Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

msm: vidc: Fix various NULL pointer accesses, memory leaks.

Browse source 
This commit fixes various NULL pointer and memory leak bugs.

Change-Id: I3b3ac40b5e440b9665858913921a06de14741b6f
Signed-off-by: Rajeshwar Kurapaty <rkurapat@codeaurora.org>
This commit is contained in:
Rajeshwar Kurapaty 2013-01-04 16:41:11 -08:00 committed by Iliyan Malchev
parent a23c5fe56c
commit 43fb8e6e05
10 changed files with 38 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/video/msm/vidc/1080p/ddl/vcd_ddl.c
View file

@ -471,8 +471,6 @@ u32 ddl_encode_frame(u32 *ddl_handle,
struct ddl_encoder_data *encoder =
&ddl->codec_data.encoder;
u32 vcd_status = VCD_S_SUCCESS;
struct vcd_transc *transc;
transc = (struct vcd_transc *)(ddl->client_data);
DDL_MSG_LOW("%s: transc = 0x%x", __func__, (u32)ddl->client_data);
if (encoder->slice_delivery_info.enable) {
return ddl_encode_frame_batch(ddl_handle,

2
drivers/video/msm/vidc/1080p/ddl/vcd_ddl_helper.c
View file

@ -505,6 +505,8 @@ u32 ddl_get_yuv_buf_size(u32 width, u32 height, u32 format)
width_round_up = width;
height_round_up = height;
align = SZ_4K;
if (format == DDL_YUV_BUF_TYPE_TILE) {
width_round_up = DDL_ALIGN(width, DDL_TILE_ALIGN_WIDTH);
height_round_up = DDL_ALIGN(height, DDL_TILE_ALIGN_HEIGHT);

4
drivers/video/msm/vidc/1080p/ddl/vcd_ddl_interrupt_handler.c
View file

@ -1810,8 +1810,10 @@ static void ddl_handle_slice_done_slice_batch(struct ddl_client_context *ddl)
slice_output = (struct vidc_1080p_enc_slice_batch_out_param *)
(encoder->batch_frame.slice_batch_out.align_virtual_addr);
DDL_MSG_LOW(" after get no of slices = %d\n", num_slices_comp);
if (slice_output == NULL)
if (slice_output == NULL) {
DDL_MSG_ERROR(" slice_output is NULL\n");
return; /* Bail out */
}
encoder->slice_delivery_info.num_slices_enc += num_slices_comp;
if (vidc_msg_timing) {
ddl_calc_core_proc_time_cnt(__func__, ENC_SLICE_OP_TIME,

10
drivers/video/msm/vidc/1080p/resource_tracker/vcd_res_tracker.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2010-2012, Code Aurora Forum. All rights reserved.
/* Copyright (c) 2010-2013, Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -160,9 +160,15 @@ ion_bail_out:
static void res_trk_pmem_free(struct ddl_buf_addr *addr)
{
struct ddl_context *ddl_context;
if (!addr) {
DDL_MSG_ERROR("\n%s() NULL address", __func__);
return;
}
ddl_context = ddl_get_context();
if (ddl_context->video_ion_client) {
if (addr && addr->alloc_handle) {
if (addr->alloc_handle) {
ion_free(ddl_context->video_ion_client,
addr->alloc_handle);
addr->alloc_handle = NULL;

2
drivers/video/msm/vidc/common/dec/vdec.c
View file

@ -2485,7 +2485,7 @@ int vid_dec_open_client(struct video_client_ctx **vid_clnt_ctx, int flags)
}
client_index = vid_dec_get_empty_client_index();
if (client_index == -1) {
if (client_index < 0) {
ERR("%s() : No free clients client_index == -1\n", __func__);
rc = -ENOMEM;
goto client_failure;

4
drivers/video/msm/vidc/common/enc/venc.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2010-2012, The Linux Foundation. All rights reserved.
/* Copyright (c) 2010-2013, Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -550,7 +550,7 @@ static int vid_enc_open_client(struct video_client_ctx **vid_clnt_ctx,
client_index = vid_enc_get_empty_client_index();
if (client_index == -1) {
if (client_index < 0) {
ERR("%s() : No free clients client_index == -1\n",
__func__);
rc = -ENODEV;

1
drivers/video/msm/vidc/common/vcd/vcd_client_sm.c
View file

@ -1622,6 +1622,7 @@ void vcd_do_client_state_transition(struct vcd_clnt_ctxt *cctxt,
if (!cctxt || to_state >= VCD_CLIENT_STATE_MAX) {
VCD_MSG_ERROR("Bad parameters. cctxt=%p, to_state=%d",
cctxt, to_state);
return;
}
state_ctxt = &cctxt->clnt_state;

3
drivers/video/msm/vidc/common/vcd/vcd_device_sm.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2010-2012, Code Aurora Forum. All rights reserved.
/* Copyright (c) 2010-2013, Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -36,6 +36,7 @@ void vcd_do_device_state_transition(struct vcd_drv_ctxt *drv_ctxt,
if (!drv_ctxt || to_state >= VCD_DEVICE_STATE_MAX) {
VCD_MSG_ERROR("Bad parameters. drv_ctxt=%p, to_state=%d",
drv_ctxt, to_state);
return;
}
state_ctxt = &drv_ctxt->dev_state;

19
drivers/video/msm/vidc/common/vcd/vcd_scheduler.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2010-2012, Code Aurora Forum. All rights reserved.
/* Copyright (c) 2010-2013, Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -88,8 +88,13 @@ u32 vcd_sched_add_client(struct vcd_clnt_ctxt *cctxt)
prop_hdr.sz = sizeof(cctxt->frm_p_units);
rc = ddl_get_property(cctxt->ddl_handle, &prop_hdr,
&cctxt->frm_p_units);
VCD_FAILED_RETURN(rc,
"Failed: Get DDL_I_FRAME_PROC_UNITS");
if (VCD_FAILED(rc)) {
kfree(sched_cctxt);
VCD_MSG_ERROR(
"Failed: Get DDL_I_FRAME_PROC_UNITS");
return rc;
}
if (cctxt->decoding) {
cctxt->frm_rate.fps_numerator =
VCD_DEC_INITIAL_FRAME_RATE;
@ -99,8 +104,12 @@ u32 vcd_sched_add_client(struct vcd_clnt_ctxt *cctxt)
prop_hdr.sz = sizeof(cctxt->frm_rate);
rc = ddl_get_property(cctxt->ddl_handle,
&prop_hdr, &cctxt->frm_rate);
VCD_FAILED_RETURN(rc,
"Failed: Get VCD_I_FRAME_RATE");
if (VCD_FAILED(rc)) {
kfree(sched_cctxt);
VCD_MSG_ERROR(
"Failed: Get VCD_I_FRAME_RATE");
return rc;
}
}
if (!cctxt->perf_set_by_client)
cctxt->reqd_perf_lvl = cctxt->frm_p_units *

5
drivers/video/msm/vidc/common/vcd/vcd_sub.c
View file

@ -1985,6 +1985,11 @@ u32 vcd_handle_input_done(
orig_frame = vcd_find_buffer_pool_entry(&cctxt->in_buf_pool,
transc->ip_buf_entry->virtual);
if (!orig_frame) {
rc = VCD_ERR_ILLEGAL_PARM;
VCD_FAILED_RETURN(rc, "Couldn't find buffer");
}
if ((transc->ip_buf_entry->frame.virtual !=
frame->vcd_frm.virtual)
|| !transc->ip_buf_entry->in_use) {