Merge "msm:ipa: Race condition observed during client disconnect." (fe810133) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/platform/msm/ipa/ipa_v3/ipa_client.c

+1 −3

Original line number	Diff line number	Diff line
		@@ -1845,9 +1845,7 @@ int ipa3_clear_endpoint_delay(u32 clnt_hdl)
		/* Set disconnect in progress flag so further flow control events are
		* not honored.
		*/
		spin_lock(&ipa3_ctx->disconnect_lock);
		ep->disconnect_in_progress = true;
		spin_unlock(&ipa3_ctx->disconnect_lock);
		atomic_set(&ep->disconnect_in_progress, 1);

		/* If flow is disabled at this point, restore the ep state.*/
		ep_ctrl.ipa_ep_delay = false;

+8 −6

Original line number	Diff line number	Diff line
		@@ -2610,11 +2610,8 @@ void ipa3_lan_rx_cb(void *priv, enum ipa_dp_evt_type evt, unsigned long data)
		metadata = status.metadata;
		ucp = status.ucp;
		ep = &ipa3_ctx->ep[src_pipe];
		if (unlikely(src_pipe >= ipa3_ctx->ipa_num_pipes \|\|
		!ep->valid \|\|
		!ep->client_notify)) {
		IPAERR("drop pipe=%d ep_valid=%d client_notify=%p\n",
		src_pipe, ep->valid, ep->client_notify);
		if (unlikely(src_pipe >= ipa3_ctx->ipa_num_pipes)) {
		IPAERR("drop pipe=%d\n", src_pipe);
		dev_kfree_skb_any(rx_skb);
		return;
		}
		@@ -2636,7 +2633,12 @@ void ipa3_lan_rx_cb(void *priv, enum ipa_dp_evt_type evt, unsigned long data)
		metadata, (u32 )rx_skb->cb);
		IPADBG_LOW("ucp: %d\n", (u8 )(rx_skb->cb + 4));

		ep->client_notify(ep->priv, IPA_RECEIVE, (unsigned long)(rx_skb));
		if (likely((!atomic_read(&ep->disconnect_in_progress)) &&
		ep->valid && ep->client_notify))
		ep->client_notify(ep->priv, IPA_RECEIVE,
		(unsigned long)(rx_skb));
		else
		dev_kfree_skb_any(rx_skb);
		}

		static void ipa3_recycle_rx_wrapper(struct ipa3_rx_pkt_wrapper *rx_pkt)

+1 −1

Original line number	Diff line number	Diff line
		@@ -768,7 +768,7 @@ struct ipa3_ep_context {
		bool keep_ipa_awake;
		struct ipa3_wlan_stats wstats;
		u32 uc_offload_state;
		bool disconnect_in_progress;
		atomic_t disconnect_in_progress;
		u32 qmi_request_sent;
		bool napi_enabled;
		u32 eot_in_poll_err;

+3 −0

Original line number	Diff line number	Diff line
		@@ -551,6 +551,9 @@ int ipa3_tear_down_uc_offload_pipes(int ipa_ep_idx_ul,
		return -EFAULT;
		}

		atomic_set(&ep_ul->disconnect_in_progress, 1);
		atomic_set(&ep_dl->disconnect_in_progress, 1);

		if (ipa3_ctx->ipa_hw_type >= IPA_HW_v4_0)
		cmd.size = sizeof(*cmd_data_v4_0);
		else