Revert "mm-video-v4l2: venc: Avoid buffer access after free"
This reverts commit cdb855bdd19c9160312195b3a2bfdd72460d281e.
Bug: 36130225
Bug: 67670457
Merged-In: I9f2ba9a9b10fc149d567f19ae8feacf2f1e1df27
diff --git a/msm8998/mm-video-v4l2/vidc/venc/inc/omx_video_base.h b/msm8998/mm-video-v4l2/vidc/venc/inc/omx_video_base.h
index b69d284..41ad538 100644
--- a/msm8998/mm-video-v4l2/vidc/venc/inc/omx_video_base.h
+++ b/msm8998/mm-video-v4l2/vidc/venc/inc/omx_video_base.h
@@ -699,7 +699,6 @@
bool allocate_native_handle;
uint64_t m_out_bm_count;
- uint64_t m_client_out_bm_count;
uint64_t m_inp_bm_count;
uint64_t m_flags;
uint64_t m_etb_count;
diff --git a/msm8998/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp b/msm8998/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp
index 22dbf65..3e7d489 100644
--- a/msm8998/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp
+++ b/msm8998/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp
@@ -297,7 +297,6 @@
pending_input_buffers(0),
pending_output_buffers(0),
m_out_bm_count(0),
- m_client_out_bm_count(0),
m_inp_bm_count(0),
m_flags(0),
m_etb_count(0),
@@ -2898,7 +2897,6 @@
}
BITMASK_SET(&m_out_bm_count,i);
- BITMASK_SET(&m_client_out_bm_count,i);
} else {
DEBUG_PRINT_ERROR("ERROR: All o/p Buffers have been Used, invalid use_buf call for "
"index = %u", i);
@@ -2936,8 +2934,6 @@
DEBUG_PRINT_ERROR("ERROR: Use Buffer in Invalid State");
return OMX_ErrorInvalidState;
}
-
- auto_lock l(m_buf_lock);
if (port == PORT_INDEX_IN) {
eRet = use_input_buffer(hComp,bufferHdr,port,appData,bytes,buffer);
} else if (port == PORT_INDEX_OUT) {
@@ -2946,6 +2942,7 @@
DEBUG_PRINT_ERROR("ERROR: Invalid Port Index received %d",(int)port);
eRet = OMX_ErrorBadPortIndex;
}
+
if (eRet == OMX_ErrorNone) {
if (allocate_done()) {
if (BITMASK_PRESENT(&m_flags,OMX_COMPONENT_IDLE_PENDING)) {
@@ -3008,6 +3005,7 @@
}
if (index < m_sInPortDef.nBufferCountActual && m_pInput_pmem) {
+ auto_lock l(m_lock);
if (m_pInput_pmem[index].fd > 0 && input_use_buffer == false) {
DEBUG_PRINT_LOW("FreeBuffer:: i/p AllocateBuffer case");
@@ -3551,7 +3549,7 @@
DEBUG_PRINT_ERROR("ERROR: Allocate Buf in Invalid State");
return OMX_ErrorInvalidState;
}
- auto_lock l(m_buf_lock);
+
// What if the client calls again.
if (port == PORT_INDEX_IN) {
#ifdef _ANDROID_ICS_
@@ -3622,12 +3620,7 @@
unsigned int nPortIndex;
DEBUG_PRINT_LOW("In for encoder free_buffer");
- auto_lock l(m_buf_lock);
- if (port == PORT_INDEX_OUT) { //client called freebuffer, clearing client buffer bitmask right away to avoid use after free
- nPortIndex = buffer - (OMX_BUFFERHEADERTYPE*)m_out_mem_ptr;
- if(BITMASK_PRESENT(&m_client_out_bm_count, nPortIndex))
- BITMASK_CLEAR(&m_client_out_bm_count,nPortIndex);
- }
+
if (m_state == OMX_StateIdle &&
(BITMASK_PRESENT(&m_flags ,OMX_COMPONENT_LOADING_PENDING))) {
DEBUG_PRINT_LOW(" free buffer while Component in Loading pending");
@@ -3984,7 +3977,7 @@
{
DEBUG_PRINT_LOW("Heap UseBuffer case, so memcpy the data");
- auto_lock l(m_buf_lock);
+ auto_lock l(m_lock);
pmem_data_buf = (OMX_U8 *)m_pInput_pmem[nBufIndex].buffer;
if (pmem_data_buf) {
memcpy (pmem_data_buf, (buffer->pBuffer + buffer->nOffset),
diff --git a/msm8998/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp b/msm8998/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp
index 33410a9..9974467 100644
--- a/msm8998/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp
+++ b/msm8998/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp
@@ -2308,15 +2308,11 @@
DEBUG_PRINT_ERROR("WARNING:Rxd DeInit,OMX not in LOADED state %d",\
m_state);
}
-
- auto_lock l(m_buf_lock);
if (m_out_mem_ptr) {
DEBUG_PRINT_LOW("Freeing the Output Memory");
for (i=0; i< m_sOutPortDef.nBufferCountActual; i++ ) {
if (BITMASK_PRESENT(&m_out_bm_count, i)) {
BITMASK_CLEAR(&m_out_bm_count, i);
- if (BITMASK_PRESENT(&m_client_out_bm_count, i))
- BITMASK_CLEAR(&m_client_out_bm_count, i);
free_output_buffer (&m_out_mem_ptr[i]);
}
@@ -2681,8 +2677,7 @@
omxhdr->nFlags = m_sVenc_msg->buf.flags;
/*Use buffer case*/
- if (BITMASK_PRESENT(&(omx->m_client_out_bm_count), bufIndex) &&
- omx->output_use_buffer && !omx->m_use_output_pmem && !omx->is_secure_session()) {
+ if (omx->output_use_buffer && !omx->m_use_output_pmem && !omx->is_secure_session()) {
DEBUG_PRINT_LOW("memcpy() for o/p Heap UseBuffer");
memcpy(omxhdr->pBuffer,
(m_sVenc_msg->buf.ptrbuffer),
