Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4fee9c49 authored by Ajay Singh Parmar's avatar Ajay Singh Parmar
Browse files

drm/msm/dp: protect edid and dpcd buffers with mutex 



The EDID and DPCD buffers are allocated and deallocated
in debug module while running in simulation mode. There
can be a race condition if multiple scripts are run and
result in double free of the buffers.

Protect the buffer allocation and deallocation functionalities
with a mutex so that such race conditions can be avoided.

CRs-Fixed: 2357704
Change-Id: Id00c0c95dc0151bf50389ec509ab8372c4ce5102
Signed-off-by: default avatarAjay Singh Parmar <aparmar@codeaurora.org>
parent a9ec0eb5

drivers/gpu/drm/msm/dp/dp_debug.c

+16 −1
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

 * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -49,6 +49,7 @@ struct dp_debug_private { 
	struct device *dev;

	struct work_struct sim_work;

	struct dp_debug dp_debug;

	struct mutex lock;

};



static int dp_debug_get_edid_buf(struct dp_debug_private *debug)
@@ -98,6 +99,8 @@ static ssize_t dp_debug_write_edid(struct file *file, 
	if (!debug)

		return -ENODEV;



	mutex_lock(&debug->lock);



	if (*ppos)

		goto bail;
@@ -148,6 +151,7 @@ static ssize_t dp_debug_write_edid(struct file *file, 
	if (!debug->dp_debug.sim_mode)

		debug->panel->set_edid(debug->panel, edid);



	mutex_unlock(&debug->lock);

	return rc;

}
@@ -166,6 +170,8 @@ static ssize_t dp_debug_write_dpcd(struct file *file, 
	if (!debug)

		return -ENODEV;



	mutex_lock(&debug->lock);



	if (*ppos)

		goto bail;
@@ -230,6 +236,7 @@ static ssize_t dp_debug_write_dpcd(struct file *file, 
	else

		debug->panel->set_dpcd(debug->panel, dpcd);



	mutex_unlock(&debug->lock);

	return rc;

}
@@ -873,6 +880,8 @@ static ssize_t dp_debug_write_sim(struct file *file, 
	if (*ppos)

		return 0;



	mutex_lock(&debug->lock);



	/* Leave room for termination char */

	len = min_t(size_t, count, SZ_8 - 1);

	if (copy_from_user(buf, user_buff, len))
@@ -906,9 +915,11 @@ static ssize_t dp_debug_write_sim(struct file *file, 
	debug->aux->set_sim_mode(debug->aux, debug->dp_debug.sim_mode,

			debug->edid, debug->dpcd);

end:

	mutex_unlock(&debug->lock);

	return len;

error:

	devm_kfree(debug->dev, debug->edid);

	mutex_unlock(&debug->lock);

	return len;

}
@@ -1272,6 +1283,8 @@ struct dp_debug *dp_debug_get(struct device *dev, struct dp_panel *panel, 
	dp_debug->hdisplay = 0;

	dp_debug->vrefresh = 0;



	mutex_init(&debug->lock);



	rc = dp_debug_init(dp_debug);

	if (rc) {

		devm_kfree(dev, debug);
@@ -1308,6 +1321,8 @@ void dp_debug_put(struct dp_debug *dp_debug) 


	dp_debug_deinit(dp_debug);



	mutex_destroy(&debug->lock);



	if (debug->edid)

		devm_kfree(debug->dev, debug->edid);