msm:camera:lrme: Fix LRME context Ref Count leak
LRME ref count is not done properly. It will lead to context ref
count leak.
This change prevents ref count leak by checking refcount value before
decrementing the ref count. It is making sure the ref count never goes
below zero.
Change-Id: Ie6927eb7465ec656cdc959a39fbefe79dcc511fa
Signed-off-by: Chandan Kumar Jha <cjha@codeaurora.org>
diff --git a/drivers/media/platform/msm/camera/cam_core/cam_context.c b/drivers/media/platform/msm/camera/cam_core/cam_context.c
index 8a3dbba..36c2fb0 100644
--- a/drivers/media/platform/msm/camera/cam_core/cam_context.c
+++ b/drivers/media/platform/msm/camera/cam_core/cam_context.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -500,7 +500,12 @@
void cam_context_putref(struct cam_context *ctx)
{
- kref_put(&ctx->refcount, cam_node_put_ctxt_to_free_list);
+ if (atomic_read(&(ctx->refcount.refcount)))
+ kref_put(&ctx->refcount, cam_node_put_ctxt_to_free_list);
+ else
+ WARN(1, "ctx %s %d state %d devhdl %X\n", ctx->dev_name,
+ ctx->ctx_id, ctx->state, ctx->dev_hdl);
+
CAM_DBG(CAM_CORE,
"ctx device hdl %ld, ref count %d, dev_name %s",
ctx->dev_hdl, atomic_read(&(ctx->refcount.refcount)),
diff --git a/drivers/media/platform/msm/camera/cam_sync/cam_sync.c b/drivers/media/platform/msm/camera/cam_sync/cam_sync.c
index c9e6e5f..26224b4 100644
--- a/drivers/media/platform/msm/camera/cam_sync/cam_sync.c
+++ b/drivers/media/platform/msm/camera/cam_sync/cam_sync.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -156,7 +156,7 @@
"Error: accessing an uninitialized sync obj = %d",
sync_obj);
spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
- return -EINVAL;
+ return 0;
}
CAM_DBG(CAM_SYNC, "deregistered callback for sync object:%d",