mm-video-v4l2: venc: Protect buffer from being freed while accessing am: 0008e21211 am: c0f642a22f
am: 979b0e6864
Change-Id: I2faf25ea66357a2444cf2f26b195e811c1d28c03
diff --git a/msm8974/mm-video-v4l2/vidc/venc/inc/omx_video_base.h b/msm8974/mm-video-v4l2/vidc/venc/inc/omx_video_base.h
index e75bfcb..025ea19 100644
--- a/msm8974/mm-video-v4l2/vidc/venc/inc/omx_video_base.h
+++ b/msm8974/mm-video-v4l2/vidc/venc/inc/omx_video_base.h
@@ -1,5 +1,5 @@
/*--------------------------------------------------------------------------
-Copyright (c) 2010-2016, The Linux Foundation. All rights reserved.
+Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
@@ -636,6 +636,7 @@
omx_cmd_queue m_opq_meta_q;
omx_cmd_queue m_opq_pmem_q;
OMX_BUFFERHEADERTYPE meta_buffer_hdr[MAX_NUM_INPUT_BUFFERS];
+ pthread_mutex_t m_buf_lock;
bool input_flush_progress;
bool output_flush_progress;
diff --git a/msm8974/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp b/msm8974/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp
index b202b6f..07eb24d 100644
--- a/msm8974/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp
+++ b/msm8974/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp
@@ -1,5 +1,5 @@
/*--------------------------------------------------------------------------
-Copyright (c) 2010-2016, Linux Foundation. All rights reserved.
+Copyright (c) 2010-2017, Linux Foundation. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
@@ -257,6 +257,7 @@
pthread_mutex_init(&m_lock, NULL);
sem_init(&m_cmd_lock,0,0);
DEBUG_PRINT_LOW("meta_buffer_hdr = %p", meta_buffer_hdr);
+ pthread_mutex_init(&m_buf_lock, NULL);
}
@@ -292,6 +293,7 @@
sem_destroy(&m_cmd_lock);
DEBUG_PRINT_HIGH("m_etb_count = %" PRIu64 ", m_fbd_count = %" PRIu64, m_etb_count,
m_fbd_count);
+ pthread_mutex_destroy(&m_buf_lock);
DEBUG_PRINT_HIGH("omx_video: Destructor exit");
DEBUG_PRINT_HIGH("Exiting OMX Video Encoder ...");
}
@@ -2369,6 +2371,7 @@
return OMX_ErrorBadParameter;
}
+ auto_lock l(m_buf_lock);
if (!m_out_mem_ptr) {
output_use_buffer = true;
int nBufHdrSize = 0;
@@ -3284,6 +3287,7 @@
nPortIndex, (unsigned int)m_sOutPortDef.nBufferCountActual);
if (nPortIndex < m_sOutPortDef.nBufferCountActual &&
BITMASK_PRESENT(&m_out_bm_count, nPortIndex)) {
+ auto_lock l(m_buf_lock);
// Clear the bit associated with it.
BITMASK_CLEAR(&m_out_bm_count,nPortIndex);
m_sOutPortDef.bPopulated = OMX_FALSE;
diff --git a/msm8974/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp b/msm8974/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp
index 047273a..ed63fb9 100644
--- a/msm8974/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp
+++ b/msm8974/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp
@@ -1,5 +1,5 @@
/*--------------------------------------------------------------------------
-Copyright (c) 2010-2014, The Linux Foundation. All rights reserved.
+Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
@@ -2255,11 +2255,18 @@
OMX_COMPONENT_GENERATE_EBD);
break;
case VEN_MSG_OUTPUT_BUFFER_DONE:
+ {
omxhdr = (OMX_BUFFERHEADERTYPE*)m_sVenc_msg->buf.clientdata;
+ OMX_U32 bufIndex = (OMX_U32)(omxhdr - omx->m_out_mem_ptr);
if ( (omxhdr != NULL) &&
- ((OMX_U32)(omxhdr - omx->m_out_mem_ptr) < omx->m_sOutPortDef.nBufferCountActual)) {
- if (m_sVenc_msg->buf.len <= omxhdr->nAllocLen) {
+ (bufIndex < omx->m_sOutPortDef.nBufferCountActual)) {
+ auto_lock l(omx->m_buf_lock);
+ if (BITMASK_ABSENT(&(omx->m_out_bm_count), bufIndex)) {
+ DEBUG_PRINT_ERROR("Recieved FBD for buffer that is already freed !");
+ break;
+ }
+ if (!omx->is_secure_session() && (m_sVenc_msg->buf.len <= omxhdr->nAllocLen)) {
omxhdr->nFilledLen = m_sVenc_msg->buf.len;
omxhdr->nOffset = m_sVenc_msg->buf.offset;
omxhdr->nTimeStamp = m_sVenc_msg->buf.timestamp;
@@ -2284,6 +2291,7 @@
omx->post_event ((unsigned long)omxhdr,m_sVenc_msg->statuscode,
OMX_COMPONENT_GENERATE_FBD);
break;
+ }
case VEN_MSG_NEED_OUTPUT_BUFFER:
//TBD what action needs to be done here??
break;
