Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a5b4fc1 authored by Prasad Kumpatla's avatar Prasad Kumpatla Committed by Soumya Managoli
Browse files

dsp: add lock in ion free to avoid use after free 



add lock in ion free to protect dma buff and avoid
use after freex

Change-Id: I6376408ce1a5b98b7aeacc32e44ec4db08ff9df5
Signed-off-by: default avatarPrasad Kumpatla <quic_pkumpatl@quicinc.com>
(cherry picked from commit b0c91b9bd989a15a6c95196936f266435cbee52e)
parent df9a245b

dsp/msm_audio_ion.c

+21 −8
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

<<<<<<< HEAD   (df9a24 dsp: q6lsm: Add check for payload buffer)

 * Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.

=======

 * Copyright (c) 2013-2019, 2020, The Linux Foundation. All rights reserved.

 *

 * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.

>>>>>>> CHANGE (b0c91b dsp: add lock in ion free to avoid use after free)

 */



#include <linux/init.h>
@@ -63,6 +69,7 @@ static void msm_audio_ion_add_allocation( 
	mutex_unlock(&(msm_audio_ion_data->list_mutex));

}



/* This function is called with ion_data list mutex lock */

static int msm_audio_dma_buf_map(struct dma_buf *dma_buf,

				 dma_addr_t *addr, size_t *len)

{
@@ -151,7 +158,6 @@ static int msm_audio_dma_buf_unmap(struct dma_buf *dma_buf) 
	 * should be explicitly acquired to avoid race condition

	 * on adding elements to the list.

	 */

	mutex_lock(&(msm_audio_ion_data.list_mutex));

	list_for_each_safe(ptr, next,

			    &(msm_audio_ion_data.alloc_list)) {
@@ -175,7 +181,6 @@ static int msm_audio_dma_buf_unmap(struct dma_buf *dma_buf) 
			break;

		}

	}

	mutex_unlock(&(msm_audio_ion_data.list_mutex));



	if (!found) {

		dev_err(cb_dev,
@@ -230,6 +235,7 @@ int msm_audio_ion_get_smmu_info(struct device **cb_dev, 
	return 0;

}



/* This function is called with ion_data list mutex lock */

static void *msm_audio_ion_map_kernel(struct dma_buf *dma_buf)

{

	int rc = 0;
@@ -278,7 +284,6 @@ static int msm_audio_ion_unmap_kernel(struct dma_buf *dma_buf) 
	 * TBD: remove the below section once new API

	 * for unmapping kernel virtual address is available.

	 */

	mutex_lock(&(msm_audio_ion_data.list_mutex));

	list_for_each_entry(alloc_data, &(msm_audio_ion_data.alloc_list),

			    list) {

		if (alloc_data->dma_buf == dma_buf) {
@@ -286,7 +291,6 @@ static int msm_audio_ion_unmap_kernel(struct dma_buf *dma_buf) 
			break;

		}

	}

	mutex_unlock(&(msm_audio_ion_data.list_mutex));



	if (!vaddr) {

		dev_err(cb_dev,
@@ -309,7 +313,8 @@ static int msm_audio_ion_unmap_kernel(struct dma_buf *dma_buf) 
	return rc;

}



static int msm_audio_ion_map_buf(struct dma_buf *dma_buf, dma_addr_t *paddr,

/* This function is called with ion_data list mutex lock */

static int msm_audio_ion_buf_map(struct dma_buf *dma_buf, dma_addr_t *paddr,

				 size_t *plen, void **vaddr)

{

	int rc = 0;
@@ -331,7 +336,10 @@ static int msm_audio_ion_map_buf(struct dma_buf *dma_buf, dma_addr_t *paddr, 
	if (IS_ERR_OR_NULL(*vaddr)) {

		pr_err("%s: ION memory mapping for AUDIO failed\n", __func__);

		rc = -ENOMEM;

		mutex_lock(&(msm_audio_ion_data.list_mutex));

		msm_audio_dma_buf_unmap(dma_buf);

		mutex_unlock(&(msm_audio_ion_data.list_mutex));



		goto err;

	}
@@ -390,7 +398,7 @@ int msm_audio_ion_alloc(struct dma_buf **dma_buf, size_t bufsz, 
		goto err;

	}



	rc = msm_audio_ion_map_buf(*dma_buf, paddr, plen, vaddr);

	rc = msm_audio_ion_buf_map(*dma_buf, paddr, plen, vaddr);

	if (rc) {

		pr_err("%s: failed to map ION buf, rc = %d\n", __func__, rc);

		goto err;
@@ -490,7 +498,7 @@ int msm_audio_ion_import(struct dma_buf **dma_buf, int fd, 
		}

	}



	rc = msm_audio_ion_map_buf(*dma_buf, paddr, plen, vaddr);

	rc = msm_audio_ion_buf_map(*dma_buf, paddr, plen, vaddr);

	if (rc) {

		pr_err("%s: failed to map ION buf, rc = %d\n", __func__, rc);

		goto err;
@@ -516,6 +524,7 @@ EXPORT_SYMBOL(msm_audio_ion_import); 
 *

 * Returns 0 on success or error on failure

 */

/* This funtion is called with ion_data list mutex lock */

int msm_audio_ion_free(struct dma_buf *dma_buf)

{

	int ret = 0;
@@ -525,11 +534,15 @@ int msm_audio_ion_free(struct dma_buf *dma_buf) 
		return -EINVAL;

	}



	mutex_lock(&(msm_audio_ion_data.list_mutex));

	ret = msm_audio_ion_unmap_kernel(dma_buf);

	if (ret)

	if (ret) {

		mutex_unlock(&(msm_audio_ion_data.list_mutex));

		return ret;

	}



	msm_audio_dma_buf_unmap(dma_buf);

	mutex_unlock(&(msm_audio_ion_data.list_mutex));



	return 0;

}