mm-video: vidc: fix memory leak in dynamic buffer mode

In dynamic buffer mode, for non-secure playback,
output buffer is mapped before each ftb to driver.
This buffer is unmapped in the fbd. During flush
operations, the mapped buffer in ftb is not freed
leading to memory leak. To fix the issue, move
the memory mapping to just before sending the ftb
to driver.

Bug: 11973141

Change-Id: Ib0e5525fdf8132434800bf4d4ff8d27b085fc8fc

1 files changed, 15 insertions, 14 deletions

diff --git a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
index 9887143f..3512c2c4 100755
--- a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
+++ b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
@@ -5557,7 +5557,6 @@ OMX_ERRORTYPE  omx_vdec::fill_this_buffer(OMX_IN OMX_HANDLETYPE  hComp,
     if (dynamic_buf_mode) {
         private_handle_t *handle = NULL;
         struct VideoDecoderOutputMetaData *meta;
-        OMX_U8 *buff = NULL;
         unsigned int nPortIndex = 0;
 
         if (!buffer || !buffer->pBuffer) {
@@ -5570,23 +5569,11 @@ OMX_ERRORTYPE  omx_vdec::fill_this_buffer(OMX_IN OMX_HANDLETYPE  hComp,
         handle = (private_handle_t *)meta->pHandle;
         DEBUG_PRINT_LOW("FTB: buftype: %d bufhndl: %p", meta->eType, meta->pHandle);
 
-        //map the buffer handle based on the size set on output port definition.
-        if (!secure_mode) {
-            buff = (OMX_U8*)mmap(0, drv_ctx.op_buf.buffer_size,
-                          PROT_READ|PROT_WRITE, MAP_SHARED, handle->fd, 0);
-        } else {
-            buff = (OMX_U8*) buffer;
-        }
 
         //Fill outputbuffer with buffer details, this will be sent to f/w during VIDIOC_QBUF
         nPortIndex = buffer-((OMX_BUFFERHEADERTYPE *)client_buffers.get_il_buf_hdr());
         drv_ctx.ptr_outputbuffer[nPortIndex].pmem_fd = handle->fd;
-        drv_ctx.ptr_outputbuffer[nPortIndex].offset = 0;
-        drv_ctx.ptr_outputbuffer[nPortIndex].bufferaddr = buff;
-        drv_ctx.ptr_outputbuffer[nPortIndex].buffer_len = drv_ctx.op_buf.buffer_size;
-        drv_ctx.ptr_outputbuffer[nPortIndex].mmaped_size = drv_ctx.op_buf.buffer_size;
-        buf_ref_add(drv_ctx.ptr_outputbuffer[nPortIndex].pmem_fd,
-                    drv_ctx.ptr_outputbuffer[nPortIndex].offset);
+        drv_ctx.ptr_outputbuffer[nPortIndex].bufferaddr = (OMX_U8*) buffer;
     }
 
 
@@ -5654,6 +5641,20 @@ OMX_ERRORTYPE  omx_vdec::fill_this_buffer_proxy(
         m_cb.FillBufferDone (hComp,m_app_data,buffer);
         return OMX_ErrorNone;
     }
+    if (dynamic_buf_mode) {
+        //map the buffer handle based on the size set on output port definition.
+        if (!secure_mode) {
+            drv_ctx.ptr_outputbuffer[nPortIndex].bufferaddr =
+                (OMX_U8*)mmap(0, drv_ctx.op_buf.buffer_size,
+                PROT_READ|PROT_WRITE, MAP_SHARED,
+                drv_ctx.ptr_outputbuffer[nPortIndex].pmem_fd, 0);
+        }
+        drv_ctx.ptr_outputbuffer[nPortIndex].offset = 0;
+        drv_ctx.ptr_outputbuffer[nPortIndex].buffer_len = drv_ctx.op_buf.buffer_size;
+        drv_ctx.ptr_outputbuffer[nPortIndex].mmaped_size = drv_ctx.op_buf.buffer_size;
+        buf_ref_add(drv_ctx.ptr_outputbuffer[nPortIndex].pmem_fd,
+                   drv_ctx.ptr_outputbuffer[nPortIndex].offset);
+    }
     pending_output_buffers++;
     buffer = client_buffers.get_dr_buf_hdr(bufferAdd);
     ptr_respbuffer = (struct vdec_output_frameinfo*)buffer->pOutputPortPrivate;