In the irq handler 'rkisp1_params_isr', the lock 'config_lock'
should be held as long as the current buffer is used. Otherwise the
stop_streaming calback might remove it from the list and
pass it to userspace while it is referenced in the irq handler.
Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
Acked-by: Helen Koike <helen.koike@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
if (!list_empty(¶ms->params))
cur_buf = list_first_entry(¶ms->params,
struct rkisp1_buffer, queue);
if (!list_empty(¶ms->params))
cur_buf = list_first_entry(¶ms->params,
struct rkisp1_buffer, queue);
- spin_unlock(¶ms->config_lock);
+ if (!cur_buf) {
+ spin_unlock(¶ms->config_lock);
new_params = (struct rkisp1_params_cfg *)(cur_buf->vaddr);
new_params = (struct rkisp1_params_cfg *)(cur_buf->vaddr);
/* update shadow register immediately */
rkisp1_param_set_bits(params, RKISP1_CIF_ISP_CTRL, RKISP1_CIF_ISP_CTRL_ISP_CFG_UPD);
/* update shadow register immediately */
rkisp1_param_set_bits(params, RKISP1_CIF_ISP_CTRL, RKISP1_CIF_ISP_CTRL_ISP_CFG_UPD);
- spin_lock(¶ms->config_lock);
list_del(&cur_buf->queue);
list_del(&cur_buf->queue);
- spin_unlock(¶ms->config_lock);
cur_buf->vb.sequence = frame_sequence;
vb2_buffer_done(&cur_buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
cur_buf->vb.sequence = frame_sequence;
vb2_buffer_done(&cur_buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
+ spin_unlock(¶ms->config_lock);
}
static const struct rkisp1_cif_isp_awb_meas_config rkisp1_awb_params_default_config = {
}
static const struct rkisp1_cif_isp_awb_meas_config rkisp1_awb_params_default_config = {