From b3f6abccd535fd79ff0f39e05d85a2059dedc0e3 Mon Sep 17 00:00:00 2001 From: Gauri Joshi Date: Mon, 2 Nov 2020 16:04:07 +0530 Subject: [PATCH] msm: mhi_dev: Fix to avoid double free in alloc_evt_buf_evt_req() There is a possible race condition, if the client calls MHI close and channel gets a start command then mhi_dev_alloc_evt_buf_evt_req() would be called. This can lead to tr_events and ereqs getting freed from both the contexts. Fix is to use a mutex to prevent this from happening parallelly. Change-Id: I9ac10211d5bd5cee96e69b7fc10955e24569cf64 Signed-off-by: Subramanian Ananthanarayanan Signed-off-by: Gauri Joshi --- drivers/platform/msm/mhi_dev/mhi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/platform/msm/mhi_dev/mhi.c b/drivers/platform/msm/mhi_dev/mhi.c index 565c9d19a108..d1943a2062c7 100644 --- a/drivers/platform/msm/mhi_dev/mhi.c +++ b/drivers/platform/msm/mhi_dev/mhi.c @@ -1713,8 +1713,10 @@ static void mhi_dev_process_cmd_ring(struct mhi_dev *mhi, return; } } + mutex_lock(&mhi->ch[ch_id].ch_lock); mhi_dev_alloc_evt_buf_evt_req(mhi, &mhi->ch[ch_id], evt_ring); + mutex_unlock(&mhi->ch[ch_id].ch_lock); } if (MHI_USE_DMA(mhi))