH,
"reject request %lld, last request to flush %lld",
csl_packet->header.request_id, fctrl->last_flush_req);
cam_mem_put_cpu_buf(config.packet_handle);
return -EBADR;
}
@@ -1015,12 +1018,15 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
&generic_ptr, &len_of_buffer);
if (rc < 0) {
cam_mem_put_cpu_buf(config.packet_handle);
CAM_ERR(CAM_FLASH, "Failed to get cpu buf");
return rc;
}
cmd_buf = (uint32_t *)generic_ptr;
if (!cmd_buf) {
CAM_ERR(CAM_FLASH, "invalid cmd buf");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -1028,6 +1034,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
(cmd_desc[i].offset >
(len_of_buffer -
sizeof(struct common_header)))) {
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
CAM_ERR(CAM_FLASH, "invalid cmd buf length");
return -EINVAL;
}
@@ -1044,6 +1052,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (len_of_buffer <
sizeof(struct cam_flash_init)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -1057,6 +1067,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"Failed parsing slave info: rc: %d",
rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
break;
@@ -1071,6 +1083,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Failed update power settings");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
break;
@@ -1089,6 +1103,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_FLASH,
"pkt parsing failed: %d", rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
break;
@@ -1098,6 +1114,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
power_info = &fctrl->power_info;
if (!power_info) {
CAM_ERR(CAM_FLASH, "Power_info is NULL");
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -1109,6 +1126,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"failed to fill vreg params for power up rc:%d",
rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1121,6 +1139,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"failed to fill vreg params power down rc:%d",
rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1128,12 +1147,14 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Enable Regulator Failed rc = %d", rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
rc = fctrl->func_tbl.apply_setting(fctrl, 0);
if (rc) {
CAM_ERR(CAM_FLASH, "cannot apply settings rc = %d", rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1163,6 +1184,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Failed in parsing i2c packets");
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
break;
@@ -1181,6 +1203,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Failed in Deleting the err: %d", rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
}
@@ -1194,12 +1217,14 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Failed in parsing i2c NRT packets");
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
rc = fctrl->func_tbl.apply_setting(fctrl, 0);
if (rc)
CAM_ERR(CAM_FLASH,
"Apply setting failed: %d", rc);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
case CAM_PKT_NOP_OPCODE: {
@@ -1211,6 +1236,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
MAX_PER_FRAME_ARRAY;
fctrl->i2c_data.per_frame[frm_offset].is_settings_valid
= false;
cam_mem_put_cpu_buf(config.packet_handle);
return 0;
}
@@ -1221,6 +1247,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
default:
CAM_ERR(CAM_FLASH, "Wrong Opcode : %d",
(csl_packet->header.op_code & 0xFFFFFF));
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
update_req_mgr:
@@ -1251,6 +1278,7 @@ update_req_mgr:
CAM_ERR(CAM_FLASH,
"Failed in adding request: %llu to request manager",
csl_packet->header.request_id);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
CAM_DBG(CAM_FLASH,
@@ -1258,7 +1286,6 @@ update_req_mgr:
add_req.req_id, add_req.trigger_eof);
}
}
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1318,6 +1345,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"Inval cam_packet strut size: %zu, len_of_buff: %zu",
sizeof(struct cam_packet), len_of_buffer);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1329,6 +1357,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (cam_packet_util_validate_packet(csl_packet,
remain_len)) {
CAM_ERR(CAM_FLASH, "Invalid packet params");
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1340,6 +1369,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_WARN(CAM_FLASH,
"reject request %lld, last request to flush %d",
csl_packet->header.request_id, fctrl->last_flush_req);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1356,12 +1386,15 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
&cmd_buf_ptr, &len_of_buffer);
if (rc) {
cam_mem_put_cpu_buf(config.packet_handle);
CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
return rc;
}
if ((len_of_buffer < sizeof(struct cam_flash_init)) ||
(cmd_desc->offset >
(len_of_buffer - sizeof(struct cam_flash_init)))) {
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
return rc;
@@ -1393,6 +1426,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (remain_len < sizeof(struct cam_flash_set_on_off)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1401,12 +1436,16 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (!flash_operation_info) {
CAM_ERR(CAM_FLASH,
"flash_operation_info Null");
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
if (flash_operation_info->count >
CAM_FLASH_MAX_LED_TRIGGERS) {
CAM_ERR(CAM_FLASH, "led count out of limit");
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1433,6 +1472,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d",
cam_flash_info->cmd_type);
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1461,6 +1502,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH, "Fail in get buffer: 0x%x",
cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1468,6 +1510,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
(cmd_desc->offset >
(len_of_buffer - sizeof(struct common_header)))) {
CAM_ERR(CAM_FLASH, "not enough buffer");
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1493,6 +1537,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (remain_len < sizeof(struct cam_flash_set_on_off)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1502,11 +1548,15 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"flash_operation_info Null");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
if (flash_operation_info->count >
CAM_FLASH_MAX_LED_TRIGGERS) {
CAM_ERR(CAM_FLASH, "led count out of limit");
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1541,6 +1591,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
default:
CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d",
cmn_hdr->cmd_type);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1556,6 +1608,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle,
&cmd_buf_ptr, &len_of_buffer);
if (rc) {
cam_mem_put_cpu_buf(config.packet_handle);
CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
return rc;
}
@@ -1565,6 +1618,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
(len_of_buffer - sizeof(struct common_header)))) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
remain_len = len_of_buffer - cmd_desc->offset;
@@ -1578,6 +1633,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (remain_len < sizeof(struct cam_flash_set_on_off)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
flash_operation_info =
@@ -1586,12 +1643,16 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"flash_operation_info Null");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
if (flash_operation_info->count >
CAM_FLASH_MAX_LED_TRIGGERS) {
CAM_ERR(CAM_FLASH, "led count out of limit");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1611,6 +1672,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc)
CAM_ERR(CAM_FLASH, "Apply setting failed: %d",
rc);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
case CAMERA_SENSOR_FLASH_CMD_TYPE_QUERYCURR: {
@@ -1619,6 +1682,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (remain_len < sizeof(struct cam_flash_query_curr)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
flash_query_info =
@@ -1638,6 +1703,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc) {
CAM_ERR(CAM_FLASH,
"Query current failed with rc=%d", rc);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
flash_query_info->query_current_ma = query_curr_ma;
@@ -1647,6 +1714,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (remain_len < sizeof(struct cam_flash_set_rer)) {
CAM_ERR(CAM_FLASH, "Not enough buffer");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
flash_rer_info = (struct cam_flash_set_rer *)cmd_buf;
@@ -1654,12 +1723,16 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"flash_rer_info Null");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
if (flash_rer_info->count >
CAM_FLASH_MAX_LED_TRIGGERS) {
CAM_ERR(CAM_FLASH, "led count out of limit");
rc = -EINVAL;
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1683,11 +1756,15 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
if (rc)
CAM_ERR(CAM_FLASH, "apply_setting failed: %d",
rc);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
default:
CAM_ERR(CAM_FLASH, "Wrong cmd_type : %d",
cmn_hdr->cmd_type);
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
cam_mem_put_cpu_buf(config.packet_handle);
rc = -EINVAL;
return rc;
}
@@ -1704,6 +1781,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
"Rxed NOP packets without linking");
fctrl->per_frame[frm_offset].cmn_attr.is_settings_valid
= false;
cam_mem_put_cpu_buf(config.packet_handle);
return -EINVAL;
}
@@ -1718,6 +1796,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH, "Wrong Opcode : %d",
(csl_packet->header.op_code & 0xFFFFFF));
rc = -EINVAL;
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
@@ -1754,6 +1833,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
CAM_ERR(CAM_FLASH,
"Failed in adding request: %llu to request manager",
csl_packet->header.request_id);
cam_mem_put_cpu_buf(config.packet_handle);
return rc;
}
CAM_DBG(CAM_FLASH,

42
drivers/cam_sensor_module/cam_ois/cam_ois_core.c
View File

@@ -1080,6 +1080,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_ERR(CAM_OIS,
"Inval cam_packet strut size: %zu, len_of_buff: %zu",
sizeof(struct cam_packet), pkt_len);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return -EINVAL;
}
@@ -1090,6 +1091,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (cam_packet_util_validate_packet(csl_packet,
remain_len)) {
CAM_ERR(CAM_OIS, "Invalid packet params");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return -EINVAL;
}
@@ -1113,11 +1115,14 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS, "Failed to get cpu buf : 0x%x",
cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
cmd_buf = (uint32_t *)generic_ptr;
if (!cmd_buf) {
CAM_ERR(CAM_OIS, "invalid cmd buf");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return -EINVAL;
}
@@ -1126,6 +1131,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
sizeof(struct common_header)))) {
CAM_ERR(CAM_OIS,
"Invalid length for sensor cmd");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return -EINVAL;
}
remain_len = len_of_buff - cmd_desc[i].offset;
@@ -1141,6 +1148,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Failed in parsing slave info");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1155,6 +1164,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc) {
CAM_ERR(CAM_OIS,
"Failed: parse power settings");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1167,6 +1178,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc) {
CAM_ERR(CAM_OIS,
"Failed: parse fw info settings");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1185,6 +1198,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"init parsing failed: %d", rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
} else if ((o_ctrl->is_ois_calib != 0) &&
@@ -1202,6 +1217,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Calib parsing failed: %d", rc);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
} else if (o_ctrl->i2c_fwinit_data.is_settings_valid == 0) {
@@ -1228,6 +1245,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
rc = cam_ois_power_up(o_ctrl);
if (rc) {
CAM_ERR(CAM_OIS, " OIS Power up failed");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
}
@@ -1358,6 +1376,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_WARN(CAM_OIS,
"Not in right state to control OIS: %d",
o_ctrl->cam_ois_state);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
offset = (uint32_t *)&csl_packet->payload;
@@ -1371,12 +1390,14 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
cmd_desc, 1, NULL);
if (rc < 0) {
CAM_ERR(CAM_OIS, "OIS pkt parsing failed: %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
rc = cam_ois_apply_settings(o_ctrl, i2c_reg_settings);
if (rc < 0) {
CAM_ERR(CAM_OIS, "Cannot apply mode settings");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1384,6 +1405,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Fail deleting Mode data: rc: %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1399,6 +1421,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_WARN(CAM_OIS,
"Not in right state to read OIS: %d",
o_ctrl->cam_ois_state);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
CAM_DBG(CAM_OIS, "number of I/O configs: %d:",
@@ -1406,6 +1429,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (csl_packet->num_io_configs == 0) {
CAM_ERR(CAM_OIS, "No I/O configs to process");
rc = -EINVAL;
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1419,6 +1443,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (io_cfg == NULL) {
CAM_ERR(CAM_OIS, "I/O config is invalid(NULL)");
rc = -EINVAL;
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1432,12 +1457,14 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
cmd_desc, 1, &io_cfg[0]);
if (rc < 0) {
CAM_ERR(CAM_OIS, "OIS read pkt parsing failed: %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
rc = cam_sensor_util_get_current_qtimer_ns(&qtime_ns);
if (rc < 0) {
CAM_ERR(CAM_OIS, "failed to get qtimer rc:%d");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1447,6 +1474,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS, "cannot read data rc: %d", rc);
delete_request(&i2c_read_settings);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1457,6 +1485,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_ERR(CAM_OIS,
"write qtimer failed rc: %d", rc);
delete_request(&i2c_read_settings);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
}
@@ -1465,6 +1494,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Failed in deleting the read settings");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1477,6 +1507,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_ERR(CAM_OIS,
"Not in right state to write time to OIS: %d",
o_ctrl->cam_ois_state);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
offset = (uint32_t *)&csl_packet->payload;
@@ -1490,6 +1521,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
cmd_desc, 1, NULL);
if (rc < 0) {
CAM_ERR(CAM_OIS, "OIS pkt parsing failed: %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1501,12 +1533,14 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
rc = cam_ois_update_time(i2c_reg_settings, CAM_ENDIANNESS_LITTLE);
if (rc < 0) {
CAM_ERR(CAM_OIS, "Cannot update time");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
rc = cam_ois_apply_settings(o_ctrl, i2c_reg_settings);
if (rc < 0) {
CAM_ERR(CAM_OIS, "Cannot apply mode settings");
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
@@ -1514,6 +1548,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
if (rc < 0) {
CAM_ERR(CAM_OIS,
"Fail deleting Mode data: rc: %d", rc);
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
break;
@@ -1521,13 +1556,16 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
default:
CAM_ERR(CAM_OIS, "Invalid Opcode: %d",
(csl_packet->header.op_code & 0xFFFFFF));
cam_mem_put_cpu_buf(dev_config.packet_handle);
return -EINVAL;
}
cam_mem_put_cpu_buf(dev_config.packet_handle);
if (!rc)
if (!rc) {
cam_mem_put_cpu_buf(dev_config.packet_handle);
return rc;
}
pwr_dwn:
cam_mem_put_cpu_buf(dev_config.packet_handle);
cam_ois_power_down(o_ctrl);
return rc;
}

3
drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c
View File

@@ -866,6 +866,7 @@ int32_t cam_handle_mem_ptr(uint64_t handle, uint32_t cmd,
if (cmd_desc[i].offset >= len) {
CAM_ERR(CAM_SENSOR,
"offset past length of buffer");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
rc = -EINVAL;
goto end;
}
@@ -873,6 +874,7 @@ int32_t cam_handle_mem_ptr(uint64_t handle, uint32_t cmd,
if (cmd_desc[i].length > remain_len) {
CAM_ERR(CAM_SENSOR,
"Not enough buffer provided for cmd");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
rc = -EINVAL;
goto end;
}
@@ -886,6 +888,7 @@ int32_t cam_handle_mem_ptr(uint64_t handle, uint32_t cmd,
if (rc < 0) {
CAM_ERR(CAM_SENSOR,
"Failed to parse the command Buffer Header");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
goto end;
}
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);

8
drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
View File

@@ -391,6 +391,7 @@ static int32_t cam_sensor_get_io_buffer(
CAM_ERR(CAM_SENSOR_UTIL,
"invalid size:io_cfg->offsets[0]: %d, buf_size: %d",
io_cfg->offsets[0], buf_size);
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
return -EINVAL;
}
i2c_settings->read_buff =
@@ -402,7 +403,6 @@ static int32_t cam_sensor_get_io_buffer(
io_cfg->direction);
rc = -EINVAL;
}
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
return rc;
}
@@ -436,6 +436,7 @@ int32_t cam_sensor_util_write_qtimer_to_io_buffer(
CAM_ERR(CAM_SENSOR_UTIL,
"invalid size:io_cfg->offsets[0]: %d, buf_size: %d",
io_cfg->offsets[0], buf_size);
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
return -EINVAL;
}
@@ -446,17 +447,18 @@ int32_t cam_sensor_util_write_qtimer_to_io_buffer(
CAM_ERR(CAM_SENSOR_UTIL,
"not enough size for qtimer, target_size:%d",
target_size);
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
return -EINVAL;
}
memcpy((void *)target_buf, &qtime_ns, sizeof(uint64_t));
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
} else {
CAM_ERR(CAM_SENSOR_UTIL, "Invalid direction: %d",
io_cfg->direction);
rc = -EINVAL;
}
cam_mem_put_cpu_buf(io_cfg->mem_handle[0]);
return rc;
}
@@ -645,6 +647,7 @@ int cam_sensor_i2c_command_parser(
(cmd_desc[i].offset >
(len_of_buff - sizeof(struct common_header)))) {
CAM_ERR(CAM_SENSOR_UTIL, "buffer provided too small");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
return -EINVAL;
}
cmd_buf = (uint32_t *)generic_ptr;
@@ -653,6 +656,7 @@ int cam_sensor_i2c_command_parser(
remain_len -= cmd_desc[i].offset;
if (remain_len < cmd_desc[i].length) {
CAM_ERR(CAM_SENSOR_UTIL, "buffer provided too small");
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
return -EINVAL;
}

2
drivers/cam_sensor_module/cam_tpg/cam_tpg_core.c
View File

@@ -480,6 +480,7 @@ static int cam_tpg_validate_cmd_descriptor(
*cmd_addr = (uintptr_t)cmd_header;
end:
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
return rc;
}
@@ -678,6 +679,7 @@ static int cam_tpg_packet_parse(
break;
}
end:
cam_mem_put_cpu_buf(config->packet_handle);
return rc;
}

1
drivers/cam_utils/cam_packet_util.c
View File

@@ -67,6 +67,7 @@ int cam_packet_util_get_cmd_mem_addr(int handle, uint32_t **buf_addr,
if (kmd_buf_addr && *len) {
*buf_addr = (uint32_t *)kmd_buf_addr;
} else {
cam_mem_put_cpu_buf(handle);
CAM_ERR(CAM_UTIL, "Invalid addr and length :%zd", *len);
rc = -ENOMEM;
}