mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-13 00:00:00 -04:00
rtac: Add mutex lock to ensure proper fops access
Add mutex lock in rtac_open and rtac_release to avoid usage count discrepancies leading to multiple calls to unmap memory resulting in null pointer dereference. CRs-Fixed: 2271712 Change-Id: Ie6da28837c352030b8d7e377d68a70cf04e7072a Signed-off-by: Tanya Dixit <tdixit@codeaurora.org>
This commit is contained in:
Tanya Dixit
Gerrit - the friendly Code Review server
parent
186f847814
commit
f6ecc2a139
1 changed files with 13 additions and 29 deletions
42
dsp/rtac.c
42
dsp/rtac.c
|
|
@ -54,6 +54,7 @@ struct rtac_cal_block_data rtac_cal[MAX_RTAC_BLOCKS] = {
|
|||
struct rtac_common_data {
|
||||
atomic_t usage_count;
|
||||
atomic_t apr_err_code;
|
||||
struct mutex rtac_fops_mutex;
|
||||
};
|
||||
|
||||
static struct rtac_common_data rtac_common;
|
||||
|
|
@ -122,10 +123,6 @@ struct mutex rtac_asm_apr_mutex;
|
|||
struct mutex rtac_voice_mutex;
|
||||
struct mutex rtac_voice_apr_mutex;
|
||||
struct mutex rtac_afe_apr_mutex;
|
||||
struct mutex rtac_asm_cal_mutex;
|
||||
struct mutex rtac_adm_cal_mutex;
|
||||
struct mutex rtac_afe_cal_mutex;
|
||||
struct mutex rtac_voice_cal_mutex;
|
||||
|
||||
int rtac_clear_mapping(uint32_t cal_type)
|
||||
{
|
||||
|
|
@ -322,7 +319,9 @@ static int rtac_open(struct inode *inode, struct file *f)
|
|||
|
||||
pr_debug("%s\n", __func__);
|
||||
|
||||
mutex_lock(&rtac_common.rtac_fops_mutex);
|
||||
atomic_inc(&rtac_common.usage_count);
|
||||
mutex_unlock(&rtac_common.rtac_fops_mutex);
|
||||
return result;
|
||||
}
|
||||
|
||||
|
|
@ -334,12 +333,15 @@ static int rtac_release(struct inode *inode, struct file *f)
|
|||
|
||||
pr_debug("%s\n", __func__);
|
||||
|
||||
mutex_lock(&rtac_common.rtac_fops_mutex);
|
||||
atomic_dec(&rtac_common.usage_count);
|
||||
pr_debug("%s: ref count %d!\n", __func__,
|
||||
atomic_read(&rtac_common.usage_count));
|
||||
|
||||
if (atomic_read(&rtac_common.usage_count) > 0)
|
||||
if (atomic_read(&rtac_common.usage_count) > 0) {
|
||||
mutex_unlock(&rtac_common.rtac_fops_mutex);
|
||||
goto done;
|
||||
}
|
||||
|
||||
for (i = 0; i < MAX_RTAC_BLOCKS; i++) {
|
||||
result2 = rtac_unmap_cal_buffer(i);
|
||||
|
|
@ -356,6 +358,7 @@ static int rtac_release(struct inode *inode, struct file *f)
|
|||
result = result2;
|
||||
}
|
||||
}
|
||||
mutex_unlock(&rtac_common.rtac_fops_mutex);
|
||||
done:
|
||||
return result;
|
||||
}
|
||||
|
|
@ -1807,84 +1810,64 @@ static long rtac_ioctl_shared(struct file *f,
|
|||
}
|
||||
|
||||
case AUDIO_GET_RTAC_ADM_CAL:
|
||||
mutex_lock(&rtac_adm_cal_mutex);
|
||||
opcode = q6common_is_instance_id_supported() ?
|
||||
ADM_CMD_GET_PP_PARAMS_V6 :
|
||||
ADM_CMD_GET_PP_PARAMS_V5;
|
||||
result = send_adm_apr((void *) arg, opcode);
|
||||
mutex_unlock(&rtac_adm_cal_mutex);
|
||||
break;
|
||||
case AUDIO_SET_RTAC_ADM_CAL:
|
||||
mutex_lock(&rtac_adm_cal_mutex);
|
||||
opcode = q6common_is_instance_id_supported() ?
|
||||
ADM_CMD_SET_PP_PARAMS_V6 :
|
||||
ADM_CMD_SET_PP_PARAMS_V5;
|
||||
result = send_adm_apr((void *) arg, opcode);
|
||||
mutex_unlock(&rtac_adm_cal_mutex);
|
||||
break;
|
||||
case AUDIO_GET_RTAC_ASM_CAL:
|
||||
mutex_lock(&rtac_asm_cal_mutex);
|
||||
opcode = q6common_is_instance_id_supported() ?
|
||||
ASM_STREAM_CMD_GET_PP_PARAMS_V3 :
|
||||
ASM_STREAM_CMD_GET_PP_PARAMS_V2;
|
||||
result = send_rtac_asm_apr((void *) arg, opcode);
|
||||
mutex_unlock(&rtac_asm_cal_mutex);
|
||||
break;
|
||||
case AUDIO_SET_RTAC_ASM_CAL:
|
||||
mutex_lock(&rtac_asm_cal_mutex);
|
||||
opcode = q6common_is_instance_id_supported() ?
|
||||
ASM_STREAM_CMD_SET_PP_PARAMS_V3 :
|
||||
ASM_STREAM_CMD_SET_PP_PARAMS_V2;
|
||||
result = send_rtac_asm_apr((void *) arg, opcode);
|
||||
mutex_unlock(&rtac_asm_cal_mutex);
|
||||
break;
|
||||
case AUDIO_GET_RTAC_CVS_CAL:
|
||||
mutex_lock(&rtac_voice_cal_mutex);
|
||||
opcode = q6common_is_instance_id_supported() ?
|
||||
VSS_ICOMMON_CMD_GET_PARAM_V3 :
|
||||
VSS_ICOMMON_CMD_GET_PARAM_V2;
|
||||
result = send_voice_apr(RTAC_CVS, (void *) arg, opcode);
|
||||
mutex_unlock(&rtac_voice_cal_mutex);
|
||||
break;
|
||||
case AUDIO_SET_RTAC_CVS_CAL:
|
||||
mutex_lock(&rtac_voice_cal_mutex);
|
||||
opcode = q6common_is_instance_id_supported() ?
|
||||
VSS_ICOMMON_CMD_SET_PARAM_V3 :
|
||||
VSS_ICOMMON_CMD_SET_PARAM_V2;
|
||||
result = send_voice_apr(RTAC_CVS, (void *) arg, opcode);
|
||||
mutex_unlock(&rtac_voice_cal_mutex);
|
||||
break;
|
||||
case AUDIO_GET_RTAC_CVP_CAL:
|
||||
mutex_lock(&rtac_voice_cal_mutex);
|
||||
opcode = q6common_is_instance_id_supported() ?
|
||||
VSS_ICOMMON_CMD_GET_PARAM_V3 :
|
||||
VSS_ICOMMON_CMD_GET_PARAM_V2;
|
||||
result = send_voice_apr(RTAC_CVP, (void *) arg, opcode);
|
||||
mutex_unlock(&rtac_voice_cal_mutex);
|
||||
break;
|
||||
case AUDIO_SET_RTAC_CVP_CAL:
|
||||
mutex_lock(&rtac_voice_cal_mutex);
|
||||
opcode = q6common_is_instance_id_supported() ?
|
||||
VSS_ICOMMON_CMD_SET_PARAM_V3 :
|
||||
VSS_ICOMMON_CMD_SET_PARAM_V2;
|
||||
result = send_voice_apr(RTAC_CVP, (void *) arg, opcode);
|
||||
mutex_unlock(&rtac_voice_cal_mutex);
|
||||
break;
|
||||
case AUDIO_GET_RTAC_AFE_CAL:
|
||||
mutex_lock(&rtac_afe_cal_mutex);
|
||||
opcode = q6common_is_instance_id_supported() ?
|
||||
AFE_PORT_CMD_GET_PARAM_V3 :
|
||||
AFE_PORT_CMD_GET_PARAM_V2;
|
||||
result = send_rtac_afe_apr((void __user *) arg, opcode);
|
||||
mutex_unlock(&rtac_afe_cal_mutex);
|
||||
break;
|
||||
case AUDIO_SET_RTAC_AFE_CAL:
|
||||
mutex_lock(&rtac_afe_cal_mutex);
|
||||
opcode = q6common_is_instance_id_supported() ?
|
||||
AFE_PORT_CMD_SET_PARAM_V3 :
|
||||
AFE_PORT_CMD_SET_PARAM_V2;
|
||||
result = send_rtac_afe_apr((void __user *) arg, opcode);
|
||||
mutex_unlock(&rtac_afe_cal_mutex);
|
||||
break;
|
||||
default:
|
||||
pr_err("%s: Invalid IOCTL, command = %d!\n",
|
||||
|
|
@ -1900,6 +1883,7 @@ static long rtac_ioctl(struct file *f,
|
|||
{
|
||||
int result = 0;
|
||||
|
||||
mutex_lock(&rtac_common.rtac_fops_mutex);
|
||||
if (!arg) {
|
||||
pr_err("%s: No data sent to driver!\n", __func__);
|
||||
result = -EFAULT;
|
||||
|
|
@ -1907,6 +1891,7 @@ static long rtac_ioctl(struct file *f,
|
|||
result = rtac_ioctl_shared(f, cmd, (void __user *)arg);
|
||||
}
|
||||
|
||||
mutex_unlock(&rtac_common.rtac_fops_mutex);
|
||||
return result;
|
||||
}
|
||||
|
||||
|
|
@ -1929,6 +1914,7 @@ static long rtac_compat_ioctl(struct file *f,
|
|||
{
|
||||
int result = 0;
|
||||
|
||||
mutex_lock(&rtac_common.rtac_fops_mutex);
|
||||
if (!arg) {
|
||||
pr_err("%s: No data sent to driver!\n", __func__);
|
||||
result = -EINVAL;
|
||||
|
|
@ -1981,6 +1967,7 @@ process:
|
|||
break;
|
||||
}
|
||||
done:
|
||||
mutex_unlock(&rtac_common.rtac_fops_mutex);
|
||||
return result;
|
||||
}
|
||||
#else
|
||||
|
|
@ -2008,6 +1995,7 @@ int __init rtac_init(void)
|
|||
/* Driver */
|
||||
atomic_set(&rtac_common.usage_count, 0);
|
||||
atomic_set(&rtac_common.apr_err_code, 0);
|
||||
mutex_init(&rtac_common.rtac_fops_mutex);
|
||||
|
||||
/* ADM */
|
||||
memset(&rtac_adm_data, 0, sizeof(rtac_adm_data));
|
||||
|
|
@ -2016,7 +2004,6 @@ int __init rtac_init(void)
|
|||
init_waitqueue_head(&rtac_adm_apr_data.cmd_wait);
|
||||
mutex_init(&rtac_adm_mutex);
|
||||
mutex_init(&rtac_adm_apr_mutex);
|
||||
mutex_init(&rtac_adm_cal_mutex);
|
||||
|
||||
rtac_adm_buffer = kzalloc(
|
||||
rtac_cal[ADM_RTAC_CAL].map_data.map_size, GFP_KERNEL);
|
||||
|
|
@ -2030,7 +2017,6 @@ int __init rtac_init(void)
|
|||
init_waitqueue_head(&rtac_asm_apr_data[i].cmd_wait);
|
||||
}
|
||||
mutex_init(&rtac_asm_apr_mutex);
|
||||
mutex_init(&rtac_asm_cal_mutex);
|
||||
|
||||
rtac_asm_buffer = kzalloc(
|
||||
rtac_cal[ASM_RTAC_CAL].map_data.map_size, GFP_KERNEL);
|
||||
|
|
@ -2044,7 +2030,6 @@ int __init rtac_init(void)
|
|||
atomic_set(&rtac_afe_apr_data.cmd_state, 0);
|
||||
init_waitqueue_head(&rtac_afe_apr_data.cmd_wait);
|
||||
mutex_init(&rtac_afe_apr_mutex);
|
||||
mutex_init(&rtac_afe_cal_mutex);
|
||||
|
||||
rtac_afe_buffer = kzalloc(
|
||||
rtac_cal[AFE_RTAC_CAL].map_data.map_size, GFP_KERNEL);
|
||||
|
|
@ -2063,7 +2048,6 @@ int __init rtac_init(void)
|
|||
}
|
||||
mutex_init(&rtac_voice_mutex);
|
||||
mutex_init(&rtac_voice_apr_mutex);
|
||||
mutex_init(&rtac_voice_cal_mutex);
|
||||
|
||||
rtac_voice_buffer = kzalloc(
|
||||
rtac_cal[VOICE_RTAC_CAL].map_data.map_size, GFP_KERNEL);
|
||||
|
|
|
|||
Loading…
Reference in a new issue