lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20221003070830.23697-2-moudy.ho@mediatek.com> Date: Mon, 3 Oct 2022 15:08:29 +0800 From: Moudy Ho <moudy.ho@...iatek.com> To: Mauro Carvalho Chehab <mchehab@...nel.org>, Matthias Brugger <matthias.bgg@...il.com>, Hans Verkuil <hverkuil-cisco@...all.nl> CC: Chun-Kuang Hu <chunkuang.hu@...nel.org>, <linux-media@...r.kernel.org>, <linux-mediatek@...ts.infradead.org>, <linux-kernel@...r.kernel.org>, <Project_Global_Chrome_Upstream_Group@...iatek.com>, Moudy Ho <moudy.ho@...iatek.com> Subject: [PATCH v2 1/2] media: platform: mtk-mdp3: fix error handling in mdp_cmdq_send() Increase and refine the goto label in mdp_cmdq_send() to avoid double free and facilitate traceability. Also, remove redundant work queue event in blocking function mdp_cmdq_send(). Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") Signed-off-by: Moudy Ho <moudy.ho@...iatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com> --- .../platform/mediatek/mdp3/mtk-mdp3-cmdq.c | 47 ++++++++++--------- 1 file changed, 26 insertions(+), 21 deletions(-) diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c index 86c054600a08..e194dec8050a 100644 --- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c +++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c @@ -252,10 +252,9 @@ static int mdp_cmdq_pkt_create(struct cmdq_client *client, struct cmdq_pkt *pkt, dma_addr_t dma_addr; pkt->va_base = kzalloc(size, GFP_KERNEL); - if (!pkt->va_base) { - kfree(pkt); + if (!pkt->va_base) return -ENOMEM; - } + pkt->buf_size = size; pkt->cl = (void *)client; @@ -368,25 +367,30 @@ int mdp_cmdq_send(struct mdp_dev *mdp, struct mdp_cmdq_param *param) cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); if (!cmd) { ret = -ENOMEM; - goto err_cmdq_data; + goto err_cancel_job; } - if (mdp_cmdq_pkt_create(mdp->cmdq_clt, &cmd->pkt, SZ_16K)) { - ret = -ENOMEM; - goto err_cmdq_data; - } + ret = mdp_cmdq_pkt_create(mdp->cmdq_clt, &cmd->pkt, SZ_16K); + if (ret) + goto err_free_cmd; comps = kcalloc(param->config->num_components, sizeof(*comps), GFP_KERNEL); if (!comps) { ret = -ENOMEM; - goto err_cmdq_data; + goto err_destroy_pkt; } path = kzalloc(sizeof(*path), GFP_KERNEL); if (!path) { ret = -ENOMEM; - goto err_cmdq_data; + goto err_free_comps; + } + + ret = mtk_mutex_prepare(mdp->mdp_mutex[MDP_PIPE_RDMA0]); + if (ret) { + dev_err(dev, "Fail to enable mutex clk\n"); + goto err_free_path; } path->mdp_dev = mdp; @@ -406,15 +410,13 @@ int mdp_cmdq_send(struct mdp_dev *mdp, struct mdp_cmdq_param *param) ret = mdp_path_ctx_init(mdp, path); if (ret) { dev_err(dev, "mdp_path_ctx_init error\n"); - goto err_cmdq_data; + goto err_free_path; } - mtk_mutex_prepare(mdp->mdp_mutex[MDP_PIPE_RDMA0]); - ret = mdp_path_config(mdp, cmd, path); if (ret) { dev_err(dev, "mdp_path_config error\n"); - goto err_cmdq_data; + goto err_free_path; } cmdq_pkt_finalize(&cmd->pkt); @@ -433,7 +435,7 @@ int mdp_cmdq_send(struct mdp_dev *mdp, struct mdp_cmdq_param *param) ret = mdp_comp_clocks_on(&mdp->pdev->dev, cmd->comps, cmd->num_comps); if (ret) { dev_err(dev, "comp %d failed to enable clock!\n", ret); - goto err_clock_off; + goto err_free_path; } dma_sync_single_for_device(mdp->cmdq_clt->chan->mbox->dev, @@ -450,17 +452,20 @@ int mdp_cmdq_send(struct mdp_dev *mdp, struct mdp_cmdq_param *param) return 0; err_clock_off: - mtk_mutex_unprepare(mdp->mdp_mutex[MDP_PIPE_RDMA0]); mdp_comp_clocks_off(&mdp->pdev->dev, cmd->comps, cmd->num_comps); -err_cmdq_data: +err_free_path: + mtk_mutex_unprepare(mdp->mdp_mutex[MDP_PIPE_RDMA0]); kfree(path); - atomic_dec(&mdp->job_count); - wake_up(&mdp->callback_wq); - if (cmd && cmd->pkt.buf_size > 0) - mdp_cmdq_pkt_destroy(&cmd->pkt); +err_free_comps: kfree(comps); +err_destroy_pkt: + mdp_cmdq_pkt_destroy(&cmd->pkt); +err_free_cmd: kfree(cmd); +err_cancel_job: + atomic_dec(&mdp->job_count); + return ret; } EXPORT_SYMBOL_GPL(mdp_cmdq_send); -- 2.18.0
Powered by blists - more mailing lists