joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity

msm: camera: cdm: Acquire mutex lock before accessing client data

Browse source 
There is a chance of use after release of client data in
cdm internal operation calls. Hence acquire mutex lock whenever
accessing client data to avoid use after release scenario.

CRs-Fixed: 3010261
Change-Id: I853854ada5e776b5d9fe34a05cd5fbd1001d68f7
Signed-off-by: Shravya Samala <shravyas@codeaurora.org>
This commit is contained in:
Shravya Samala 2021-11-15 14:40:42 +05:30 • committed by Gerrit - the friendly Code Review server
commit 6f0d0c6b69
1 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
drivers/media/platform/msm/camera_v3/cam_cdm/cam_cdm_core_common.c
View file

@ -243,35 +243,34 @@ int cam_cdm_stream_ops_internal(void *hw_priv,
return -EINVAL;
core = (struct cam_cdm *)cdm_hw->core_info;
mutex_lock(&cdm_hw->hw_mutex);
client_idx = CAM_CDM_GET_CLIENT_IDX(*handle);
client = core->clients[client_idx];
if (!client) {
CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x", client, *handle);
mutex_unlock(&cdm_hw->hw_mutex);
return -EINVAL;
}
cam_cdm_get_client_refcount(client);
if (*handle != client->handle) {
CAM_ERR(CAM_CDM, "client id given handle=%x invalid", *handle);
cam_cdm_put_client_refcount(client);
return -EINVAL;
rc = -EINVAL;
goto end;
}
if (operation == true) {
if (true == client->stream_on) {
CAM_ERR(CAM_CDM,
"Invalid CDM client is already streamed ON");
cam_cdm_put_client_refcount(client);
return rc;
goto end;
}
} else {
if (client->stream_on == false) {
CAM_ERR(CAM_CDM,
"Invalid CDM client is already streamed Off");
cam_cdm_put_client_refcount(client);
return rc;
goto end;
}
}
mutex_lock(&cdm_hw->hw_mutex);
if (operation == true) {
if (!cdm_hw->open_count) {
struct cam_ahb_vote ahb_vote;