Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 101e9304 authored by Ajay Singh Parmar's avatar Ajay Singh Parmar Committed by Gerrit - the friendly Code Review server
Browse files

drm/msm/dp: protect edid and dpcd buffers with mutex 



The EDID and DPCD buffers are allocated and deallocated
in debug module while running in simulation mode. There
can be a race condition if multiple scripts are run and
result in double free of the buffers.

Protect the buffer allocation and deallocation functionalities
with a mutex so that such race conditions can be avoided.

CRs-Fixed: 2357704
Change-Id: Id00c0c95dc0151bf50389ec509ab8372c4ce5102
Signed-off-by: default avatarAjay Singh Parmar <aparmar@codeaurora.org>
parent 48457358

drivers/gpu/drm/msm/dp/dp_debug.c

+17 −0
Original line number Diff line number Diff line
@@ -50,6 +50,7 @@ struct dp_debug_private { 
	struct dp_debug dp_debug;

	struct dp_parser *parser;

	struct dp_ctrl *ctrl;

	struct mutex lock;

};



static int dp_debug_get_edid_buf(struct dp_debug_private *debug)
@@ -99,6 +100,8 @@ static ssize_t dp_debug_write_edid(struct file *file, 
	if (!debug)

		return -ENODEV;



	mutex_lock(&debug->lock);



	if (*ppos)

		goto bail;
@@ -170,6 +173,7 @@ static ssize_t dp_debug_write_edid(struct file *file, 
	 */

	pr_info("[%s]\n", edid ? "SET" : "CLEAR");



	mutex_unlock(&debug->lock);

	return rc;

}
@@ -189,6 +193,8 @@ static ssize_t dp_debug_write_dpcd(struct file *file, 
	if (!debug)

		return -ENODEV;



	mutex_lock(&debug->lock);



	if (*ppos)

		goto bail;
@@ -270,6 +276,7 @@ static ssize_t dp_debug_write_dpcd(struct file *file, 
		debug->aux->dpcd_updated(debug->aux);

	}



	mutex_unlock(&debug->lock);

	return rc;

}
@@ -1449,6 +1456,7 @@ static void dp_debug_set_sim_mode(struct dp_debug_private *debug, bool sim) 


		if (dp_debug_get_dpcd_buf(debug)) {

			devm_kfree(debug->dev, debug->edid);

			debug->edid = NULL;

			return;

		}
@@ -1497,6 +1505,8 @@ static ssize_t dp_debug_write_sim(struct file *file, 
	if (*ppos)

		return 0;



	mutex_lock(&debug->lock);



	/* Leave room for termination char */

	len = min_t(size_t, count, SZ_8 - 1);

	if (copy_from_user(buf, user_buff, len))
@@ -1509,6 +1519,7 @@ static ssize_t dp_debug_write_sim(struct file *file, 


	dp_debug_set_sim_mode(debug, sim);

end:

	mutex_unlock(&debug->lock);

	return len;

}
@@ -1995,7 +2006,9 @@ static void dp_debug_abort(struct dp_debug *dp_debug) 


	debug = container_of(dp_debug, struct dp_debug_private, dp_debug);



	mutex_lock(&debug->lock);

	dp_debug_set_sim_mode(debug, false);

	mutex_unlock(&debug->lock);

}



struct dp_debug *dp_debug_get(struct dp_debug_in *in)
@@ -2033,6 +2046,8 @@ struct dp_debug *dp_debug_get(struct dp_debug_in *in) 
	dp_debug->hdisplay = 0;

	dp_debug->vrefresh = 0;



	mutex_init(&debug->lock);



	rc = dp_debug_init(dp_debug);

	if (rc) {

		devm_kfree(in->dev, debug);
@@ -2084,6 +2099,8 @@ void dp_debug_put(struct dp_debug *dp_debug) 


	dp_debug_deinit(dp_debug);



	mutex_destroy(&debug->lock);



	if (debug->edid)

		devm_kfree(debug->dev, debug->edid);