am 75763076: Protects mapping and unmapping of data buffers as well as structures using mutex bug 2174390

Merge commit '757630763c2efcdb23925cd6413f2e36d46123be' into eclair-mr2

* commit '757630763c2efcdb23925cd6413f2e36d46123be':
  Protects mapping and unmapping of data buffers as well as structures using mutex

1 files changed, 40 insertions, 15 deletions

diff --git a/omx/system/src/openmax_il/lcml/src/LCML_DspCodec.c b/omx/system/src/openmax_il/lcml/src/LCML_DspCodec.c
index 3d3cf36..104a4dc 100644
--- a/omx/system/src/openmax_il/lcml/src/LCML_DspCodec.c
+++ b/omx/system/src/openmax_il/lcml/src/LCML_DspCodec.c
@@ -853,7 +853,7 @@ static OMX_ERRORTYPE QueueBuffer (OMX_HANDLETYPE hComponent,
     int streamId = 0;
     DSP_STATUS status;
     OMX_ERRORTYPE eError = OMX_ErrorNone;
-    char * tmp2;
+    char * tmp2=NULL;
     DMM_BUFFER_OBJ* pDmmBuf=NULL;
     int commandId;
     struct DSP_MSG msg;
@@ -864,7 +864,7 @@ static OMX_ERRORTYPE QueueBuffer (OMX_HANDLETYPE hComponent,
     if (hComponent == NULL)
     {
         eError = OMX_ErrorInsufficientResources;
-        goto EXIT;
+        return eError;
     }
 
     phandle = (LCML_DSP_INTERFACE *)(((LCML_CODEC_INTERFACE *)hComponent)->pCodec);
@@ -949,6 +949,12 @@ static OMX_ERRORTYPE QueueBuffer (OMX_HANDLETYPE hComponent,
     {
         LCML_DPRINT("Unrecognized buffer type..");
         eError = OMX_ErrorBadParameter;
+        if(tmp2)
+        {
+            free(tmp2);
+            phandle->commStruct = NULL;
+        }
+        goto EXIT;
     }
     commandId = USN_GPPMSG_SET_BUFF|streamId;
     LCML_DPRINT("Sending command ID 0x%x",commandId);
@@ -1015,7 +1021,6 @@ static OMX_ERRORTYPE QueueBuffer (OMX_HANDLETYPE hComponent,
     
     /* storing mapped address of struct */
     phandle->commStruct->iArmArg = (OMX_U32)pDmmBuf->pMapped;
-    pthread_mutex_unlock(&phandle->mutex);
     
     LCML_DPRINT("sending SETBUFF \n");
     msg.dwCmd = commandId;
@@ -1027,9 +1032,7 @@ static OMX_ERRORTYPE QueueBuffer (OMX_HANDLETYPE hComponent,
     DSP_ERROR_EXIT (status, "Send message to node", EXIT);
 
 EXIT:
-    if(eError != OMX_ErrorNone){
-        pthread_mutex_unlock(&phandle->mutex);
-    }
+    pthread_mutex_unlock(&phandle->mutex);
     return eError;
 }
 
@@ -1059,7 +1062,7 @@ static OMX_ERRORTYPE ControlCodec(OMX_HANDLETYPE hComponent,
     if (hComponent == NULL )
     {
         eError= OMX_ErrorInsufficientResources;
-        goto EXIT;
+        return eError;
     }
 
     phandle = (LCML_DSP_INTERFACE *)(((LCML_CODEC_INTERFACE *)hComponent)->pCodec);
@@ -1168,22 +1171,31 @@ static OMX_ERRORTYPE ControlCodec(OMX_HANDLETYPE hComponent,
         {
             struct DSP_MSG msg;
             int i;
+            pthread_mutex_lock(&phandle->mutex);
             for (i = 0; i < QUEUE_SIZE; i++)
             {
                 /* searching for empty slot */
                 if (phandle->pAlgcntlDmmBuf[i] == NULL)
                     break;
             }
+            if(i >= QUEUE_SIZE)
+            {
+                pthread_mutex_unlock(&phandle->mutex);
+                eError = OMX_ErrorUndefined;
+                goto EXIT;
+            }
             LCML_MALLOC(phandle->pAlgcntlDmmBuf[i],sizeof(DMM_BUFFER_OBJ),DMM_BUFFER_OBJ);
             if(phandle->pAlgcntlDmmBuf[i] == NULL)
             {
                 eError = OMX_ErrorInsufficientResources;
+                pthread_mutex_unlock(&phandle->mutex);
                 goto EXIT;
             }
             memset(phandle->pAlgcntlDmmBuf[i],0,sizeof(DMM_BUFFER_OBJ));
             eError = DmmMap(phandle->dspCodec->hProc,(int)args[2],(int)args[2], args[1],(phandle->pAlgcntlDmmBuf[i]), 0);
             if (eError != OMX_ErrorNone)
             {
+                pthread_mutex_unlock(&phandle->mutex);
                 goto EXIT;
             }
             phandle->algcntlmapped[i] = 1;
@@ -1197,6 +1209,7 @@ static OMX_ERRORTYPE ControlCodec(OMX_HANDLETYPE hComponent,
                                 PERF_ModuleSocketNode);                                
 #endif
             status = DSPNode_PutMessage (phandle->dspCodec->hNode, &msg, DSP_FOREVER);
+            pthread_mutex_unlock(&phandle->mutex);
             DSP_ERROR_EXIT (status, "Send message to node", EXIT);
             break;
         }
@@ -1213,16 +1226,25 @@ static OMX_ERRORTYPE ControlCodec(OMX_HANDLETYPE hComponent,
             else 
             {
                 int i;
+                pthread_mutex_lock(&phandle->mutex);
                 for (i = 0; i < QUEUE_SIZE; i++)
                 {
                     /* searching for empty slot */
                     if (phandle->pStrmcntlDmmBuf[i] == NULL)
                         break;
                 }
+                if(i >= QUEUE_SIZE)
+                {
+                    eError=OMX_ErrorUndefined;
+                    pthread_mutex_unlock(&phandle->mutex);
+                    goto EXIT;
+                }
+
                 LCML_MALLOC(phandle->pStrmcntlDmmBuf[i],sizeof(DMM_BUFFER_OBJ),DMM_BUFFER_OBJ);
                 if(phandle->pStrmcntlDmmBuf[i] == NULL)
                 {
                     eError = OMX_ErrorInsufficientResources;
+                    pthread_mutex_unlock(&phandle->mutex);
                     goto EXIT;
                 }
                 
@@ -1231,6 +1253,7 @@ static OMX_ERRORTYPE ControlCodec(OMX_HANDLETYPE hComponent,
                 eError = DmmMap(phandle->dspCodec->hProc, (int)args[2],(int)args[2], args[1],(phandle->pStrmcntlDmmBuf[i]), 0);
                 if (eError != OMX_ErrorNone)
                 {
+                    pthread_mutex_unlock(&phandle->mutex);
                     goto EXIT;
                 }
                 phandle->strmcntlmapped[i] = 1;
@@ -1256,6 +1279,7 @@ static OMX_ERRORTYPE ControlCodec(OMX_HANDLETYPE hComponent,
                                 PERF_ModuleSocketNode);                                
 #endif
             status = DSPNode_PutMessage (phandle->dspCodec->hNode, &msg, DSP_FOREVER);
+            pthread_mutex_unlock(&phandle->mutex);
             DSP_ERROR_EXIT (status, "Send message to node", EXIT);
 
             LCML_DPRINT("STRMControl: arg[0]: message = %x\n",(int)args[0]);
@@ -1425,10 +1449,8 @@ OMX_ERRORTYPE FreeResources (LCML_DSP_INTERFACE *hInterface)
     codec = (LCML_DSP_INTERFACE *)(((LCML_CODEC_INTERFACE*)hInterface->pCodecinterfacehandle)->pCodec);
     if(codec != NULL)
     {
-    pthread_mutex_lock(&codec->mutex);
-    
-
-    LCML_DPRINT("%d :: LCML:: FreeResources\n",__LINE__);
+        pthread_mutex_lock(&codec->mutex);
+        LCML_DPRINT("%d :: LCML:: FreeResources\n",__LINE__);
         if(codec->g_aNotificationObjects[0]!= NULL)
         {
             LCML_FREE(codec->g_aNotificationObjects[0]);
@@ -1445,13 +1467,14 @@ OMX_ERRORTYPE FreeResources (LCML_DSP_INTERFACE *hInterface)
                 codec->g_aNotificationObjects[2] = NULL;
             }
  #endif
-            pthread_mutex_unlock(&codec->mutex);
-            pthread_mutex_destroy (&codec->mutex);
             LCML_FREE(((LCML_CODEC_INTERFACE*)hInterface->pCodecinterfacehandle));
             hInterface->pCodecinterfacehandle = NULL;
-            LCML_FREE(codec);
-            codec = NULL;
         }
+        pthread_mutex_unlock(&codec->mutex);
+        pthread_mutex_destroy (&codec->mutex);
+        LCML_FREE(codec);
+        codec = NULL;
+
     }
     LCML_DPRINT("%d :: LCML:: FreeResources\n",__LINE__);
     return eError;
@@ -1912,6 +1935,7 @@ void* MessagingThread(void* arg)
                     
                         int i;
                         event = EMMCodecAlgCtrlAck;
+                        pthread_mutex_lock(&hDSPInterface->mutex);
                         for (i = 0; i < QUEUE_SIZE; i++)
                         {
                             pDmmBuf = ((LCML_DSP_INTERFACE *)arg)->pAlgcntlDmmBuf[i];
@@ -1930,6 +1954,7 @@ void* MessagingThread(void* arg)
                         args[0] = (void *) msg.dwArg1;
                         args[6] = (void *) arg;  /* handle */
                         LCML_DPRINT("GOT MESSAGE USN_DSPACK_ALGCTRL \n");
+                        pthread_mutex_unlock(&hDSPInterface->mutex);
                     }
                     else if (commandId == USN_DSPACK_STRMCTRL)
                     {