Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d537afa0 authored by Nicolas Saenz Julienne's avatar Nicolas Saenz Julienne Committed by Greg Kroah-Hartman
Browse files

firmware: raspberrypi: Keep count of all consumers 



[ Upstream commit 1e7c57355a3bc617fc220234889e49fe722a6305 ]

When unbinding the firmware device we need to make sure it has no
consumers left. Otherwise we'd leave them with a firmware handle
pointing at freed memory.

Keep a reference count of all consumers and introduce rpi_firmware_put()
which will permit automatically decrease the reference count upon
unbinding consumer drivers.

Suggested-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: default avatarNicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Reviewed-by: default avatarStephen Boyd <sboyd@kernel.org>
Reviewed-by: default avatarBartosz Golaszewski <bgolaszewski@baylibre.com>
Stable-dep-of: 5bca3688bdbc ("Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 919f4703

drivers/firmware/raspberrypi.c

+37 −3
Original line number Original line Diff line number Diff line
@@ -7,6 +7,7 @@ 
 */

 */





#include <linux/dma-mapping.h>

#include <linux/dma-mapping.h>

#include <linux/kref.h>

#include <linux/mailbox_client.h>

#include <linux/mailbox_client.h>

#include <linux/module.h>

#include <linux/module.h>

#include <linux/of_platform.h>

#include <linux/of_platform.h>
@@ -27,6 +28,8 @@ struct rpi_firmware { 
	struct mbox_chan *chan; /* The property channel. */

	struct mbox_chan *chan; /* The property channel. */

	struct completion c;

	struct completion c;

	u32 enabled;

	u32 enabled;



	struct kref consumers;

};

};





static DEFINE_MUTEX(transaction_lock);

static DEFINE_MUTEX(transaction_lock);
@@ -214,12 +217,31 @@ static void rpi_register_clk_driver(struct device *dev) 
						-1, NULL, 0);

						-1, NULL, 0);

}

}





static void rpi_firmware_delete(struct kref *kref)

{

	struct rpi_firmware *fw = container_of(kref, struct rpi_firmware,

					       consumers);



	mbox_free_channel(fw->chan);

	kfree(fw);

}



void rpi_firmware_put(struct rpi_firmware *fw)

{

	kref_put(&fw->consumers, rpi_firmware_delete);

}

EXPORT_SYMBOL_GPL(rpi_firmware_put);



static int rpi_firmware_probe(struct platform_device *pdev)

static int rpi_firmware_probe(struct platform_device *pdev)

{

{

	struct device *dev = &pdev->dev;

	struct device *dev = &pdev->dev;

	struct rpi_firmware *fw;

	struct rpi_firmware *fw;





	fw = devm_kzalloc(dev, sizeof(*fw), GFP_KERNEL);

	/*

	 * Memory will be freed by rpi_firmware_delete() once all users have

	 * released their firmware handles. Don't use devm_kzalloc() here.

	 */

	fw = kzalloc(sizeof(*fw), GFP_KERNEL);

	if (!fw)

	if (!fw)

		return -ENOMEM;

		return -ENOMEM;
@@ -236,6 +258,7 @@ static int rpi_firmware_probe(struct platform_device *pdev) 
	}

	}





	init_completion(&fw->c);

	init_completion(&fw->c);

	kref_init(&fw->consumers);





	platform_set_drvdata(pdev, fw);

	platform_set_drvdata(pdev, fw);
@@ -264,7 +287,8 @@ static int rpi_firmware_remove(struct platform_device *pdev) 
	rpi_hwmon = NULL;

	rpi_hwmon = NULL;

	platform_device_unregister(rpi_clk);

	platform_device_unregister(rpi_clk);

	rpi_clk = NULL;

	rpi_clk = NULL;

	mbox_free_channel(fw->chan);



	rpi_firmware_put(fw);





	return 0;

	return 0;

}

}
@@ -273,16 +297,26 @@ static int rpi_firmware_remove(struct platform_device *pdev) 
 * rpi_firmware_get - Get pointer to rpi_firmware structure.

 * rpi_firmware_get - Get pointer to rpi_firmware structure.

 * @firmware_node:    Pointer to the firmware Device Tree node.

 * @firmware_node:    Pointer to the firmware Device Tree node.

 *

 *

 * The reference to rpi_firmware has to be released with rpi_firmware_put().

 *

 * Returns NULL is the firmware device is not ready.

 * Returns NULL is the firmware device is not ready.

 */

 */

struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)

struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)

{

{

	struct platform_device *pdev = of_find_device_by_node(firmware_node);

	struct platform_device *pdev = of_find_device_by_node(firmware_node);

	struct rpi_firmware *fw;





	if (!pdev)

	if (!pdev)

		return NULL;

		return NULL;





	return platform_get_drvdata(pdev);

	fw = platform_get_drvdata(pdev);

	if (!fw)

		return NULL;



	if (!kref_get_unless_zero(&fw->consumers))

		return NULL;



	return fw;

}

}

EXPORT_SYMBOL_GPL(rpi_firmware_get);

EXPORT_SYMBOL_GPL(rpi_firmware_get);

include/soc/bcm2835/raspberrypi-firmware.h

+2 −0
Original line number Original line Diff line number Diff line
@@ -140,6 +140,7 @@ int rpi_firmware_property(struct rpi_firmware *fw, 
			  u32 tag, void *data, size_t len);

			  u32 tag, void *data, size_t len);

int rpi_firmware_property_list(struct rpi_firmware *fw,

int rpi_firmware_property_list(struct rpi_firmware *fw,

			       void *data, size_t tag_size);

			       void *data, size_t tag_size);

void rpi_firmware_put(struct rpi_firmware *fw);

struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node);

struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node);

#else

#else

static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag,

static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag,
@@ -154,6 +155,7 @@ static inline int rpi_firmware_property_list(struct rpi_firmware *fw, 
	return -ENOSYS;

	return -ENOSYS;

}

}





static inline void rpi_firmware_put(struct rpi_firmware *fw) { }

static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)

static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)

{

{

	return NULL;

	return NULL;