Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 180cb628 authored by Arun Kumar Neelakantam's avatar Arun Kumar Neelakantam Committed by Gerrit - the friendly Code Review server
Browse files

soc: qcom: qmi_interface: sync release and data_ready callback 



Receiving data on a socket which is getting closed by client at same time
can cause invalid pointer access.

Use sk_callback_lock to sync between data_read callback and socket close.

CRs-Fixed: 2372711
Change-Id: I98951a86a6a53bf196026a342ec4fff726bedf92
Signed-off-by: default avatarArun Kumar Neelakantam <aneela@codeaurora.org>
parent 352a344c

drivers/soc/qcom/qmi_interface.c

+9 −2
Original line number Original line Diff line number Diff line
@@ -575,16 +575,21 @@ static void qmi_data_ready_work(struct work_struct *work) 




static void qmi_data_ready(struct sock *sk)

static void qmi_data_ready(struct sock *sk)

{

{

	struct qmi_handle *qmi = sk->sk_user_data;

	struct qmi_handle *qmi = NULL;





	/*

	/*

	 * This will be NULL if we receive data while being in

	 * This will be NULL if we receive data while being in

	 * qmi_handle_release()

	 * qmi_handle_release()

	 */

	 */

	if (!qmi)

	read_lock_bh(&sk->sk_callback_lock);

	qmi = sk->sk_user_data;

	if (!qmi) {

		read_unlock_bh(&sk->sk_callback_lock);

		return;

		return;

	}





	queue_work(qmi->wq, &qmi->work);

	queue_work(qmi->wq, &qmi->work);

	read_unlock_bh(&sk->sk_callback_lock);

}

}





static struct socket *qmi_sock_create(struct qmi_handle *qmi,

static struct socket *qmi_sock_create(struct qmi_handle *qmi,
@@ -691,7 +696,9 @@ void qmi_handle_release(struct qmi_handle *qmi) 
	struct qmi_txn *txn;

	struct qmi_txn *txn;

	int txn_id;

	int txn_id;





	write_lock_bh(&sock->sk->sk_callback_lock);

	sock->sk->sk_user_data = NULL;

	sock->sk->sk_user_data = NULL;

	write_unlock_bh(&sock->sk->sk_callback_lock);

	cancel_work_sync(&qmi->work);

	cancel_work_sync(&qmi->work);





	qmi_recv_del_server(qmi, -1, -1);

	qmi_recv_del_server(qmi, -1, -1);