A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 21:59:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

soc: qcom: qmi: Remove txn idr entry in qmi handle release

Browse source 
txn idr entry contains local pointer, which can go out of context
if the calling function exits. Qmi handle can be released from other
thread context(SSR), where iterating over pending transactions list
if txn idr entry is not removed it results in crash in next iteration
as the previous txn idr entry is not valid.

CR-Fixed: 2373541
Change-Id: I0c96a575fb198115532de9977095f2c056742b33
Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>
This commit is contained in:
Deepak Kumar Singh 2019-01-14 17:23:12 +05:30 • committed by Gerrit - the friendly Code Review server
commit 780b9bb5d5
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
drivers/soc/qcom/qmi_interface.c
View file

@ -347,8 +347,12 @@ int qmi_txn_wait(struct qmi_txn *txn, unsigned long timeout)
ret = wait_for_completion_timeout(&txn->completion, timeout);
if (txn->result == -ENETRESET)
mutex_lock(&txn->lock);
if (txn->result == -ENETRESET) {
mutex_unlock(&txn->lock);
return txn->result;
}
mutex_unlock(&txn->lock);
mutex_lock(&qmi->txn_lock);
mutex_lock(&txn->lock);
@ -712,8 +716,11 @@ void qmi_handle_release(struct qmi_handle *qmi)
mutex_lock(&qmi->txn_lock);
idr_for_each_entry(&qmi->txns, txn, txn_id) {
mutex_lock(&txn->lock);
idr_remove(&qmi->txns, txn->id);
txn->result = -ENETRESET;
complete(&txn->completion);
mutex_unlock(&txn->lock);
}
mutex_unlock(&qmi->txn_lock);
idr_destroy(&qmi->txns);