Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c27cf71 authored by Deepak Kumar Singh's avatar Deepak Kumar Singh
Browse files

soc: qcom: glink_probe: Use ref count for holding ssr context 



During ssr rpmsg ssr device will unregister, which can result
in use of stale device pointer in ssr callback function.

Now incrementing refcount inside ssr callback function to
prevent release of rpmsg device.

CRs-Fixed: 2551255
Change-Id: If3fc57c4635378dc6fdcb7df120c83dca0e83758
Signed-off-by: default avatarDeepak Kumar Singh <deesin@codeaurora.org>
parent c0512624

drivers/soc/qcom/glink_probe.c

+19 −2
Original line number Diff line number Diff line
@@ -69,6 +69,7 @@ struct glink_ssr { 
	u32 seq_num;

	struct completion completion;

	struct work_struct unreg_work;

	struct kref refcount;

};



struct edge_info {
@@ -86,6 +87,18 @@ struct edge_info { 
};

LIST_HEAD(edge_infos);



static void glink_ssr_release(struct kref *ref)

{

	struct glink_ssr *ssr = container_of(ref, struct glink_ssr,

					     refcount);

	struct glink_ssr_nb *nb, *tmp;



	list_for_each_entry_safe(nb, tmp, &ssr->notify_list, list)

		kfree(nb);



	kfree(ssr);

}



static void glink_ssr_ssr_unreg_work(struct work_struct *work)

{

	struct glink_ssr *ssr = container_of(work, struct glink_ssr,
@@ -95,9 +108,8 @@ static void glink_ssr_ssr_unreg_work(struct work_struct *work) 
	list_for_each_entry_safe(nb, tmp, &ssr->notify_list, list) {

		subsys_notif_unregister_notifier(nb->ssr_register_handle,

						 &nb->nb);

		kfree(nb);

	}

	kfree(ssr);

	kref_put(&ssr->refcount, glink_ssr_release);

}



static int glink_ssr_ssr_cb(struct notifier_block *this,
@@ -112,6 +124,8 @@ static int glink_ssr_ssr_cb(struct notifier_block *this, 
	if (!dev || !ssr->ept)

		return NOTIFY_DONE;



	kref_get(&ssr->refcount);



	if (code == SUBSYS_AFTER_SHUTDOWN) {

		ssr->seq_num++;

		reinit_completion(&ssr->completion);
@@ -130,6 +144,7 @@ static int glink_ssr_ssr_cb(struct notifier_block *this, 
		if (ret) {

			GLINK_ERR(dev, "fail to send do cleanup to %s %d\n",

				  nb->ssr_label, ret);

			kref_put(&ssr->refcount, glink_ssr_release);

			return NOTIFY_DONE;

		}
@@ -137,6 +152,7 @@ static int glink_ssr_ssr_cb(struct notifier_block *this, 
		if (!ret)

			GLINK_ERR(dev, "timeout waiting for cleanup resp\n");

	}

	kref_put(&ssr->refcount, glink_ssr_release);

	return NOTIFY_DONE;

}
@@ -232,6 +248,7 @@ static int glink_ssr_probe(struct rpmsg_device *rpdev) 
	INIT_LIST_HEAD(&ssr->notify_list);

	init_completion(&ssr->completion);

	INIT_WORK(&ssr->unreg_work, glink_ssr_ssr_unreg_work);

	kref_init(&ssr->refcount);



	ssr->dev = &rpdev->dev;

	ssr->ept = rpdev->ept;