Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed47fedc authored by Manoj Prabhu B's avatar Manoj Prabhu B
Browse files

diag: Do not USB write_done if MHI has gone down 



Race condition in handling MHI read channel buffers while external
proc has gone down and USB connect and disconnect events is prevented
by not freeing the read channel buffer when USB has notified write_done
if MHI has gone down.

Change-Id: I725b5115947390c7659047ac6848a797e1854a93
Signed-off-by: default avatarManoj Prabhu B <bmanoj@codeaurora.org>
parent 3f43b0f2

drivers/char/diag/diagfwd_mhi.c

+13 −0
Original line number Diff line number Diff line
@@ -44,6 +44,7 @@ struct diag_mhi_info diag_mhi[NUM_MHI_DEV][NUM_MHI_CHAN] = { 
			.name = "MDM",

			.enabled = 0,

			.num_read = 0,

			.device_reset = 0,

			.mempool = POOL_TYPE_MDM,

			.mempool_init = 0,

			.mhi_wq = NULL,
@@ -61,6 +62,7 @@ struct diag_mhi_info diag_mhi[NUM_MHI_DEV][NUM_MHI_CHAN] = { 
			.name = "MDM_DCI",

			.enabled = 0,

			.num_read = 0,

			.device_reset = 0,

			.mempool = POOL_TYPE_MDM_DCI,

			.mempool_init = 0,

			.mhi_wq = NULL,
@@ -80,6 +82,7 @@ struct diag_mhi_info diag_mhi[NUM_MHI_DEV][NUM_MHI_CHAN] = { 
			.name = "MDM_2",

			.enabled = 0,

			.num_read = 0,

			.device_reset = 0,

			.mempool = POOL_TYPE_MDM2,

			.mempool_init = 0,

			.mhi_wq = NULL,
@@ -97,6 +100,7 @@ struct diag_mhi_info diag_mhi[NUM_MHI_DEV][NUM_MHI_CHAN] = { 
			.name = "MDM_DCI_2",

			.enabled = 0,

			.num_read = 0,

			.device_reset = 0,

			.mempool = POOL_TYPE_MDM2_DCI,

			.mempool_init = 0,

			.mhi_wq = NULL,
@@ -294,6 +298,7 @@ static int __mhi_close(struct diag_mhi_info *mhi_info, int close_flag) 
	}

	mhi_buf_tbl_clear(mhi_info);

	diag_remote_dev_close(mhi_info->dev_id);

	mhi_info->device_reset = 1;

	return 0;

}
@@ -377,6 +382,7 @@ static int __mhi_open(struct diag_mhi_info *mhi_info, int token, int open_flag) 
		}

	}



	mhi_info->device_reset = 0;

	diag_remote_dev_open(mhi_info->dev_id);

	queue_work(mhi_info->mhi_wq, &(mhi_info->read_work));

	return 0;
@@ -661,6 +667,13 @@ static int mhi_fwd_complete(int token, int ch, unsigned char *buf, 
	if (!buf)

		return -EINVAL;



	if (diag_mhi[dev_idx][ch].device_reset) {

		DIAG_LOG(DIAG_DEBUG_MHI,

		"Device (id: %d, ch: %d) has gone down, skip freeing buffer %pK len:%d\n",

		dev_idx, ch, buf, len);

		return -ENODEV;

	}



	DIAG_LOG(DIAG_DEBUG_MHI,

		"Remove buffer from mhi read table after write completion %pK len:%d\n",

		buf, len);

drivers/char/diag/diagfwd_mhi.h

+2 −1
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/* Copyright (c) 2014-2019, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014-2020, The Linux Foundation. All rights reserved.

 */



#ifndef DIAGFWD_MHI_H
@@ -60,6 +60,7 @@ struct diag_mhi_info { 
	int mempool;

	int mempool_init;

	int num_read;

	int device_reset;

	uint8_t enabled;

	struct mhi_device *mhi_dev;

	char name[DIAG_MHI_NAME_SZ];