Commit 7a811175 authored Dec 12, 2023 by Panicker Harish

msm_serial_hs: Fix race between mod_timer and del_timer calls



Deletion of timer and synchronization of the handler will happen
during del_timer, but in the issue case the timer got deleted and
before handler_sync should happen the timer is getting modified or
accessed which further leads to kernel panic.

Fix this by modifying del_timer to del_timer_sync so that the timer
is protected until synchronization happen.

Change-Id: If5dec66b9bbcb5369898536ba1c727b487a13018
Signed-off-by: Venkata Manasa Kakarla <venkka@codeaurora.org>
Signed-off-by: Yatish Kumar Singh <quic_yatishku@quicinc.com>
Signed-off-by: Panicker Harish <quic_pharish@quicinc.com>

parent ad5ca445

drivers/tty/serial/msm_serial_hs.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1849,7 +1849,7 @@ static void msm_hs_sps_tx_callback(struct sps_event_notify *notify)
	&addr, notify->data.transfer.iovec.size,		&addr, notify->data.transfer.iovec.size,
	notify->data.transfer.iovec.flags);		notify->data.transfer.iovec.flags);

	del_timer(&msm_uport->tx.tx_timeout_timer);		del_timer_sync(&msm_uport->tx.tx_timeout_timer);
	MSM_HS_DBG("%s(): Queue kthread work\n", __func__);		MSM_HS_DBG("%s(): Queue kthread work\n", __func__);
	kthread_queue_work(&msm_uport->tx.kworker, &msm_uport->tx.kwork);		kthread_queue_work(&msm_uport->tx.kworker, &msm_uport->tx.kwork);
	}		}