Merge "msm: adsprpc: Protect maps using map mutex" (0550e6d3) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/char/adsprpc.c

+21 −16

Original line number	Diff line number	Diff line
		@@ -2501,7 +2501,7 @@ static int fastrpc_get_spd_session(char name, int session, int *cid)

		static int fastrpc_mmap_remove_pdr(struct fastrpc_file *fl);
		static int fastrpc_channel_open(struct fastrpc_file *fl);
		static int fastrpc_mmap_remove_ssr(struct fastrpc_file *fl);
		static int fastrpc_mmap_remove_ssr(struct fastrpc_file *fl, int locked);
		static int fastrpc_init_process(struct fastrpc_file *fl,
		struct fastrpc_ioctl_init_attrs *uproc)
		{
		@@ -3081,7 +3081,7 @@ static int fastrpc_mmap_on_dsp(struct fastrpc_file *fl, uint32_t flags,
		}

		static int fastrpc_munmap_on_dsp_rh(struct fastrpc_file *fl, uint64_t phys,
		size_t size, uint32_t flags)
		size_t size, uint32_t flags, int locked)
		{
		int err = 0;
		struct fastrpc_apps *me = &gfa;
		@@ -3092,13 +3092,14 @@ static int fastrpc_munmap_on_dsp_rh(struct fastrpc_file *fl, uint64_t phys,
		if (flags == ADSP_MMAP_HEAP_ADDR) {
		struct fastrpc_ioctl_invoke_crc ioctl;
		remote_arg_t ra[2];
		int err = 0;
		int err = 0, cid = 0;
		struct {
		uint8_t skey;
		} routargs;

		if (fl == NULL)
		goto bail;
		cid = fl->cid;
		tgid = fl->tgid;
		ra[0].buf.pv = (void *)&tgid;
		ra[0].buf.len = sizeof(tgid);
		@@ -3113,8 +3114,16 @@ static int fastrpc_munmap_on_dsp_rh(struct fastrpc_file *fl, uint64_t phys,
		ioctl.attrs = NULL;
		ioctl.crc = NULL;

		if (locked) {
		mutex_unlock(&fl->map_mutex);
		mutex_unlock(&me->channel[cid].smd_mutex);
		}
		VERIFY(err, 0 == (err = fastrpc_internal_invoke(fl,
		FASTRPC_MODE_PARALLEL, 1, &ioctl)));
		if (locked) {
		mutex_lock(&me->channel[cid].smd_mutex);
		mutex_lock(&fl->map_mutex);
		}
		if (err)
		goto bail;
		} else if (flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
		@@ -3148,7 +3157,8 @@ static int fastrpc_munmap_on_dsp(struct fastrpc_file *fl, uintptr_t raddr,
		goto bail;
		if (flags == ADSP_MMAP_HEAP_ADDR \|\|
		flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
		VERIFY(err, !fastrpc_munmap_on_dsp_rh(fl, phys, size, flags));
		VERIFY(err, !fastrpc_munmap_on_dsp_rh(fl, phys, size,
		flags, 0));
		if (err)
		goto bail;
		}
		@@ -3156,7 +3166,7 @@ static int fastrpc_munmap_on_dsp(struct fastrpc_file *fl, uintptr_t raddr,
		return err;
		}

		static int fastrpc_mmap_remove_ssr(struct fastrpc_file *fl)
		static int fastrpc_mmap_remove_ssr(struct fastrpc_file *fl, int locked)
		{
		struct fastrpc_mmap match = NULL, map = NULL;
		struct hlist_node *n = NULL;
		@@ -3179,7 +3189,7 @@ static int fastrpc_mmap_remove_ssr(struct fastrpc_file *fl)

		if (match) {
		err = fastrpc_munmap_on_dsp_rh(fl, match->phys,
		match->size, match->flags);
		match->size, match->flags, locked);
		if (err)
		goto bail;
		if (me->ramdump_handle && me->enable_ramdump) {
		@@ -3198,18 +3208,13 @@ static int fastrpc_mmap_remove_ssr(struct fastrpc_file *fl)
		kfree(ramdump_segments_rh);
		}
		}
		mutex_lock(&fl->map_mutex);
		fastrpc_mmap_free(match, 0);
		mutex_unlock(&fl->map_mutex);
		}
		} while (match);
		me->enable_ramdump = false;
		bail:
		if (err && match) {
		mutex_lock(&fl->map_mutex);
		if (err && match)
		fastrpc_mmap_add(match);
		mutex_unlock(&fl->map_mutex);
		}
		return err;
		}

		@@ -3231,7 +3236,7 @@ static int fastrpc_mmap_remove_pdr(struct fastrpc_file *fl)
		}
		if (me->channel[fl->cid].spd[session].pdrcount !=
		me->channel[fl->cid].spd[session].prevpdrcount) {
		err = fastrpc_mmap_remove_ssr(fl);
		err = fastrpc_mmap_remove_ssr(fl, 0);
		if (err)
		pr_warn("adsprpc: %s: %s: failed to unmap remote heap (err %d)\n",
		__func__, current->comm, err);
		@@ -4018,13 +4023,13 @@ static int fastrpc_channel_open(struct fastrpc_file *fl)

		if (cid == ADSP_DOMAIN_ID && me->channel[cid].ssrcount !=
		me->channel[cid].prevssrcount) {
		mutex_unlock(&me->channel[cid].smd_mutex);
		err = fastrpc_mmap_remove_ssr(fl);
		mutex_lock(&fl->map_mutex);
		err = fastrpc_mmap_remove_ssr(fl, 1);
		mutex_unlock(&fl->map_mutex);
		if (err)
		pr_warn("adsprpc: %s: %s: failed to unmap remote heap for %s (err %d)\n",
		__func__, current->comm,
		me->channel[cid].subsys, err);
		mutex_lock(&me->channel[cid].smd_mutex);
		me->channel[cid].prevssrcount =
		me->channel[cid].ssrcount;
		}