From 0eeb42c1b691a1c9b3b791b9eb2079bffcef2b11 Mon Sep 17 00:00:00 2001 From: Shadul Shaikh Date: Wed, 4 Oct 2023 17:20:03 +0530 Subject: [PATCH] msm: camera: sensor: Unmap DMA buffers to end access from kernel Unmap DMA buffers in error/success cases to end the access from kernel space. CRs-Fixed: 3635168. Change-Id: Ibbcffdfabfcc336cac8e29db8b1df50c7c34e601 Signed-off-by: Shadul Shaikh --- .../cam_actuator/cam_actuator_core.c | 8 ++ .../cam_csiphy/cam_csiphy_core.c | 9 ++ .../cam_eeprom/cam_eeprom_core.c | 11 +++ .../cam_flash/cam_flash_core.c | 95 +++++++++++++++++++ .../cam_sensor_module/cam_ois/cam_ois_core.c | 41 +++++++- .../cam_sensor/cam_sensor_core.c | 3 + .../cam_sensor_utils/cam_sensor_util.c | 2 + 7 files changed, 167 insertions(+), 2 deletions(-) diff --git a/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c b/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c index 1e308de4f167..7ed7baa2b272 100644 --- a/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c +++ b/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c @@ -501,6 +501,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl, cmd_buf = (uint32_t *)generic_ptr; if (!cmd_buf) { CAM_ERR(CAM_ACTUATOR, "invalid cmd buf"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); rc = -EINVAL; goto end; } @@ -509,6 +510,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl, sizeof(struct common_header)))) { CAM_ERR(CAM_ACTUATOR, "Invalid length for sensor cmd"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); rc = -EINVAL; goto end; } @@ -525,6 +527,8 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl, if (rc < 0) { CAM_ERR(CAM_ACTUATOR, "Failed to parse slave info: %d", rc); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); goto end; } break; @@ -540,6 +544,8 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl, CAM_ERR(CAM_ACTUATOR, "Failed:parse power settings: %d", rc); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); goto end; } break; @@ -560,6 +566,8 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl, CAM_ERR(CAM_ACTUATOR, "Failed:parse init settings: %d", rc); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); goto end; } break; diff --git a/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c b/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c index 4add28badba3..4d399db2e901 100644 --- a/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c +++ b/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c @@ -248,6 +248,7 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev, "Inval cam_packet strut size: %zu, len_of_buff: %zu", sizeof(struct cam_packet), len); rc = -EINVAL; + cam_mem_put_cpu_buf(cfg_dev->packet_handle); return rc; } @@ -259,6 +260,7 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev, remain_len)) { CAM_ERR(CAM_CSIPHY, "Invalid packet params"); rc = -EINVAL; + cam_mem_put_cpu_buf(cfg_dev->packet_handle); return rc; } @@ -270,12 +272,14 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev, CAM_ERR(CAM_CSIPHY, "num_cmd_buffers = %d", csl_packet->num_cmd_buf); rc = -EINVAL; + cam_mem_put_cpu_buf(cfg_dev->packet_handle); return rc; } rc = cam_packet_util_validate_cmd_desc(cmd_desc); if (rc) { CAM_ERR(CAM_CSIPHY, "Invalid cmd desc ret: %d", rc); + cam_mem_put_cpu_buf(cfg_dev->packet_handle); return rc; } @@ -284,6 +288,7 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev, if (rc < 0) { CAM_ERR(CAM_CSIPHY, "Failed to get cmd buf Mem address : %d", rc); + cam_mem_put_cpu_buf(cfg_dev->packet_handle); return rc; } @@ -292,6 +297,8 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev, CAM_ERR(CAM_CSIPHY, "Not enough buffer provided for cam_cisphy_info"); rc = -EINVAL; + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(cfg_dev->packet_handle); return rc; } @@ -302,6 +309,8 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev, index = cam_csiphy_get_instance_offset(csiphy_dev, cfg_dev->dev_handle); if (index < 0 || index >= csiphy_dev->session_max_device_support) { CAM_ERR(CAM_CSIPHY, "index is invalid: %d", index); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(cfg_dev->packet_handle); return -EINVAL; } diff --git a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c index 4085bfa7b620..6eff736f4d04 100644 --- a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c +++ b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c @@ -1100,6 +1100,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl, } if (buf_size <= io_cfg->offsets[0]) { CAM_ERR(CAM_EEPROM, "Not enough buffer"); + cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); rc = -EINVAL; return rc; } @@ -1112,6 +1113,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl, if (!read_buffer) { CAM_ERR(CAM_EEPROM, "invalid buffer to copy data"); + cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); rc = -EINVAL; return rc; } @@ -1120,6 +1122,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl, if (remain_len < e_ctrl->cal_data.num_data) { CAM_ERR(CAM_EEPROM, "failed to copy, Invalid size"); + cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); rc = -EINVAL; return rc; } @@ -1234,6 +1237,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg) CAM_ERR(CAM_EEPROM, "Inval cam_packet strut size: %zu, len_of_buff: %zu", sizeof(struct cam_packet), pkt_len); + cam_mem_put_cpu_buf(dev_config.packet_handle); rc = -EINVAL; return rc; } @@ -1245,6 +1249,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg) if (cam_packet_util_validate_packet(csl_packet, remain_len)) { CAM_ERR(CAM_EEPROM, "Invalid packet params"); + cam_mem_put_cpu_buf(dev_config.packet_handle); rc = -EINVAL; return rc; } @@ -1256,6 +1261,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg) e_ctrl->soc_info.dev->of_node, e_ctrl); if (rc < 0) { CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } rc = cam_eeprom_get_cal_data(e_ctrl, csl_packet); @@ -1271,6 +1277,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg) if (rc) { CAM_ERR(CAM_EEPROM, "Failed in parsing the pkt"); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } @@ -1329,6 +1336,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg) csl_packet, e_ctrl); if (rc < 0) { CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } @@ -1350,6 +1358,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg) e_ctrl->eebin_info.size); if (rc < 0) { CAM_ERR(CAM_EEPROM, "Failed in erase : %d", rc); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } @@ -1359,6 +1368,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg) rc = cam_eeprom_write(e_ctrl); if (rc < 0) { CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } @@ -1384,6 +1394,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg) memdata_free: vfree(e_ctrl->cal_data.mapdata); error: + cam_mem_put_cpu_buf(dev_config.packet_handle); kfree(power_info->power_setting); kfree(power_info->power_down_setting); power_info->power_setting = NULL; diff --git a/drivers/cam_sensor_module/cam_flash/cam_flash_core.c b/drivers/cam_sensor_module/cam_flash/cam_flash_core.c index d80bdff9eee3..40ad3584c6a2 100644 --- a/drivers/cam_sensor_module/cam_flash/cam_flash_core.c +++ b/drivers/cam_sensor_module/cam_flash/cam_flash_core.c @@ -1068,6 +1068,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) CAM_ERR(CAM_FLASH, "Inval cam_packet strut size: %zu, len_of_buff: %zu", sizeof(struct cam_packet), len_of_buffer); + cam_mem_put_cpu_buf(config.packet_handle); return -EINVAL; } @@ -1078,6 +1079,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) if (cam_packet_util_validate_packet(csl_packet, remain_len)) { CAM_ERR(CAM_FLASH, "Invalid packet params"); + cam_mem_put_cpu_buf(config.packet_handle); return -EINVAL; } @@ -1088,6 +1090,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) CAM_DBG(CAM_FLASH, "reject request %lld, last request to flush %lld", csl_packet->header.request_id, fctrl->last_flush_req); + cam_mem_put_cpu_buf(config.packet_handle); return -EINVAL; } @@ -1111,11 +1114,14 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) &generic_ptr, &len_of_buffer); if (rc < 0) { CAM_ERR(CAM_FLASH, "Failed to get cpu buf"); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } cmd_buf = (uint32_t *)generic_ptr; if (!cmd_buf) { CAM_ERR(CAM_FLASH, "invalid cmd buf"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); return -EINVAL; } @@ -1124,6 +1130,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) (len_of_buffer - sizeof(struct common_header)))) { CAM_ERR(CAM_FLASH, "invalid cmd buf length"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); return -EINVAL; } remain_len = len_of_buffer - cmd_desc[i].offset; @@ -1140,6 +1148,10 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) if (len_of_buffer < sizeof(struct cam_flash_init)) { CAM_ERR(CAM_FLASH, "Not enough buffer"); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf( + config.packet_handle); return -EINVAL; } @@ -1159,6 +1171,10 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) CAM_ERR(CAM_FLASH, "Failed parsing slave info: rc: %d", rc); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf( + config.packet_handle); return rc; } cmd_length_in_bytes = @@ -1185,6 +1201,10 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) if (rc) { CAM_ERR(CAM_FLASH, "Failed update power settings"); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf( + config.packet_handle); return rc; } break; @@ -1204,6 +1224,10 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) if (rc < 0) { CAM_ERR(CAM_FLASH, "pkt parsing failed: %d", rc); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf( + config.packet_handle); return rc; } cmd_length_in_bytes = @@ -1220,6 +1244,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) power_info = &fctrl->power_info; if (!power_info) { CAM_ERR(CAM_FLASH, "Power_info is NULL"); + cam_mem_put_cpu_buf(config.packet_handle); return -EINVAL; } @@ -1231,6 +1256,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) CAM_ERR(CAM_FLASH, "failed to fill vreg params for power up rc:%d", rc); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } @@ -1243,6 +1269,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) CAM_ERR(CAM_FLASH, "failed to fill vreg params power down rc:%d", rc); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } @@ -1250,12 +1277,14 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) if (rc) { CAM_ERR(CAM_FLASH, "Enable Regulator Failed rc = %d", rc); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } rc = fctrl->func_tbl.apply_setting(fctrl, 0); if (rc) { CAM_ERR(CAM_FLASH, "cannot apply settings rc = %d", rc); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } @@ -1285,6 +1314,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) if (rc) { CAM_ERR(CAM_FLASH, "Failed in parsing i2c packets"); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } break; @@ -1303,6 +1333,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) if (rc) { CAM_ERR(CAM_FLASH, "Failed in Deleting the err: %d", rc); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } } @@ -1316,12 +1347,14 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) if (rc) { CAM_ERR(CAM_FLASH, "Failed in parsing i2c NRT packets"); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } rc = fctrl->func_tbl.apply_setting(fctrl, 0); if (rc) CAM_ERR(CAM_FLASH, "Apply setting failed: %d", rc); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } case CAM_PKT_NOP_OPCODE: { @@ -1333,6 +1366,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) MAX_PER_FRAME_ARRAY; fctrl->i2c_data.per_frame[frm_offset].is_settings_valid = false; + cam_mem_put_cpu_buf(config.packet_handle); return 0; } @@ -1343,6 +1377,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) default: CAM_ERR(CAM_FLASH, "Wrong Opcode : %d", (csl_packet->header.op_code & 0xFFFFFF)); + cam_mem_put_cpu_buf(config.packet_handle); return -EINVAL; } update_req_mgr: @@ -1425,6 +1460,7 @@ int cam_flash_pmic_gpio_pkt_parser( CAM_ERR(CAM_FLASH, "Inval cam_packet strut size: %zu, len_of_buff: %zu", sizeof(struct cam_packet), len_of_buffer); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1436,6 +1472,7 @@ int cam_flash_pmic_gpio_pkt_parser( if (cam_packet_util_validate_packet(csl_packet, remain_len)) { CAM_ERR(CAM_FLASH, "Invalid packet params"); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1447,6 +1484,7 @@ int cam_flash_pmic_gpio_pkt_parser( CAM_WARN(CAM_FLASH, "reject request %lld, last request to flush %d", csl_packet->header.request_id, fctrl->last_flush_req); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1464,12 +1502,15 @@ int cam_flash_pmic_gpio_pkt_parser( &cmd_buf_ptr, &len_of_buffer); if (rc) { CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } if ((len_of_buffer < sizeof(struct cam_flash_init)) || (cmd_desc->offset > (len_of_buffer - sizeof(struct cam_flash_init)))) { CAM_ERR(CAM_FLASH, "Not enough buffer"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1493,6 +1534,8 @@ int cam_flash_pmic_gpio_pkt_parser( if (rc) { CAM_ERR(CAM_FLASH, "Enable Regulator Failed rc = %d", rc); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } @@ -1505,6 +1548,8 @@ int cam_flash_pmic_gpio_pkt_parser( if (remain_len < sizeof(struct cam_flash_set_on_off)) { CAM_ERR(CAM_FLASH, "Not enough buffer"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1514,12 +1559,16 @@ int cam_flash_pmic_gpio_pkt_parser( if (!flash_operation_info) { CAM_ERR(CAM_FLASH, "flash_operation_info Null"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } if (flash_operation_info->count > CAM_FLASH_MAX_LED_TRIGGERS) { CAM_ERR(CAM_FLASH, "led count out of limit"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1547,6 +1596,8 @@ int cam_flash_pmic_gpio_pkt_parser( default: CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d", cam_flash_info->cmd_type); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1576,6 +1627,7 @@ int cam_flash_pmic_gpio_pkt_parser( if (rc) { CAM_ERR(CAM_FLASH, "Fail in get buffer: 0x%x", cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } @@ -1583,6 +1635,8 @@ int cam_flash_pmic_gpio_pkt_parser( (cmd_desc->offset > (len_of_buffer - sizeof(struct common_header)))) { CAM_ERR(CAM_FLASH, "not enough buffer"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1591,6 +1645,8 @@ int cam_flash_pmic_gpio_pkt_parser( cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr + cmd_desc->offset); if (!cmd_buf) { + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1606,10 +1662,16 @@ int cam_flash_pmic_gpio_pkt_parser( CAM_WARN(CAM_FLASH, "Rxed Flash fire ops without linking"); flash_data->cmn_attr.is_settings_valid = false; + cam_mem_put_cpu_buf( + cmd_desc->mem_handle); + cam_mem_put_cpu_buf( + config.packet_handle); return -EINVAL; } if (remain_len < sizeof(struct cam_flash_set_on_off)) { CAM_ERR(CAM_FLASH, "Not enough buffer"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1619,12 +1681,16 @@ int cam_flash_pmic_gpio_pkt_parser( if (!flash_operation_info) { CAM_ERR(CAM_FLASH, "flash_operation_info Null"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } if (flash_operation_info->count > CAM_FLASH_MAX_LED_TRIGGERS) { CAM_ERR(CAM_FLASH, "led count out of limit"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1645,6 +1711,8 @@ int cam_flash_pmic_gpio_pkt_parser( default: CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d", cmn_hdr->cmd_type); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1661,6 +1729,7 @@ int cam_flash_pmic_gpio_pkt_parser( &cmd_buf_ptr, &len_of_buffer); if (rc) { CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } @@ -1668,6 +1737,8 @@ int cam_flash_pmic_gpio_pkt_parser( (cmd_desc->offset > (len_of_buffer - sizeof(struct common_header)))) { CAM_ERR(CAM_FLASH, "Not enough buffer"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1681,6 +1752,8 @@ int cam_flash_pmic_gpio_pkt_parser( CAM_DBG(CAM_FLASH, "Widget Flash Operation"); if (remain_len < sizeof(struct cam_flash_set_on_off)) { CAM_ERR(CAM_FLASH, "Not enough buffer"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1689,12 +1762,16 @@ int cam_flash_pmic_gpio_pkt_parser( if (!flash_operation_info) { CAM_ERR(CAM_FLASH, "flash_operation_info Null"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } if (flash_operation_info->count > CAM_FLASH_MAX_LED_TRIGGERS) { CAM_ERR(CAM_FLASH, "led count out of limit"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1715,6 +1792,8 @@ int cam_flash_pmic_gpio_pkt_parser( if (rc) CAM_ERR(CAM_FLASH, "Apply setting failed: %d", rc); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } case CAMERA_SENSOR_FLASH_CMD_TYPE_QUERYCURR: { @@ -1722,6 +1801,8 @@ int cam_flash_pmic_gpio_pkt_parser( if (remain_len < sizeof(struct cam_flash_query_curr)) { CAM_ERR(CAM_FLASH, "Not enough buffer"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1744,6 +1825,8 @@ int cam_flash_pmic_gpio_pkt_parser( if (rc) { CAM_ERR(CAM_FLASH, "Query current failed with rc=%d", rc); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } flash_query_info->query_current_ma = query_curr_ma; @@ -1753,6 +1836,8 @@ int cam_flash_pmic_gpio_pkt_parser( rc = 0; if (remain_len < sizeof(struct cam_flash_set_rer)) { CAM_ERR(CAM_FLASH, "Not enough buffer"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1760,12 +1845,16 @@ int cam_flash_pmic_gpio_pkt_parser( if (!flash_rer_info) { CAM_ERR(CAM_FLASH, "flash_rer_info Null"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } if (flash_rer_info->count > CAM_FLASH_MAX_LED_TRIGGERS) { CAM_ERR(CAM_FLASH, "led count out of limit"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1790,11 +1879,15 @@ int cam_flash_pmic_gpio_pkt_parser( if (rc) CAM_ERR(CAM_FLASH, "apply_setting failed: %d", rc); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); return rc; } default: CAM_ERR(CAM_FLASH, "Wrong cmd_type : %d", cmn_hdr->cmd_type); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } @@ -1811,6 +1904,7 @@ int cam_flash_pmic_gpio_pkt_parser( "Rxed NOP packets without linking"); fctrl->per_frame[frm_offset].cmn_attr.is_settings_valid = false; + cam_mem_put_cpu_buf(config.packet_handle); return -EINVAL; } @@ -1824,6 +1918,7 @@ int cam_flash_pmic_gpio_pkt_parser( default: CAM_ERR(CAM_FLASH, "Wrong Opcode : %d", (csl_packet->header.op_code & 0xFFFFFF)); + cam_mem_put_cpu_buf(config.packet_handle); rc = -EINVAL; return rc; } diff --git a/drivers/cam_sensor_module/cam_ois/cam_ois_core.c b/drivers/cam_sensor_module/cam_ois/cam_ois_core.c index 5223f3ac2f54..5fda815b140c 100644 --- a/drivers/cam_sensor_module/cam_ois/cam_ois_core.c +++ b/drivers/cam_sensor_module/cam_ois/cam_ois_core.c @@ -460,6 +460,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) CAM_ERR(CAM_OIS, "Inval cam_packet strut size: %zu, len_of_buff: %zu", sizeof(struct cam_packet), pkt_len); + cam_mem_put_cpu_buf(dev_config.packet_handle); return -EINVAL; } @@ -470,6 +471,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (cam_packet_util_validate_packet(csl_packet, remain_len)) { CAM_ERR(CAM_OIS, "Invalid packet params"); + cam_mem_put_cpu_buf(dev_config.packet_handle); return -EINVAL; } @@ -491,11 +493,14 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (rc < 0) { CAM_ERR(CAM_OIS, "Failed to get cpu buf : 0x%x", cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } cmd_buf = (uint32_t *)generic_ptr; if (!cmd_buf) { CAM_ERR(CAM_OIS, "invalid cmd buf"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf(dev_config.packet_handle); return -EINVAL; } @@ -504,6 +509,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) sizeof(struct common_header)))) { CAM_ERR(CAM_OIS, "Invalid length for sensor cmd"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf(dev_config.packet_handle); return -EINVAL; } remain_len = len_of_buff - cmd_desc[i].offset; @@ -517,6 +524,10 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (rc < 0) { CAM_ERR(CAM_OIS, "Failed in parsing slave info"); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf( + dev_config.packet_handle); return rc; } break; @@ -531,6 +542,10 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (rc) { CAM_ERR(CAM_OIS, "Failed: parse power settings"); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf( + dev_config.packet_handle); return rc; } break; @@ -549,6 +564,10 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (rc < 0) { CAM_ERR(CAM_OIS, "init parsing failed: %d", rc); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf( + dev_config.packet_handle); return rc; } } else if ((o_ctrl->is_ois_calib != 0) && @@ -566,6 +585,10 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (rc < 0) { CAM_ERR(CAM_OIS, "Calib parsing failed: %d", rc); + cam_mem_put_cpu_buf( + cmd_desc[i].mem_handle); + cam_mem_put_cpu_buf( + dev_config.packet_handle); return rc; } } @@ -578,6 +601,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) rc = cam_ois_power_up(o_ctrl); if (rc) { CAM_ERR(CAM_OIS, " OIS Power up failed"); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } o_ctrl->cam_ois_state = CAM_OIS_CONFIG; @@ -635,6 +659,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) CAM_WARN(CAM_OIS, "Not in right state to control OIS: %d", o_ctrl->cam_ois_state); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } offset = (uint32_t *)&csl_packet->payload; @@ -648,12 +673,14 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) cmd_desc, 1, NULL); if (rc < 0) { CAM_ERR(CAM_OIS, "OIS pkt parsing failed: %d", rc); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } rc = cam_ois_apply_settings(o_ctrl, i2c_reg_settings); if (rc < 0) { CAM_ERR(CAM_OIS, "Cannot apply mode settings"); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } @@ -661,6 +688,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (rc < 0) { CAM_ERR(CAM_OIS, "Fail deleting Mode data: rc: %d", rc); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } break; @@ -673,6 +701,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) CAM_WARN(CAM_OIS, "Not in right state to read OIS: %d", o_ctrl->cam_ois_state); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } CAM_DBG(CAM_OIS, "number of I/O configs: %d:", @@ -680,6 +709,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (csl_packet->num_io_configs == 0) { CAM_ERR(CAM_OIS, "No I/O configs to process"); rc = -EINVAL; + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } @@ -692,6 +722,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (io_cfg == NULL) { CAM_ERR(CAM_OIS, "I/O config is invalid(NULL)"); rc = -EINVAL; + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } @@ -705,6 +736,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) cmd_desc, 1, io_cfg); if (rc < 0) { CAM_ERR(CAM_OIS, "OIS read pkt parsing failed: %d", rc); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } @@ -714,6 +746,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (rc < 0) { CAM_ERR(CAM_OIS, "cannot read data rc: %d", rc); delete_request(&i2c_read_settings); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } @@ -721,6 +754,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) if (rc < 0) { CAM_ERR(CAM_OIS, "Failed in deleting the read settings"); + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; } break; @@ -728,13 +762,16 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) default: CAM_ERR(CAM_OIS, "Invalid Opcode: %d", (csl_packet->header.op_code & 0xFFFFFF)); + cam_mem_put_cpu_buf(dev_config.packet_handle); return -EINVAL; } - cam_mem_put_cpu_buf(dev_config.packet_handle); - if (!rc) + if (!rc) { + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; + } pwr_dwn: + cam_mem_put_cpu_buf(dev_config.packet_handle); cam_ois_power_down(o_ctrl); return rc; } diff --git a/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c b/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c index bdf8cacac506..4ada916ac77c 100644 --- a/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c +++ b/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c @@ -637,6 +637,7 @@ int32_t cam_handle_mem_ptr(uint64_t handle, struct cam_sensor_ctrl_t *s_ctrl) if (cmd_desc[i].offset >= len) { CAM_ERR(CAM_SENSOR, "offset past length of buffer"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); rc = -EINVAL; goto end; } @@ -644,6 +645,7 @@ int32_t cam_handle_mem_ptr(uint64_t handle, struct cam_sensor_ctrl_t *s_ctrl) if (cmd_desc[i].length > remain_len) { CAM_ERR(CAM_SENSOR, "Not enough buffer provided for cmd"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); rc = -EINVAL; goto end; } @@ -656,6 +658,7 @@ int32_t cam_handle_mem_ptr(uint64_t handle, struct cam_sensor_ctrl_t *s_ctrl) if (rc < 0) { CAM_ERR(CAM_SENSOR, "Failed to parse the command Buffer Header"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); goto end; } cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); diff --git a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c index 0f1265499f2f..d2b4e65687c3 100644 --- a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c +++ b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c @@ -264,6 +264,7 @@ static int32_t cam_sensor_get_io_buffer( CAM_ERR(CAM_SENSOR, "invalid size:io_cfg->offsets[0]: %d, buf_size: %d", io_cfg->offsets[0], buf_size); + cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); return -EINVAL; } i2c_settings->read_buff = @@ -459,6 +460,7 @@ int cam_sensor_i2c_command_parser( remain_len -= cmd_desc[i].offset; if (remain_len < cmd_desc[i].length) { CAM_ERR(CAM_SENSOR, "buffer provided too small"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); return -EINVAL; }