Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5fed186d authored by Dinesh K Garg's avatar Dinesh K Garg
Browse files

msm: mink: release cbobj refs 



While processing cbobjs, SMCinvoke increases cbobj's refcount when call
goes to user space but when call returns from user space, it doesn't
decreases refcount. Updating refcount logic for cbobj.

Change-Id: I4324c3f983cee46db2fe9d2081a1be2437de7e8c
Signed-off-by: default avatarDinesh K Garg <dineshg@codeaurora.org>
parent 648dc229

drivers/soc/qcom/smcinvoke.c

+12 −0
Original line number Diff line number Diff line
@@ -1232,6 +1232,9 @@ static int marshal_out_tzcb_req(const struct smcinvoke_accept *user_req, 
	int32_t tzhandles_to_release[OBJECT_COUNTS_MAX_OO] = {0};

	struct smcinvoke_tzcb_req *tzcb_req = cb_txn->cb_req;

	union smcinvoke_tz_args *tz_args = tzcb_req->args;

	put_pending_cbobj_locked(

			TZHANDLE_GET_SERVER(cb_txn->cb_req->hdr.tzhandle),

			TZHANDLE_GET_OBJID(cb_txn->cb_req->hdr.tzhandle));



	tzcb_req->result = user_req->result;

	FOR_ARGS(i, tzcb_req->hdr.counts, BO) {
@@ -1268,6 +1271,13 @@ static int marshal_out_tzcb_req(const struct smcinvoke_accept *user_req, 
			goto out;

		tzhandles_to_release[i] = tz_args[i].handle;

	}

	FOR_ARGS(i, tzcb_req->hdr.counts, OI) {

		if (TZHANDLE_IS_CB_OBJ(tz_args[i].handle)) {

			put_pending_cbobj_locked(

				TZHANDLE_GET_SERVER(tz_args[i].handle),

				TZHANDLE_GET_OBJID(tz_args[i].handle));

		}

	}

	ret = 0;

out:

	if (ret)
@@ -1694,6 +1704,8 @@ static int smcinvoke_release(struct inode *nodp, struct file *filp) 


	ret = prepare_send_scm_msg(in_buf, SMCINVOKE_TZ_MIN_BUF_SIZE, out_buf,

		SMCINVOKE_TZ_MIN_BUF_SIZE, &req, NULL, &release_handles);



	process_piggyback_data(out_buf, SMCINVOKE_TZ_MIN_BUF_SIZE);

out:

	kfree(filp->private_data);

	free_page((long)in_buf);