From: Ayoung Sim <a.sim@samsung.com>
Date: Wed, 1 Aug 2018 07:42:04 +0000 (+0900)
Subject: [COMMON] media: mfc: delete the src buffer of strange consumed size
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=9d850e62e0c7f6ec208f973c0d4373a8c9e908d8;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

[COMMON] media: mfc: delete the src buffer of strange consumed size

Change-Id: I8595ae5d408ca4ed02eb10ecf77335344dd41ece
Signed-off-by: Ayoung Sim <a.sim@samsung.com>
---

diff --git a/drivers/media/platform/exynos/mfc/mfc_isr.c b/drivers/media/platform/exynos/mfc/mfc_isr.c
index afc3ea4bfae2..24abce01bb15 100644
--- a/drivers/media/platform/exynos/mfc/mfc_isr.c
+++ b/drivers/media/platform/exynos/mfc/mfc_isr.c
@@ -469,6 +469,7 @@ static void __mfc_handle_frame_error(struct mfc_ctx *ctx,
 
 		mfc_debug(2, "MFC needs next buffer\n");
 		dec->consumed = 0;
+		dec->remained_size = 0;
 
 		if (call_cop(ctx, get_buf_ctrls_val, ctx, &ctx->src_ctrls[index]) < 0)
 			mfc_err_ctx("failed in get_buf_ctrls_val\n");
diff --git a/drivers/media/platform/exynos/mfc/mfc_queue.c b/drivers/media/platform/exynos/mfc/mfc_queue.c
index eff0319284ef..93cdf96f6f2d 100644
--- a/drivers/media/platform/exynos/mfc/mfc_queue.c
+++ b/drivers/media/platform/exynos/mfc/mfc_queue.c
@@ -94,6 +94,7 @@ struct mfc_buf *mfc_get_del_if_consumed(struct mfc_ctx *ctx, struct mfc_buf_queu
 	struct mfc_buf *mfc_buf = NULL;
 	struct mfc_dec *dec = ctx->dec_priv;
 	unsigned long remained;
+	bool exceed = false;
 
 	spin_lock_irqsave(&ctx->buf_queue_lock, flags);
 
@@ -107,16 +108,22 @@ struct mfc_buf *mfc_get_del_if_consumed(struct mfc_ctx *ctx, struct mfc_buf_queu
 
 	mfc_debug(2, "addr[0]: 0x%08llx\n", mfc_buf->addr[0][0]);
 
-	if (dec->remained_size)
+	if (dec->remained_size) {
 		remained = dec->remained_size - consumed;
-	else
+		if (consumed > dec->remained_size)
+			exceed = true;
+	} else {
 		remained = mfc_buf->vb.vb2_buf.planes[0].bytesused - consumed;
+		if (consumed > mfc_buf->vb.vb2_buf.planes[0].bytesused)
+			exceed = true;
+	}
 
 	mfc_debug(2, "[MULTIFRAME] Total Size: %d, consumed: %ld, remained: %ld\n",
 		mfc_buf->vb.vb2_buf.planes[0].bytesused, consumed, remained);
+	if (exceed == true)
+		mfc_err_ctx("[MULTIFRAME] consumed size exceeded the total remained size\n");
 
-	if ((consumed > 0) && (remained > min_bytes) && (error == 0) &&
-			(mfc_buf->vb.vb2_buf.planes[0].bytesused > consumed)){
+	if ((consumed > 0) && (remained > min_bytes) && (error == 0) && (exceed == false)) {
 		/* do not delete from queue */
 		*deleted = 0;
 	} else {