commit 11127e7697ed9b6d6d1821ce73a08123d26fc606
author XuZhengguo <zhengguo.xu@intel.com> Tue Feb 14 14:28:58 2023 +0800
committer intel-mediadev <mediadev@intel.com> Tue Feb 14 14:51:00 2023 +0800
tree 3161826e9eaef6bf55ebbaa0949a085cbee29467
parent 1a7fc56440f20de183153d6a9098dbbfc1f226a8

[Decode] Correct ddi heap element count when free

All ddi heap are linked list instead of array. So it needs to iterate all elements to avoid potential leak.

media_driver/linux/common/cp/ddi/media_ddi_prot.cpp

diff --git a/media_driver/linux/common/cp/ddi/media_ddi_prot.cpp b/media_driver/linux/common/cp/ddi/media_ddi_prot.cpp
index 98b934a..e6ea1c1 100644
--- a/media_driver/linux/common/cp/ddi/media_ddi_prot.cpp
+++ b/media_driver/linux/common/cp/ddi/media_ddi_prot.cpp
@@ -330,13 +330,14 @@
     if (nullptr == mediaContextHeapBase)
         return;
 
-    for (int32_t elementId = 0; elementId < ctxNums; ++elementId)
+    for (int32_t elementId = 0; ctxNums > 0  && elementId < contextHeap->uiAllocatedHeapElements; ++elementId)
     {
         PDDI_MEDIA_VACONTEXT_HEAP_ELEMENT mediaContextHeapElmt = &mediaContextHeapBase[elementId];
-        if (nullptr == mediaContextHeapElmt->pVaContext)
+        if (nullptr != mediaContextHeapElmt && nullptr == mediaContextHeapElmt->pVaContext)
             continue;
         VAContextID vaCtxID = (VAContextID)(mediaContextHeapElmt->uiVaContextID + vaContextOffset);
         DdiMediaProtected::DdiMedia_DestroyProtectedSession(ctx, vaCtxID);
+        ctxNums--;
     }
 }
 

media_driver/linux/common/ddi/media_libva.cpp

diff --git a/media_driver/linux/common/ddi/media_libva.cpp b/media_driver/linux/common/ddi/media_libva.cpp
index ed3aa07..f48ea91 100755
--- a/media_driver/linux/common/ddi/media_libva.cpp
+++ b/media_driver/linux/common/ddi/media_libva.cpp
@@ -774,15 +774,16 @@
         return;
 
     int32_t surfaceNums = mediaCtx->uiNumSurfaces;
-    for (int32_t elementId = 0; elementId < surfaceNums; elementId++)
+    for (int32_t elementId = 0; surfaceNums > 0 && elementId < surfaceHeap->uiAllocatedHeapElements; elementId++)
     {
         PDDI_MEDIA_SURFACE_HEAP_ELEMENT mediaSurfaceHeapElmt = &mediaSurfaceHeapBase[elementId];
-        if (nullptr == mediaSurfaceHeapElmt->pSurface)
+        if (nullptr != mediaSurfaceHeapElmt && nullptr == mediaSurfaceHeapElmt->pSurface)
             continue;
 
         DdiMediaUtil_FreeSurface(mediaSurfaceHeapElmt->pSurface);
         MOS_FreeMemory(mediaSurfaceHeapElmt->pSurface);
         DdiMediaUtil_ReleasePMediaSurfaceFromHeap(surfaceHeap,mediaSurfaceHeapElmt->uiVaSurfaceID);
+        surfaceNums--;
         mediaCtx->uiNumSurfaces--;
     }
 }
@@ -809,14 +810,15 @@
         return;
 
     int32_t bufNums = mediaCtx->uiNumBufs;
-    for (int32_t elementId = 0; bufNums > 0; ++elementId)
+    for (int32_t elementId = 0; bufNums > 0 && elementId < bufferHeap->uiAllocatedHeapElements; ++elementId)
     {
         PDDI_MEDIA_BUFFER_HEAP_ELEMENT mediaBufferHeapElmt = &mediaBufferHeapBase[elementId];
-        if (nullptr == mediaBufferHeapElmt->pBuffer)
+        if (nullptr != mediaBufferHeapElmt && nullptr == mediaBufferHeapElmt->pBuffer)
             continue;
+        //Note: uiNumBufs will recount in DdiMedia_DestroyBuffer
         DdiMedia_DestroyBuffer(ctx,mediaBufferHeapElmt->uiVaBufferID);
         //Ensure the non-empty buffer to be destroyed.
-        --bufNums;
+        bufNums--;
     }
 }
 
@@ -842,12 +844,14 @@
         return;
 
     int32_t imageNums = mediaCtx->uiNumImages;
-    for (int32_t elementId = 0; elementId < imageNums; ++elementId)
+    for (int32_t elementId = 0; imageNums > 0 && elementId < imageHeap->uiAllocatedHeapElements; ++elementId)
     {
         PDDI_MEDIA_IMAGE_HEAP_ELEMENT mediaImageHeapElmt = &mediaImageHeapBase[elementId];
-        if (nullptr == mediaImageHeapElmt->pImage)
+        if (nullptr != mediaImageHeapElmt && nullptr == mediaImageHeapElmt->pImage)
             continue;
+        //Note: uiNumImages will recount in DdiMedia_DestroyImage
         DdiMedia_DestroyImage(ctx,mediaImageHeapElmt->uiVaImageID);
+        imageNums--;
     }
 }
 
@@ -865,13 +869,14 @@
     if (nullptr == mediaContextHeapBase)
         return;
 
-    for (int32_t elementId = 0; elementId < ctxNums; ++elementId)
+    for (int32_t elementId = 0; ctxNums > 0 && elementId < contextHeap->uiAllocatedHeapElements; ++elementId)
     {
         PDDI_MEDIA_VACONTEXT_HEAP_ELEMENT mediaContextHeapElmt = &mediaContextHeapBase[elementId];
-        if (nullptr == mediaContextHeapElmt->pVaContext)
+        if (nullptr != mediaContextHeapElmt && nullptr == mediaContextHeapElmt->pVaContext)
             continue;
         VAContextID vaCtxID = (VAContextID)(mediaContextHeapElmt->uiVaContextID + vaContextOffset);
         DdiMedia_DestroyContext(ctx,vaCtxID);
+        ctxNums--;
     }
 
 }