TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'LA.UM.9.12.1.r1-09700-SMxx50.QSSI12.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/video-driver into android13-4.19-kona

Browse Source 
"LA.UM.9.12.1.r1-09700-SMxx50.QSSI12.0"

* tag 'LA.UM.9.12.1.r1-09700-SMxx50.QSSI12.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/video-driver:
  msm: vidc: Release cvp buffer lock in invalid buffer case
  msm: vidc: Fix possible UAF during buffer unregister call
  vidc: Return EBUSY if mbpf check fails
  vidc: Skip unsupported session load in load calculation

 Conflicts:
	techpack/video/msm/vidc/msm_vidc_common.c

Change-Id: I7dc1d60f51c11288c83f7ee4097b2b2f39d2655b
This commit is contained in:
Michael Bestas
2024-10-10 14:26:14 +03:00
parent 080219bb4f 40d93e2b75
commit 8fc1b264e3
5 changed files with 16 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
techpack/video/msm/vidc/msm_cvp_internal.c
View File

@@ -142,7 +142,6 @@ void handle_session_unregister_buffer_done(enum hal_command_response cmd,
break;
}
}
mutex_unlock(&inst->cvpbufs.lock);
if (!found) {
s_vpr_e(inst->sid, "%s: client_data %x not found\n",
__func__, response->data.unregbuf.client_data);
@@ -164,12 +163,11 @@ void handle_session_unregister_buffer_done(enum hal_command_response cmd,
data[3] = cbuf->buf.offset;
v4l2_event_queue_fh(&inst->event_handler, &event);
mutex_lock(&inst->cvpbufs.lock);
list_del(&cbuf->list);
mutex_unlock(&inst->cvpbufs.lock);
kfree(cbuf);
cbuf = NULL;
exit:
mutex_unlock(&inst->cvpbufs.lock);
s_vpr_l(inst->sid, "handled: SESSION_UNREGISTER_BUFFER_DONE\n");
put_inst(inst);
}
@@ -432,9 +430,9 @@ static int msm_cvp_unregister_buffer(struct msm_vidc_inst *inst,
break;
}
}
mutex_unlock(&inst->cvpbufs.lock);
if (!found) {
print_client_buffer(VIDC_ERR, "invalid", inst, buf);
mutex_unlock(&inst->cvpbufs.lock);
return -EINVAL;
}
@@ -450,6 +448,7 @@ static int msm_cvp_unregister_buffer(struct msm_vidc_inst *inst,
if (rc)
print_cvp_buffer(VIDC_ERR, "unregister failed", inst, cbuf);
mutex_unlock(&inst->cvpbufs.lock);
return rc;
}

1
techpack/video/msm/vidc/msm_vidc.c
View File

@@ -1488,6 +1488,7 @@ void *msm_vidc_open(int core_id, int session_type)
inst->entropy_mode = HFI_H264_ENTROPY_CABAC;
inst->full_range = COLOR_RANGE_UNSPECIFIED;
inst->active = true;
inst->supported = true;
for (i = SESSION_MSG_INDEX(SESSION_MSG_START);
i <= SESSION_MSG_INDEX(SESSION_MSG_END); i++) {

11
techpack/video/msm/vidc/msm_vidc_common.c
View File

@@ -817,8 +817,8 @@ int msm_comm_get_inst_load(struct msm_vidc_inst *inst,
* | res * max(op, fps)|
* ----------------|----------------------------|
*/
if (is_thumbnail_session(inst) ||
if (!is_supported_session(inst) ||
is_thumbnail_session(inst) ||
(!is_realtime_session(inst) &&
quirks == LOAD_ADMISSION_CONTROL)) {
load = 0;
@@ -858,7 +858,6 @@ int msm_comm_get_device_load(struct msm_vidc_core *core,
list_for_each_entry(inst, &core->instances, list) {
if (inst->session_type != sess_type)
continue;
if (load_type == MSM_VIDC_VIDEO && !is_video_session(inst))
continue;
else if (load_type == MSM_VIDC_IMAGE && !is_grid_session(inst))
@@ -3547,6 +3546,7 @@ static int msm_vidc_load_resources(int flipped_state,
"H/W is overloaded. needed: %d max: %d\n",
video_load, max_video_load);
msm_vidc_print_running_insts(inst->core);
inst->supported = false;
return -ENOMEM;
}
@@ -3555,6 +3555,7 @@ static int msm_vidc_load_resources(int flipped_state,
"H/W is overloaded. needed: [video + image][%d + %d], max: [video + image][%d + %d]\n",
video_load, image_load, max_video_load, max_image_load);
msm_vidc_print_running_insts(inst->core);
inst->supported = false;
return -ENOMEM;
}
@@ -5818,7 +5819,7 @@ static int msm_vidc_check_mbpf_supported(struct msm_vidc_inst *inst)
if (mbpf > core->resources.max_mbpf) {
msm_vidc_print_running_insts(inst->core);
return -ENOMEM;
return -EBUSY;
}
return 0;
@@ -5962,6 +5963,7 @@ static int msm_vidc_check_mbps_supported(struct msm_vidc_inst *inst)
"H/W is overloaded. needed: %d max: %d\n",
video_load, max_video_load);
msm_vidc_print_running_insts(inst->core);
inst->supported = false;
return -EBUSY;
}
@@ -5971,6 +5973,7 @@ static int msm_vidc_check_mbps_supported(struct msm_vidc_inst *inst)
video_load, image_load,
max_video_load, max_image_load);
msm_vidc_print_running_insts(inst->core);
inst->supported = false;
return -EBUSY;
}
}

5
techpack/video/msm/vidc/msm_vidc_common.h
View File

@@ -157,7 +157,10 @@ static inline bool is_encode_session(struct msm_vidc_inst *inst)
{
return inst->session_type == MSM_VIDC_ENCODER;
}
static inline bool is_supported_session(struct msm_vidc_inst *inst)
{
return inst->supported;
}
static inline bool is_primary_output_mode(struct msm_vidc_inst *inst)
{
return inst->stream_output_mode == HAL_VIDEO_DECODER_PRIMARY;

1
techpack/video/msm/vidc/msm_vidc_internal.h
View File

@@ -577,6 +577,7 @@ struct msm_vidc_inst {
int full_range;
u64 last_qbuf_time_ns;
bool active;
bool supported;
};
extern struct msm_vidc_drv *vidc_driver;