msm: camera: common: synchronization in CRM close and subdev register

There is a chance of a race condition where cam_register_subdev
and cam_req_mgr_close may be invoked simultaneously.
In such cases, v4l2 subdev registration may be in progress
in cam_register_subdev while cam_req_mgr_close attempts to
shut down the subdev, potentially causing a panic during
boot up.
Enhanced mutex locking by replacing dev_lock with cam_lock
to avoid such conditions and ensure proper synchronization
between subdev registration and shutdown.

CRs-Fixed: 4235165
Change-Id: I8ac389af6875b8e20583082e078ee9fa4e56138e
Signed-off-by: Keval Sanghvi <ksanghvi@qti.qualcomm.com>

Author: KevalSanghviQti

camera/drivers/cam_req_mgr/cam_req_mgr_dev.c

@@ -214,11 +214,13 @@ static int cam_req_mgr_close(struct file *filep)
 
 	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_LOCK);
 
+	mutex_lock(&g_dev.subdev_lock);
 	mutex_lock(&g_dev.cam_lock);
 
 	if (g_dev.open_cnt <= 0) {
 		CAM_WARN(CAM_CRM, "open_cnt <= 0 in close!");
 		mutex_unlock(&g_dev.cam_lock);
+		mutex_unlock(&g_dev.subdev_lock);
 		cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
 		return -EINVAL;
 	}
@@ -255,6 +257,7 @@ static int cam_req_mgr_close(struct file *filep)
 	cam_req_mgr_util_free_hdls();
 	cam_mem_mgr_deinit();
 	mutex_unlock(&g_dev.cam_lock);
+	mutex_unlock(&g_dev.subdev_lock);
 
 	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
 
@@ -920,6 +923,7 @@ int cam_register_subdev(struct cam_subdev *csd)
 		return -EINVAL;
 	}
 
+	mutex_lock(&g_dev.subdev_lock);
 	mutex_lock(&g_dev.dev_lock);
 
 	sd = &csd->sd;
@@ -969,6 +973,7 @@ int cam_register_subdev(struct cam_subdev *csd)
 reg_fail:
 invalid_val_fail:
 	mutex_unlock(&g_dev.dev_lock);
+	mutex_unlock(&g_dev.subdev_lock);
 	return rc;
 }
 
@@ -979,10 +984,12 @@ int cam_unregister_subdev(struct cam_subdev *csd)
 		return -ENODEV;
 	}
 
+	mutex_lock(&g_dev.subdev_lock);
 	mutex_lock(&g_dev.dev_lock);
 	v4l2_device_unregister_subdev(&csd->sd);
 	g_dev.count--;
 	mutex_unlock(&g_dev.dev_lock);
+	mutex_unlock(&g_dev.subdev_lock);
 
 	return 0;
 }
@@ -1012,6 +1019,7 @@ static int cam_req_mgr_component_master_bind(struct device *dev)
 
 	g_dev.open_cnt = 0;
 	g_dev.shutdown_state = false;
+	mutex_init(&g_dev.subdev_lock);
 	mutex_init(&g_dev.cam_lock);
 	spin_lock_init(&g_dev.cam_eventq_lock);
 	mutex_init(&g_dev.dev_lock);
@@ -1070,6 +1078,7 @@ static int cam_req_mgr_component_master_bind(struct device *dev)
 req_mgr_util_fail:
 	mutex_destroy(&g_dev.dev_lock);
 	mutex_destroy(&g_dev.cam_lock);
+	mutex_destroy(&g_dev.subdev_lock);
 	cam_video_device_cleanup();
 video_setup_fail:
 	cam_media_device_cleanup();
@@ -1093,6 +1102,7 @@ static void cam_req_mgr_component_master_unbind(struct device *dev)
 	cam_v4l2_device_cleanup();
 	cam_req_mgr_destroy_timer_slab();
 	mutex_destroy(&g_dev.dev_lock);
+	mutex_destroy(&g_dev.subdev_lock);
 	g_dev.state = false;
 }
 

camera/drivers/cam_req_mgr/cam_req_mgr_dev.h

@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
  * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
  */
 
 #ifndef _CAM_REQ_MGR_DEV_H_
@@ -34,6 +35,7 @@ struct cam_req_mgr_device {
 	struct v4l2_fh *cam_eventq;
 	spinlock_t cam_eventq_lock;
 	bool shutdown_state;
+	struct mutex subdev_lock;
 };
 
 #define CAM_REQ_MGR_GET_PAYLOAD_PTR(ev, type)        \

camera_kt/drivers/cam_req_mgr/cam_req_mgr_dev.c

@@ -202,11 +202,13 @@ static int cam_req_mgr_close(struct file *filep)
 
 	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_LOCK);
 
+	mutex_lock(&g_dev.subdev_lock);
 	mutex_lock(&g_dev.cam_lock);
 
 	if (g_dev.open_cnt <= 0) {
 		CAM_WARN(CAM_CRM, "open_cnt <= 0 in close!");
 		mutex_unlock(&g_dev.cam_lock);
+		mutex_unlock(&g_dev.subdev_lock);
 		cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
 		return -EINVAL;
 	}
@@ -243,6 +245,7 @@ static int cam_req_mgr_close(struct file *filep)
 	cam_req_mgr_util_free_hdls();
 	cam_mem_mgr_deinit();
 	mutex_unlock(&g_dev.cam_lock);
+	mutex_unlock(&g_dev.subdev_lock);
 
 	cam_req_mgr_rwsem_write_op(CAM_SUBDEV_UNLOCK);
 
@@ -810,6 +813,7 @@ int cam_register_subdev(struct cam_subdev *csd)
 		return -EINVAL;
 	}
 
+	mutex_lock(&g_dev.subdev_lock);
 	mutex_lock(&g_dev.dev_lock);
 
 	sd = &csd->sd;
@@ -860,6 +864,7 @@ int cam_register_subdev(struct cam_subdev *csd)
 reg_fail:
 invalid_val_fail:
 	mutex_unlock(&g_dev.dev_lock);
+	mutex_unlock(&g_dev.subdev_lock);
 	return rc;
 }
 
@@ -870,10 +875,12 @@ int cam_unregister_subdev(struct cam_subdev *csd)
 		return -ENODEV;
 	}
 
+	mutex_lock(&g_dev.subdev_lock);
 	mutex_lock(&g_dev.dev_lock);
 	v4l2_device_unregister_subdev(&csd->sd);
 	g_dev.count--;
 	mutex_unlock(&g_dev.dev_lock);
+	mutex_unlock(&g_dev.subdev_lock);
 
 	return 0;
 }
@@ -892,6 +899,7 @@ static int cam_req_mgr_component_master_bind(struct device *dev)
 	mutex_init(&g_dev.cam_lock);
 	spin_lock_init(&g_dev.cam_eventq_lock);
 	mutex_init(&g_dev.dev_lock);
+	mutex_init(&g_dev.subdev_lock);
 
 	rc = cam_req_mgr_util_init();
 	if (rc) {
@@ -960,6 +968,7 @@ static int cam_req_mgr_component_master_bind(struct device *dev)
 	cam_v4l2_device_cleanup();
 	mutex_destroy(&g_dev.dev_lock);
 	mutex_destroy(&g_dev.cam_lock);
+	mutex_destroy(&g_dev.subdev_lock);
 	g_dev.state = false;
 	return rc;
 }
@@ -977,6 +986,7 @@ static void cam_req_mgr_component_master_unbind(struct device *dev)
 	cam_video_device_cleanup();
 	cam_v4l2_device_cleanup();
 	mutex_destroy(&g_dev.dev_lock);
+	mutex_destroy(&g_dev.subdev_lock);
 	g_dev.state = false;
 }
 

camera_kt/drivers/cam_req_mgr/cam_req_mgr_dev.h

@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
  * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
  */
 
 #ifndef _CAM_REQ_MGR_DEV_H_
@@ -32,6 +33,7 @@ struct cam_req_mgr_device {
 	struct v4l2_fh *cam_eventq;
 	spinlock_t cam_eventq_lock;
 	bool shutdown_state;
+	struct mutex subdev_lock;
 };
 
 #define CAM_REQ_MGR_GET_PAYLOAD_PTR(ev, type)        \