Merge "diag: Mark global buffer NULL after freeing from mempool" (85ea37a0) · Commits · e / devices / android_kernel_oneplus_sm8150

drivers/char/diag/diagchar.h

+10 −0

Original line number	Diff line number	Diff line
		@@ -719,6 +719,16 @@ extern struct diagchar_dev *driver;
		extern int wrap_enabled;
		extern uint16_t wrap_count;

		struct diag_apps_data_t {
		void *buf;
		uint32_t len;
		int ctxt;
		uint8_t allocated;
		};

		extern struct diag_apps_data_t hdlc_data;
		extern struct diag_apps_data_t non_hdlc_data;

		void diag_get_timestamp(char *time_str);
		void check_drain_timer(void);
		int diag_get_remote(int remote_info);

drivers/char/diag/diagchar_core.c

+37 −15

Original line number	Diff line number	Diff line
		@@ -153,14 +153,8 @@ static int timer_in_progress;
		static int diag_mask_clear_param = 1;
		module_param(diag_mask_clear_param, int, 0644);

		struct diag_apps_data_t {
		void *buf;
		uint32_t len;
		int ctxt;
		};

		static struct diag_apps_data_t hdlc_data;
		static struct diag_apps_data_t non_hdlc_data;
		struct diag_apps_data_t hdlc_data;
		struct diag_apps_data_t non_hdlc_data;
		static struct mutex apps_data_mutex;

		#define DIAGPKT_MAX_DELAYED_RSP 0xFFFF
		@@ -229,6 +223,7 @@ static void diag_drain_apps_data(struct diag_apps_data_t *data)
		diagmem_free(driver, data->buf, POOL_TYPE_HDLC);
		data->buf = NULL;
		data->len = 0;
		data->allocated = 0;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		}

		@@ -2905,14 +2900,19 @@ static int diag_process_apps_data_hdlc(unsigned char *buf, int len,
		send.last = (void *)(buf + len - 1);
		send.terminate = 1;

		if (!data->buf)
		if (!data->buf) {
		spin_lock_irqsave(&driver->diagmem_lock, flags);
		data->buf = diagmem_alloc(driver, DIAG_MAX_HDLC_BUF_SIZE +
		APF_DIAG_PADDING,
		POOL_TYPE_HDLC);
		if (!data->buf) {
		ret = PKT_DROP;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		goto fail_ret;
		}
		data->allocated = 1;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		}

		if ((DIAG_MAX_HDLC_BUF_SIZE - data->len) <= max_encoded_size) {
		err = diag_mux_write(DIAG_LOCAL_PROC, data->buf, data->len,
		@@ -2923,13 +2923,17 @@ static int diag_process_apps_data_hdlc(unsigned char *buf, int len,
		}
		data->buf = NULL;
		data->len = 0;
		spin_lock_irqsave(&driver->diagmem_lock, flags);
		data->buf = diagmem_alloc(driver, DIAG_MAX_HDLC_BUF_SIZE +
		APF_DIAG_PADDING,
		POOL_TYPE_HDLC);
		if (!data->buf) {
		ret = PKT_DROP;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		goto fail_ret;
		}
		data->allocated = 1;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		}

		enc.dest = data->buf + data->len;
		@@ -2952,13 +2956,17 @@ static int diag_process_apps_data_hdlc(unsigned char *buf, int len,
		}
		data->buf = NULL;
		data->len = 0;
		spin_lock_irqsave(&driver->diagmem_lock, flags);
		data->buf = diagmem_alloc(driver, DIAG_MAX_HDLC_BUF_SIZE +
		APF_DIAG_PADDING,
		POOL_TYPE_HDLC);
		if (!data->buf) {
		ret = PKT_DROP;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		goto fail_ret;
		}
		data->allocated = 1;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);

		enc.dest = data->buf + data->len;
		enc.dest_last = (void *)(data->buf + data->len +
		@@ -2986,9 +2994,11 @@ static int diag_process_apps_data_hdlc(unsigned char *buf, int len,

		fail_free_buf:
		spin_lock_irqsave(&driver->diagmem_lock, flags);
		if (data->allocated)
		diagmem_free(driver, data->buf, POOL_TYPE_HDLC);
		data->buf = NULL;
		data->len = 0;
		data->allocated = 0;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		fail_ret:
		return ret;
		@@ -3016,13 +3026,17 @@ static int diag_process_apps_data_non_hdlc(unsigned char *buf, int len,
		}

		if (!data->buf) {
		spin_lock_irqsave(&driver->diagmem_lock, flags);
		data->buf = diagmem_alloc(driver, DIAG_MAX_HDLC_BUF_SIZE +
		APF_DIAG_PADDING,
		POOL_TYPE_HDLC);
		if (!data->buf) {
		ret = PKT_DROP;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		goto fail_ret;
		}
		data->allocated = 1;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		}

		if ((DIAG_MAX_HDLC_BUF_SIZE - data->len) <= max_pkt_size) {
		@@ -3034,13 +3048,17 @@ static int diag_process_apps_data_non_hdlc(unsigned char *buf, int len,
		}
		data->buf = NULL;
		data->len = 0;
		spin_lock_irqsave(&driver->diagmem_lock, flags);
		data->buf = diagmem_alloc(driver, DIAG_MAX_HDLC_BUF_SIZE +
		APF_DIAG_PADDING,
		POOL_TYPE_HDLC);
		if (!data->buf) {
		ret = PKT_DROP;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		goto fail_ret;
		}
		data->allocated = 1;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		}

		header.start = CONTROL_CHAR;
		@@ -3067,9 +3085,11 @@ static int diag_process_apps_data_non_hdlc(unsigned char *buf, int len,

		fail_free_buf:
		spin_lock_irqsave(&driver->diagmem_lock, flags);
		if (data->allocated)
		diagmem_free(driver, data->buf, POOL_TYPE_HDLC);
		data->buf = NULL;
		data->len = 0;
		data->allocated = 0;
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		fail_ret:
		return ret;
		@@ -4132,8 +4152,10 @@ static int __init diagchar_init(void)
		driver->rsp_buf_ctxt = SET_BUF_CTXT(APPS_DATA, TYPE_CMD, TYPE_CMD);
		hdlc_data.ctxt = SET_BUF_CTXT(APPS_DATA, TYPE_DATA, 1);
		hdlc_data.len = 0;
		hdlc_data.allocated = 0;
		non_hdlc_data.ctxt = SET_BUF_CTXT(APPS_DATA, TYPE_DATA, 1);
		non_hdlc_data.len = 0;
		non_hdlc_data.allocated = 0;
		mutex_init(&driver->hdlc_disable_mutex);
		mutex_init(&driver->diagchar_mutex);
		mutex_init(&driver->diag_notifier_mutex);

drivers/char/diag/diagfwd.c

+14 −3

Original line number	Diff line number	Diff line
		@@ -1766,6 +1766,7 @@ static int diagfwd_mux_write_done(unsigned char *buf, int len, int buf_ctxt,
		int peripheral = -1;
		int type = -1;
		int num = -1;
		struct diag_apps_data_t *temp = NULL;

		if (!buf \|\| len < 0)
		return -EINVAL;
		@@ -1784,9 +1785,19 @@ static int diagfwd_mux_write_done(unsigned char *buf, int len, int buf_ctxt,
		diag_ws_on_copy(DIAG_WS_MUX);
		} else if (peripheral == APPS_DATA) {
		spin_lock_irqsave(&driver->diagmem_lock, flags);
		diagmem_free(driver, (unsigned char *)buf,
		POOL_TYPE_HDLC);
		buf = NULL;
		if (hdlc_data.allocated)
		temp = &hdlc_data;
		else if (non_hdlc_data.allocated)
		temp = &non_hdlc_data;
		else
		DIAG_LOG(DIAG_DEBUG_PERIPHERALS,
		"No apps data buffer is allocated to be freed\n");
		if (temp) {
		diagmem_free(driver, temp->buf, POOL_TYPE_HDLC);
		temp->buf = NULL;
		temp->len = 0;
		temp->allocated = 0;
		}
		spin_unlock_irqrestore(&driver->diagmem_lock, flags);
		} else {
		pr_err_ratelimited("diag: Invalid peripheral %d in %s, type: %d\n",