diff options
authorSanjay Singh <>2018-09-17 11:28:23 +0530
committerGerrit - the friendly Code Review server <code-review@localhost>2018-09-16 23:01:37 -0700
commitf2489454258456e27f74b6f18c3ee0b15c9cac0e (patch)
parent7dffb567cd2d32057a30169803a6592b240304b4 (diff)
msm: vidc: do not set video state to DEINIT very early
If video state set to DEINIT before processing all frame done packets in the list may create video failures as explained below, the client communication to video hardware will fail because of DEINIT state and client will close the session upon failure which will happen in parallel to response thread processing the response packets in the list. It may happen that client already free'd the buffer references and response thread might access the same buffer reference and results in use-after-free memory fault. So In case of sys error from video hardware, set video state to DEINIT after processing all packets in the list to avoid use-after-free failure. Change-Id: Id44c26b1bbfc49e9725bf70e21a3e861a04d0133 Signed-off-by: Maheshwar Ajja <> Signed-off-by: Sanjay Singh <>
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/media/platform/msm/vidc_3x/venus_hfi.c b/drivers/media/platform/msm/vidc_3x/venus_hfi.c
index b83606a..c385088 100644
--- a/drivers/media/platform/msm/vidc_3x/venus_hfi.c
+++ b/drivers/media/platform/msm/vidc_3x/venus_hfi.c
@@ -1587,7 +1587,7 @@ static int __iface_cmdq_write_relaxed(struct venus_hfi_device *device,
if (!__core_in_valid_state(device)) {
- dprintk(VIDC_DBG, "%s - fw not in init state\n", __func__);
+ dprintk(VIDC_ERR, "%s - fw not in init state\n", __func__);
result = -EINVAL;
goto err_q_null;
@@ -3337,8 +3337,6 @@ static void __process_sys_error(struct venus_hfi_device *device)
struct hfi_sfr_struct *vsfr = NULL;
- __set_state(device, VENUS_STATE_DEINIT);
/* Once SYS_ERROR received from HW, it is safe to halt the AXI.
* With SYS_ERROR, Venus FW may have crashed and HW might be
* active and causing unnecessary transactions. Hence it is
@@ -3581,6 +3579,9 @@ static int __response_handler(struct venus_hfi_device *device)
"Too many packets in message queue to handle at once, deferring read\n");
+ /* do not read packets after sys error packet */
+ if (info->response_type == HAL_SYS_ERROR)
+ break;
if (requeue_pm_work && device->res->sw_power_collapsible) {