Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit afce6728 authored by Amir Samuelov's avatar Amir Samuelov Committed by Gerrit - the friendly Code Review server
Browse files

spcom: avoid race condition when handling commands 



The spcom allows only one owner per channel, so only one app can open()
a channel char device at a time.
However, the channel owner process might share the channel file
descriptor (fd) with other threads, that might write() concurrently
a command to spcom, that can cause a race.
Add a mutex to "serialize" handling of the commands.

Change-Id: Ief9c6c48a862444dfff66d14d2317568cd6e81e6
Signed-off-by: default avatarAmir Samuelov <amirs@codeaurora.org>
parent 90355b6e

drivers/soc/qcom/spcom.c

+7 −3
Original line number Diff line number Diff line
@@ -242,7 +242,7 @@ struct spcom_device { 
	int channel_count;



	/* private */

	struct mutex lock;

	struct mutex cmd_lock;



	/* Link state */

	struct completion link_state_changed;
@@ -1962,6 +1962,8 @@ static int spcom_handle_write(struct spcom_channel *ch, 
	swap_id = htonl(cmd->cmd_id);

	memcpy(cmd_name, &swap_id, sizeof(int));



	mutex_lock(&spcom_dev->cmd_lock);



	pr_debug("cmd_id [0x%x] cmd_name [%s].\n", cmd_id, cmd_name);



	switch (cmd_id) {
@@ -1985,9 +1987,11 @@ static int spcom_handle_write(struct spcom_channel *ch, 
		break;

	default:

		pr_err("Invalid Command Id [0x%x].\n", (int) cmd->cmd_id);

		return -EINVAL;

		ret = -EINVAL;

	}



	mutex_unlock(&spcom_dev->cmd_lock);



	return ret;

}
@@ -2688,7 +2692,7 @@ static int spcom_probe(struct platform_device *pdev) 
		return -ENOMEM;



	spcom_dev = dev;

	mutex_init(&dev->lock);

	mutex_init(&spcom_dev->cmd_lock);

	init_completion(&dev->link_state_changed);

	spcom_dev->link_state = GLINK_LINK_STATE_DOWN;