decoder: CB1 fix some crash in peek. [1/1]

PD#SWPL-58570

Problem:
When fifo is abnormal, the back-end peek to the wrong data crash.

Solution:
Check whether the fifo is abnormal and return empty when abnormal.

Verify:
adt3

Change-Id: Ie84d4bae905094790af13271ad7bdee9f94ff254
Signed-off-by: gan.zhang <gan.zhang@amlogic.com>

diff --git a/drivers/frame_provider/decoder/avs2/vavs2.c b/drivers/frame_provider/decoder/avs2/vavs2.c
index 3bad1ebccc839b6047e338f2fa34211a85b72f21..1ec012da69297120bb3e1935445200b71ce07bf5 100644 (file)
--- a/drivers/frame_provider/decoder/avs2/vavs2.c
+++ b/drivers/frame_provider/decoder/avs2/vavs2.c
@@ -4206,6 +4206,13 @@ static struct vframe_s *vavs2_vf_peek(void *op_arg)
                return &dec->vframe_dummy;
        }
 
+       if (kfifo_len(&dec->display_q) > VF_POOL_SIZE) {
+               avs2_print(dec, AVS2_DBG_BUFMGR,
+                       "kfifo len:%d invalid, peek error\n",
+                       kfifo_len(&dec->display_q));
+               return NULL;
+       }
+
        if (kfifo_peek(&dec->display_q, &vf))
                return vf;
 

diff --git a/drivers/frame_provider/decoder/avs_multi/avs_multi.c b/drivers/frame_provider/decoder/avs_multi/avs_multi.c
index dcb15e112194ed71ba7d0d1bacb5827bd24db967..8b492614cb8ca9dd7a86467dc56c6a7c8b6078de 100644 (file)
--- a/drivers/frame_provider/decoder/avs_multi/avs_multi.c
+++ b/drivers/frame_provider/decoder/avs_multi/avs_multi.c
@@ -987,6 +987,13 @@ static struct vframe_s *vavs_vf_peek(void *op_arg)
        if (hw->recover_flag)
                return NULL;
 
+       if (kfifo_len(&hw->display_q) > VF_POOL_SIZE) {
+               debug_print(hw, PRINT_FLAG_RUN_FLOW,
+                       "kfifo len:%d invalid, peek error\n",
+                       kfifo_len(&hw->display_q));
+               return NULL;
+       }
+
        if (kfifo_peek(&hw->display_q, &vf)) {
                if (vf) {
                        if (force_fps & 0x100) {

diff --git a/drivers/frame_provider/decoder/h264_multi/vmh264.c b/drivers/frame_provider/decoder/h264_multi/vmh264.c
index 368f9f7ad01a4c2363e4c660972d61046252f8e4..9150d192de834c21b97993e8c25255b33914294c 100644 (file)
--- a/drivers/frame_provider/decoder/h264_multi/vmh264.c
+++ b/drivers/frame_provider/decoder/h264_multi/vmh264.c
@@ -4173,6 +4173,13 @@ static struct vframe_s *vh264_vf_peek(void *op_arg)
                return &hw->vframe_dummy;
        }
 
+       if (kfifo_len(&hw->display_q) > VF_POOL_SIZE) {
+               dpb_print(DECODE_ID(hw), PRINT_FLAG_VDEC_STATUS,
+                       "kfifo len:%d invalid, peek error\n",
+                       kfifo_len(&hw->display_q));
+               return NULL;
+       }
+
        if (kfifo_out_peek(&hw->display_q, (void *)&vf, 2)) {
                if (vf[1]) {
                        vf[0]->next_vf_pts_valid = true;

diff --git a/drivers/frame_provider/decoder/h265/vh265.c b/drivers/frame_provider/decoder/h265/vh265.c
index 0728a0ddea2b9322a019f1d7b546539c40e432f8..9369556850c484055e51c269ea9aed30ed631923 100644 (file)
--- a/drivers/frame_provider/decoder/h265/vh265.c
+++ b/drivers/frame_provider/decoder/h265/vh265.c
@@ -8643,6 +8643,12 @@ static struct vframe_s *vh265_vf_peek(void *op_arg)
                return &hevc->vframe_dummy;
        }
 
+       if (kfifo_len(&hevc->display_q) > VF_POOL_SIZE) {
+               hevc_print(hevc, H265_DEBUG_BUFMGR,
+                       "kfifo len:%d invalid, peek error\n",
+                       kfifo_len(&hevc->display_q));
+               return NULL;
+       }
 
        if (kfifo_out_peek(&hevc->display_q, (void *)&vf, 2)) {
                if (vf[1]) {

diff --git a/drivers/frame_provider/decoder/mjpeg/vmjpeg_multi.c b/drivers/frame_provider/decoder/mjpeg/vmjpeg_multi.c
index 8fe1dbb60073da6cbb4881c63c18d02805ac9cc0..d16dd32e9f3e98d2dac0b0a5b2400f817d67a66f 100644 (file)
--- a/drivers/frame_provider/decoder/mjpeg/vmjpeg_multi.c
+++ b/drivers/frame_provider/decoder/mjpeg/vmjpeg_multi.c
@@ -492,6 +492,14 @@ static struct vframe_s *vmjpeg_vf_peek(void *op_arg)
        if (!hw)
                return NULL;
        hw->peek_num++;
+
+       if (kfifo_len(&hw->display_q) > VF_POOL_SIZE) {
+               mmjpeg_debug_print(DECODE_ID(hw), PRINT_FLAG_RUN_FLOW,
+                       "kfifo len:%d invalid, peek error\n",
+                       kfifo_len(&hw->display_q));
+               return NULL;
+       }
+
        if (kfifo_peek(&hw->display_q, &vf))
                return vf;
 

diff --git a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
index f4494199e8643b658ec4643c43ef5e1849515084..337498a8b5a61b9d4c612a4823406979ce9c2bd4 100644 (file)
--- a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
+++ b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
@@ -2549,6 +2549,14 @@ static struct vframe_s *vmpeg_vf_peek(void *op_arg)
        struct vdec_mpeg12_hw_s *hw =
        (struct vdec_mpeg12_hw_s *)vdec->private;
        hw->peek_num++;
+
+       if (kfifo_len(&hw->display_q) > VF_POOL_SIZE) {
+               debug_print(DECODE_ID(hw), PRINT_FLAG_RUN_FLOW,
+                       "kfifo len:%d invalid, peek error\n",
+                       kfifo_len(&hw->display_q));
+               return NULL;
+       }
+
        if (kfifo_peek(&hw->display_q, &vf))
                return vf;
 

diff --git a/drivers/frame_provider/decoder/mpeg4/vmpeg4_multi.c b/drivers/frame_provider/decoder/mpeg4/vmpeg4_multi.c
index c2ed4963d2fe3300f9e6175b6a6d628a57810898..bc31c73f8206aef5b12905e6d0b94c449120c1d4 100644 (file)
--- a/drivers/frame_provider/decoder/mpeg4/vmpeg4_multi.c
+++ b/drivers/frame_provider/decoder/mpeg4/vmpeg4_multi.c
@@ -1662,6 +1662,14 @@ static struct vframe_s *vmpeg_vf_peek(void *op_arg)
        if (!hw)
                return NULL;
        hw->peek_num++;
+
+       if (kfifo_len(&hw->display_q) > VF_POOL_SIZE) {
+               mmpeg4_debug_print(DECODE_ID(hw), PRINT_FLAG_RUN_FLOW,
+                       "kfifo len:%d invalid, peek error\n",
+                       kfifo_len(&hw->display_q));
+               return NULL;
+       }
+
        if (kfifo_peek(&hw->display_q, &vf))
                return vf;
 

diff --git a/drivers/frame_provider/decoder/vav1/vav1.c b/drivers/frame_provider/decoder/vav1/vav1.c
index d67d76cd103c72b4aa972b5ab673c5321edc05a0..e00dde7f86b5f1316161beaa521d172d60fd76d0 100644 (file)
--- a/drivers/frame_provider/decoder/vav1/vav1.c
+++ b/drivers/frame_provider/decoder/vav1/vav1.c
@@ -6029,6 +6029,13 @@ static struct vframe_s *vav1_vf_peek(void *op_arg)
        if (step == 2)
                return NULL;
 
+       if (kfifo_len(&hw->display_q) > VF_POOL_SIZE) {
+               av1_print(hw, AV1_DEBUG_BUFMGR,
+                       "kfifo len:%d invalid, peek error\n",
+                       kfifo_len(&hw->display_q));
+               return NULL;
+       }
+
        if (kfifo_out_peek(&hw->display_q, (void *)&vf, 2)) {
                if (vf[1]) {
                        vf[0]->next_vf_pts_valid = true;

diff --git a/drivers/frame_provider/decoder/vp9/vvp9.c b/drivers/frame_provider/decoder/vp9/vvp9.c
index 6e6c85996bc4bb09325f3b42506c7b686cb36b48..974cfe6d0ed023ee4d48160bff999c5f0556b4b6 100644 (file)
--- a/drivers/frame_provider/decoder/vp9/vvp9.c
+++ b/drivers/frame_provider/decoder/vp9/vvp9.c
@@ -7067,6 +7067,13 @@ static struct vframe_s *vvp9_vf_peek(void *op_arg)
        if (step == 2)
                return NULL;
 
+       if (kfifo_len(&pbi->display_q) > VF_POOL_SIZE) {
+               vp9_print(pbi, VP9_DEBUG_BUFMGR,
+                       "kfifo len:%d invalid, peek error\n",
+                       kfifo_len(&pbi->display_q));
+               return NULL;
+       }
+
        if (kfifo_out_peek(&pbi->display_q, (void *)&vf, 2)) {
                if (vf[1]) {
                        vf[0]->next_vf_pts_valid = true;