mm-video: vidc: stability fixes in decoder
Do not unmap output handles in dynamic buffer mode when
buffers are freed (since they are unmapped already in FBD).
Change-Id: I3ff2d91a3aebb7ca4f574150dda34cf4314e02ab
diff --git a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
index f0e5a91..3176d86 100644
--- a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
+++ b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
@@ -3914,6 +3914,7 @@
munmap((void *)drv_ctx.extradata_info.uaddr, drv_ctx.extradata_info.size);
close(drv_ctx.extradata_info.ion.fd_ion_data.fd);
free_ion_memory(&drv_ctx.extradata_info.ion);
+ memset(&drv_ctx.extradata_info, 0, sizeof(drv_ctx.extradata_info));
}
drv_ctx.extradata_info.size = (drv_ctx.extradata_info.size + 4095) & (~4095);
drv_ctx.extradata_info.ion.ion_device_fd = alloc_map_ion_memory(
@@ -4427,36 +4428,39 @@
setbuffers.buffer_type = VDEC_BUFFER_TYPE_OUTPUT;
memcpy (&setbuffers.buffer,&drv_ctx.ptr_outputbuffer[index],
sizeof (vdec_bufferpayload));
+
+ if (!dynamic_buf_mode) {
#ifdef _ANDROID_
- if (m_enable_android_native_buffers) {
- if (!secure_mode) {
- if (drv_ctx.ptr_outputbuffer[index].pmem_fd > 0) {
- munmap(drv_ctx.ptr_outputbuffer[index].bufferaddr,
- drv_ctx.ptr_outputbuffer[index].mmaped_size);
- }
- }
- drv_ctx.ptr_outputbuffer[index].pmem_fd = -1;
- } else {
-#endif
- if (drv_ctx.ptr_outputbuffer[0].pmem_fd > 0 && !ouput_egl_buffers && !m_use_output_pmem) {
+ if (m_enable_android_native_buffers) {
if (!secure_mode) {
- DEBUG_PRINT_LOW("unmap the output buffer fd = %d",
- drv_ctx.ptr_outputbuffer[0].pmem_fd);
- DEBUG_PRINT_LOW("unmap the ouput buffer size=%d address = %p",
- drv_ctx.ptr_outputbuffer[0].mmaped_size * drv_ctx.op_buf.actualcount,
- drv_ctx.ptr_outputbuffer[0].bufferaddr);
- munmap (drv_ctx.ptr_outputbuffer[0].bufferaddr,
- drv_ctx.ptr_outputbuffer[0].mmaped_size * drv_ctx.op_buf.actualcount);
+ if (drv_ctx.ptr_outputbuffer[index].pmem_fd > 0) {
+ munmap(drv_ctx.ptr_outputbuffer[index].bufferaddr,
+ drv_ctx.ptr_outputbuffer[index].mmaped_size);
+ }
}
- close (drv_ctx.ptr_outputbuffer[0].pmem_fd);
- drv_ctx.ptr_outputbuffer[0].pmem_fd = -1;
+ drv_ctx.ptr_outputbuffer[index].pmem_fd = -1;
+ } else {
+#endif
+ if (drv_ctx.ptr_outputbuffer[0].pmem_fd > 0 && !ouput_egl_buffers && !m_use_output_pmem) {
+ if (!secure_mode) {
+ DEBUG_PRINT_LOW("\n unmap the output buffer fd = %d",
+ drv_ctx.ptr_outputbuffer[0].pmem_fd);
+ DEBUG_PRINT_LOW("\n unmap the ouput buffer size=%d address = %p",
+ drv_ctx.ptr_outputbuffer[0].mmaped_size * drv_ctx.op_buf.actualcount,
+ drv_ctx.ptr_outputbuffer[0].bufferaddr);
+ munmap (drv_ctx.ptr_outputbuffer[0].bufferaddr,
+ drv_ctx.ptr_outputbuffer[0].mmaped_size * drv_ctx.op_buf.actualcount);
+ }
+ close (drv_ctx.ptr_outputbuffer[0].pmem_fd);
+ drv_ctx.ptr_outputbuffer[0].pmem_fd = -1;
#ifdef USE_ION
- free_ion_memory(&drv_ctx.op_buf_ion_info[0]);
+ free_ion_memory(&drv_ctx.op_buf_ion_info[0]);
#endif
- }
+ }
#ifdef _ANDROID_
- }
+ }
#endif
+ } //!dynamic_buf_mode
if (release_output_done()) {
free_extradata();
}
@@ -8025,6 +8029,11 @@
int enable = 0;
OMX_U32 mbaff = 0;
int buf_index = p_buf_hdr - m_out_mem_ptr;
+ if (buf_index >= drv_ctx.extradata_info.count) {
+ DEBUG_PRINT_ERROR("handle_extradata: invalid index(%d) max(%d)",
+ buf_index, drv_ctx.extradata_info.count);
+ return;
+ }
struct msm_vidc_panscan_window_payload *panscan_payload = NULL;
OMX_U8 *pBuffer = (OMX_U8 *)(drv_ctx.ptr_outputbuffer[buf_index].bufferaddr) +
p_buf_hdr->nOffset;