Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eec048bf authored by Michael Adisumarta's avatar Michael Adisumarta
Browse files

msm: ipa: fix race condition around sys->len 



Changes to gaurd sys->len with a spinlock to
avoid race condition between incrementing and
decrementing this value.

Change-Id: I638fea5a1a9cdda10b471fb4fa500079024e24c7
CRs-Fixed: 2093851
Acked-by: default avatarJyothi Jayanthi <jyothij@qti.qualcomm.com>
Signed-off-by: default avatarMichael Adisumarta <madisuma@codeaurora.org>
parent 089d1cb5

drivers/platform/msm/ipa/ipa_v3/ipa_dp.c

+2 −0
Original line number Diff line number Diff line
@@ -2574,6 +2574,7 @@ static void ipa3_wq_rx_common(struct ipa3_sys_context *sys, u32 size) 
		WARN_ON(1);

		return;

	}

	spin_lock_bh(&sys->spinlock);

	rx_pkt_expected = list_first_entry(&sys->head_desc_list,

					   struct ipa3_rx_pkt_wrapper,

					   link);
@@ -2581,6 +2582,7 @@ static void ipa3_wq_rx_common(struct ipa3_sys_context *sys, u32 size) 
	sys->len--;

	if (size)

		rx_pkt_expected->len = size;

	spin_unlock_bh(&sys->spinlock);

	rx_skb = rx_pkt_expected->data.skb;

	dma_unmap_single(ipa3_ctx->pdev, rx_pkt_expected->data.dma_addr,

			sys->rx_buff_sz, DMA_FROM_DEVICE);