Merge "mm-camera2:isp2: Avoid use after free buffer"

diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp40.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp40.c
index 717e375..850f1b0 100644 (file)
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp40.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp40.c
@@ -1061,15 +1061,18 @@ static int msm_vfe40_start_fetch_engine(struct vfe_device *vfe_dev,
                                fe_cfg->stream_id);
                vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;
 
+               mutex_lock(&vfe_dev->buf_mgr->lock);
                rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
                        vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
                if (rc < 0 || !buf) {
                        pr_err("%s: No fetch buffer rc= %d buf= %pK\n",
                                __func__, rc, buf);
+                       mutex_unlock(&vfe_dev->buf_mgr->lock);
                        return -EINVAL;
                }
                mapped_info = buf->mapped_info[0];
                buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
        } else {
                rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
                        &mapped_info, fe_cfg->fd);
@@ -1122,14 +1125,15 @@ static int msm_vfe40_start_fetch_engine_multi_pass(struct vfe_device *vfe_dev,
                mutex_lock(&vfe_dev->buf_mgr->lock);
                rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
                        vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
-               mutex_unlock(&vfe_dev->buf_mgr->lock);
                if (rc < 0 || !buf) {
                        pr_err("%s: No fetch buffer rc= %d buf= %pK\n",
                                __func__, rc, buf);
+                       mutex_unlock(&vfe_dev->buf_mgr->lock);
                        return -EINVAL;
                }
                mapped_info = buf->mapped_info[0];
                buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
        } else {
                rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
                        &mapped_info, fe_cfg->fd);

diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp44.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp44.c
index 1d50354..3b8de1a 100644 (file)
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp44.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp44.c
@@ -895,13 +895,14 @@ static int msm_vfe44_fetch_engine_start(struct vfe_device *vfe_dev,
                mutex_lock(&vfe_dev->buf_mgr->lock);
                rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
                        vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
-               mutex_unlock(&vfe_dev->buf_mgr->lock);
                if (rc < 0) {
                        pr_err("%s: No fetch buffer\n", __func__);
+                       mutex_unlock(&vfe_dev->buf_mgr->lock);
                        return -EINVAL;
                }
                mapped_info = buf->mapped_info[0];
                buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
        } else {
                rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
                        &mapped_info, fe_cfg->fd);

diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp46.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp46.c
index 42787c6..f8866b0 100644 (file)
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp46.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp46.c
@@ -836,14 +836,15 @@ static int msm_vfe46_start_fetch_engine(struct vfe_device *vfe_dev,
                mutex_lock(&vfe_dev->buf_mgr->lock);
                rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
                        vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
-               mutex_unlock(&vfe_dev->buf_mgr->lock);
                if (rc < 0 || !buf) {
                        pr_err("%s: No fetch buffer rc= %d buf= %pK\n",
                                __func__, rc, buf);
+                       mutex_unlock(&vfe_dev->buf_mgr->lock);
                        return -EINVAL;
                }
                mapped_info = buf->mapped_info[0];
                buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
        } else {
                rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
                        &mapped_info, fe_cfg->fd);

diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c
index b4308cc..0a969cc 100644 (file)
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c
@@ -1104,15 +1104,18 @@ int msm_vfe47_start_fetch_engine(struct vfe_device *vfe_dev,
                        fe_cfg->stream_id);
                vfe_dev->fetch_engine_info.bufq_handle = bufq_handle;
 
+               mutex_lock(&vfe_dev->buf_mgr->lock);
                rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
                        vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
                if (rc < 0 || !buf) {
                        pr_err("%s: No fetch buffer rc= %d buf= %pK\n",
                                __func__, rc, buf);
+                       mutex_unlock(&vfe_dev->buf_mgr->lock);
                        return -EINVAL;
                }
                mapped_info = buf->mapped_info[0];
                buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
        } else {
                rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
                        &mapped_info, fe_cfg->fd);
@@ -1165,14 +1168,15 @@ int msm_vfe47_start_fetch_engine_multi_pass(struct vfe_device *vfe_dev,
                mutex_lock(&vfe_dev->buf_mgr->lock);
                rc = vfe_dev->buf_mgr->ops->get_buf_by_index(
                        vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf);
-               mutex_unlock(&vfe_dev->buf_mgr->lock);
                if (rc < 0 || !buf) {
                        pr_err("%s: No fetch buffer rc= %d buf= %pK\n",
                                __func__, rc, buf);
+                       mutex_unlock(&vfe_dev->buf_mgr->lock);
                        return -EINVAL;
                }
                mapped_info = buf->mapped_info[0];
                buf->state = MSM_ISP_BUFFER_STATE_DISPATCHED;
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
        } else {
                rc = vfe_dev->buf_mgr->ops->map_buf(vfe_dev->buf_mgr,
                        &mapped_info, fe_cfg->fd);

diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
index fa116b1..4dc471b 100644 (file)
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
@@ -3944,10 +3944,12 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg)
                                &update_cmd->update_info[i];
                        stream_info = msm_isp_get_stream_common_data(vfe_dev,
                                HANDLE_TO_IDX(update_info->stream_handle));
+                       mutex_lock(&vfe_dev->buf_mgr->lock);
                        rc = msm_isp_request_frame(vfe_dev, stream_info,
                                update_info->user_stream_id,
                                update_info->frame_id,
                                MSM_ISP_INVALID_BUF_INDEX);
+                       mutex_unlock(&vfe_dev->buf_mgr->lock);
                        if (rc)
                                pr_err("%s failed to request frame!\n",
                                        __func__);
@@ -3993,10 +3995,12 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg)
                        rc = -EINVAL;
                        break;
                }
+               mutex_lock(&vfe_dev->buf_mgr->lock);
                rc = msm_isp_request_frame(vfe_dev, stream_info,
                        req_frm->user_stream_id,
                        req_frm->frame_id,
                        req_frm->buf_index);
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
                if (rc)
                        pr_err("%s failed to request frame!\n",
                                __func__);

diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
index 1a27a5d..c132947 100644 (file)
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
@@ -406,8 +406,10 @@ static int msm_isp_start_fetch_engine_multi_pass(struct vfe_device *vfe_dev,
                        0, 1);
                msm_isp_reset_framedrop(vfe_dev, stream_info);
 
+               mutex_lock(&vfe_dev->buf_mgr->lock);
                rc = msm_isp_cfg_offline_ping_pong_address(vfe_dev, stream_info,
                        VFE_PING_FLAG, fe_cfg->output_buf_idx);
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
                if (rc < 0) {
                        pr_err("%s: Fetch engine config failed\n", __func__);
                        return -EINVAL;
@@ -895,7 +897,9 @@ static long msm_isp_ioctl_unlocked(struct v4l2_subdev *sd,
        case VIDIOC_MSM_ISP_CFG_STREAM:
                mutex_lock(&vfe_dev->core_mutex);
                MSM_ISP_DUAL_VFE_MUTEX_LOCK(vfe_dev);
+               mutex_lock(&vfe_dev->buf_mgr->lock);
                rc = msm_isp_cfg_axi_stream(vfe_dev, arg);
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
                MSM_ISP_DUAL_VFE_MUTEX_UNLOCK(vfe_dev);
                mutex_unlock(&vfe_dev->core_mutex);
                break;
@@ -925,6 +929,7 @@ static long msm_isp_ioctl_unlocked(struct v4l2_subdev *sd,
        case VIDIOC_MSM_ISP_AXI_RESTART:
                mutex_lock(&vfe_dev->core_mutex);
                MSM_ISP_DUAL_VFE_MUTEX_LOCK(vfe_dev);
+               mutex_lock(&vfe_dev->buf_mgr->lock);
                if (atomic_read(&vfe_dev->error_info.overflow_state)
                        != HALT_ENFORCED) {
                        rc = msm_isp_stats_restart(vfe_dev);
@@ -935,6 +940,7 @@ static long msm_isp_ioctl_unlocked(struct v4l2_subdev *sd,
                        pr_err_ratelimited("%s: no AXI restart, halt enforced.\n",
                                __func__);
                }
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
                MSM_ISP_DUAL_VFE_MUTEX_UNLOCK(vfe_dev);
                mutex_unlock(&vfe_dev->core_mutex);
                break;
@@ -1010,7 +1016,9 @@ static long msm_isp_ioctl_unlocked(struct v4l2_subdev *sd,
        case VIDIOC_MSM_ISP_CFG_STATS_STREAM:
                mutex_lock(&vfe_dev->core_mutex);
                MSM_ISP_DUAL_VFE_MUTEX_LOCK(vfe_dev);
+               mutex_lock(&vfe_dev->buf_mgr->lock);
                rc = msm_isp_cfg_stats_stream(vfe_dev, arg);
+               mutex_unlock(&vfe_dev->buf_mgr->lock);
                MSM_ISP_DUAL_VFE_MUTEX_UNLOCK(vfe_dev);
                mutex_unlock(&vfe_dev->core_mutex);
                break;