OMX: Base: Add Protection For Alloc/Use During Error Cleanup

If Port Enable fails during port reconfig (in VIDDEC3_create
or if all buffers don't come in time), error handling will
automatically disable the port and cleanup resources.

If the application is still calling AllocateBuffer during this
time, then it was possible that a crash may happen when AllocateBuffer
uses the same resources that are being released during Disable
transition. To prevent this race condition, a mutex is added
around Allocate/Use_Buffer and the error handling for the failure
case.

Change-Id: Ief3f999c4c04ab5dc2ae2b3cdbd8be357e18903d
Signed-off-by: Angela Stegmaier <angelabaker@ti.com>

3 files changed, 26 insertions, 0 deletions

diff --git a/omx/base/omx_base_comp/inc/omx_base_internal.h b/omx/base/omx_base_comp/inc/omx_base_internal.h
index ad1f171..f989ae9 100644
--- a/omx/base/omx_base_comp/inc/omx_base_internal.h
+++ b/omx/base/omx_base_comp/inc/omx_base_internal.h
@@ -95,6 +95,7 @@ typedef struct OMXBaseComp_Private {
     OMX_PTR              pErrorCmdcompleteEvent;
     OMX_PTR              pCmdPipeMutex;
     OMX_PTR              pNewStateMutex;
+    OMX_PTR              pPortDisableMutex;
     OMX_ERRORTYPE (*fpInvokeProcessFunction)(OMX_HANDLETYPE hComponent,
                                             OMX_U32 retEvent);
 
diff --git a/omx/base/omx_base_comp/src/omx_base.c b/omx/base/omx_base_comp/src/omx_base.c
index 931bef8..31079bf 100644
--- a/omx/base/omx_base_comp/src/omx_base.c
+++ b/omx/base/omx_base_comp/src/omx_base.c
@@ -739,6 +739,9 @@ OMX_ERRORTYPE OMXBase_AllocateBuffer(OMX_HANDLETYPE hComponent,
     pComp = (OMX_COMPONENTTYPE *)hComponent;
     pBaseComp = (OMXBaseComp *)pComp->pComponentPrivate;
     pBaseCompPvt = (OMXBaseComp_Pvt *)pBaseComp->pPvtData;
+
+    OSAL_ObtainMutex(pBaseCompPvt->pPortDisableMutex, OSAL_SUSPEND);
+
     nStartPortNumber = pBaseComp->nMinStartPortIndex;
     nPorts = pBaseComp->nNumPorts;
     OMX_CHECK(nPortIndex >= nStartPortNumber && nPortIndex < nPorts,
@@ -811,6 +814,9 @@ OMX_ERRORTYPE OMXBase_AllocateBuffer(OMX_HANDLETYPE hComponent,
     }
 
 EXIT:
+    if ((hComponent != NULL)  && (nSizeBytes > 0)) {
+        OSAL_ReleaseMutex(pBaseCompPvt->pPortDisableMutex);
+    }
     return (eError);
 }
 
@@ -839,6 +845,9 @@ OMX_ERRORTYPE OMXBase_UseBuffer(OMX_HANDLETYPE hComponent,
     pComp = (OMX_COMPONENTTYPE *)hComponent;
     pBaseComp = (OMXBaseComp *)pComp->pComponentPrivate;
     pBaseCompPvt = (OMXBaseComp_Pvt *)pBaseComp->pPvtData;
+
+    OSAL_ObtainMutex(pBaseCompPvt->pPortDisableMutex, OSAL_SUSPEND);
+
     nStartPortNumber = pBaseComp->nMinStartPortIndex;
     nPorts = pBaseComp->nNumPorts;
     OMX_CHECK(nPortIndex >= nStartPortNumber && nPortIndex < nPorts,
@@ -914,6 +923,9 @@ OMX_ERRORTYPE OMXBase_UseBuffer(OMX_HANDLETYPE hComponent,
         OMX_CHECK(OSAL_ErrNone == tStatus, OMX_ErrorInsufficientResources);
     }
 EXIT:
+    if (hComponent != NULL) {
+        OSAL_ReleaseMutex(pBaseCompPvt->pPortDisableMutex);
+    }
     return (eError);
 }
 
diff --git a/omx/base/omx_base_comp/src/omx_base_internal.c b/omx/base/omx_base_comp/src/omx_base_internal.c
index 953361d..a575491 100644
--- a/omx/base/omx_base_comp/src/omx_base_internal.c
+++ b/omx/base/omx_base_comp/src/omx_base_internal.c
@@ -100,6 +100,10 @@ OMX_ERRORTYPE OMXBase_PrivateInit(OMX_HANDLETYPE hComponent)
     tStatus = OSAL_CreateEvent(&(pBaseCompPvt->pTriggerEvent));
     OMX_CHECK(OSAL_ErrNone == tStatus, OMX_ErrorInsufficientResources);
 
+    /*Create mutex for port disable*/
+    tStatus = OSAL_CreateMutex(&(pBaseCompPvt->pPortDisableMutex));
+    OMX_CHECK(OSAL_ErrNone == tStatus, OMX_ErrorInsufficientResources);
+
     OSAL_Memcpy(pBaseCompPvt->cTaskName, pBaseComp->cComponentName, strlen(pBaseComp->cComponentName));
     pBaseCompPvt->nStackSize = OMX_BASE_THREAD_STACKSIZE;
     pBaseCompPvt->nPrioirty = OMX_BASE_THREAD_PRIORITY;
@@ -231,6 +235,13 @@ OMX_ERRORTYPE OMXBase_PrivateDeInit(OMX_HANDLETYPE hComponent)
         }
         pBaseCompPvt->pCmdPipeMutex = NULL;
     }
+    if (pBaseCompPvt->pPortDisableMutex) {
+        tStatus = OSAL_DeleteMutex(pBaseCompPvt->pPortDisableMutex);
+        if( tStatus != OSAL_ErrNone ) {
+            eError = OMX_ErrorUndefined;
+        }
+        pBaseCompPvt->pPortDisableMutex = NULL;
+    }
 
     OSAL_ReleaseMutex(pBaseCompPvt->pNewStateMutex);
 
@@ -1535,6 +1546,7 @@ void OMXBase_HandleFailEvent(OMX_HANDLETYPE hComponent, OMX_COMMANDTYPE eCmd,
         case OMX_CommandPortDisable :
             /*Close DIO on the relevant ports for both enable as well as disable
             commands*/
+            OSAL_ObtainMutex(pBaseCompPvt->pPortDisableMutex, OSAL_SUSPEND);
             if( nPortIndex == OMX_ALL ) {
                 for( i = 0; i < pBaseComp->nNumPorts; i++ ) {
                     pPort = pBaseComp->pPorts[i];
@@ -1555,6 +1567,7 @@ void OMXBase_HandleFailEvent(OMX_HANDLETYPE hComponent, OMX_COMMANDTYPE eCmd,
                     }
                 }
             }
+            OSAL_ReleaseMutex(pBaseCompPvt->pPortDisableMutex);
         break;
 
         default :