Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f6ecc2a1 authored by Tanya Dixit's avatar Tanya Dixit Committed by Gerrit - the friendly Code Review server
Browse files

rtac: Add mutex lock to ensure proper fops access 



Add mutex lock in rtac_open and rtac_release
to avoid usage count discrepancies leading
to multiple calls to unmap memory resulting in
null pointer dereference.

CRs-Fixed: 2271712
Change-Id: Ie6da28837c352030b8d7e377d68a70cf04e7072a
Signed-off-by: default avatarTanya Dixit <tdixit@codeaurora.org>
parent 186f8478

dsp/rtac.c

+13 −29
Original line number Original line Diff line number Diff line
@@ -54,6 +54,7 @@ struct rtac_cal_block_data rtac_cal[MAX_RTAC_BLOCKS] = { 
struct rtac_common_data {

struct rtac_common_data {

	atomic_t			usage_count;

	atomic_t			usage_count;

	atomic_t			apr_err_code;

	atomic_t			apr_err_code;

	struct mutex			rtac_fops_mutex;

};

};





static struct rtac_common_data		rtac_common;

static struct rtac_common_data		rtac_common;
@@ -122,10 +123,6 @@ struct mutex rtac_asm_apr_mutex; 
struct mutex			rtac_voice_mutex;

struct mutex			rtac_voice_mutex;

struct mutex			rtac_voice_apr_mutex;

struct mutex			rtac_voice_apr_mutex;

struct mutex			rtac_afe_apr_mutex;

struct mutex			rtac_afe_apr_mutex;

struct mutex			rtac_asm_cal_mutex;

struct mutex			rtac_adm_cal_mutex;

struct mutex			rtac_afe_cal_mutex;

struct mutex			rtac_voice_cal_mutex;





int rtac_clear_mapping(uint32_t cal_type)

int rtac_clear_mapping(uint32_t cal_type)

{

{
@@ -322,7 +319,9 @@ static int rtac_open(struct inode *inode, struct file *f) 




	pr_debug("%s\n", __func__);

	pr_debug("%s\n", __func__);





	mutex_lock(&rtac_common.rtac_fops_mutex);

	atomic_inc(&rtac_common.usage_count);

	atomic_inc(&rtac_common.usage_count);

	mutex_unlock(&rtac_common.rtac_fops_mutex);

	return result;

	return result;

}

}
@@ -334,12 +333,15 @@ static int rtac_release(struct inode *inode, struct file *f) 




	pr_debug("%s\n", __func__);

	pr_debug("%s\n", __func__);





	mutex_lock(&rtac_common.rtac_fops_mutex);

	atomic_dec(&rtac_common.usage_count);

	atomic_dec(&rtac_common.usage_count);

	pr_debug("%s: ref count %d!\n", __func__,

	pr_debug("%s: ref count %d!\n", __func__,

		atomic_read(&rtac_common.usage_count));

		atomic_read(&rtac_common.usage_count));





	if (atomic_read(&rtac_common.usage_count) > 0)

	if (atomic_read(&rtac_common.usage_count) > 0) {

		mutex_unlock(&rtac_common.rtac_fops_mutex);

		goto done;

		goto done;

	}





	for (i = 0; i < MAX_RTAC_BLOCKS; i++) {

	for (i = 0; i < MAX_RTAC_BLOCKS; i++) {

		result2 = rtac_unmap_cal_buffer(i);

		result2 = rtac_unmap_cal_buffer(i);
@@ -356,6 +358,7 @@ static int rtac_release(struct inode *inode, struct file *f) 
			result = result2;

			result = result2;

		}

		}

	}

	}

	mutex_unlock(&rtac_common.rtac_fops_mutex);

done:

done:

	return result;

	return result;

}

}
@@ -1807,84 +1810,64 @@ static long rtac_ioctl_shared(struct file *f, 
	}

	}





	case AUDIO_GET_RTAC_ADM_CAL:

	case AUDIO_GET_RTAC_ADM_CAL:

		mutex_lock(&rtac_adm_cal_mutex);

		opcode = q6common_is_instance_id_supported() ?

		opcode = q6common_is_instance_id_supported() ?

				 ADM_CMD_GET_PP_PARAMS_V6 :

				 ADM_CMD_GET_PP_PARAMS_V6 :

				 ADM_CMD_GET_PP_PARAMS_V5;

				 ADM_CMD_GET_PP_PARAMS_V5;

		result = send_adm_apr((void *) arg, opcode);

		result = send_adm_apr((void *) arg, opcode);

		mutex_unlock(&rtac_adm_cal_mutex);

		break;

		break;

	case AUDIO_SET_RTAC_ADM_CAL:

	case AUDIO_SET_RTAC_ADM_CAL:

		mutex_lock(&rtac_adm_cal_mutex);

		opcode = q6common_is_instance_id_supported() ?

		opcode = q6common_is_instance_id_supported() ?

				 ADM_CMD_SET_PP_PARAMS_V6 :

				 ADM_CMD_SET_PP_PARAMS_V6 :

				 ADM_CMD_SET_PP_PARAMS_V5;

				 ADM_CMD_SET_PP_PARAMS_V5;

		result = send_adm_apr((void *) arg, opcode);

		result = send_adm_apr((void *) arg, opcode);

		mutex_unlock(&rtac_adm_cal_mutex);

		break;

		break;

	case AUDIO_GET_RTAC_ASM_CAL:

	case AUDIO_GET_RTAC_ASM_CAL:

		mutex_lock(&rtac_asm_cal_mutex);

		opcode = q6common_is_instance_id_supported() ?

		opcode = q6common_is_instance_id_supported() ?

				 ASM_STREAM_CMD_GET_PP_PARAMS_V3 :

				 ASM_STREAM_CMD_GET_PP_PARAMS_V3 :

				 ASM_STREAM_CMD_GET_PP_PARAMS_V2;

				 ASM_STREAM_CMD_GET_PP_PARAMS_V2;

		result = send_rtac_asm_apr((void *) arg, opcode);

		result = send_rtac_asm_apr((void *) arg, opcode);

		mutex_unlock(&rtac_asm_cal_mutex);

		break;

		break;

	case AUDIO_SET_RTAC_ASM_CAL:

	case AUDIO_SET_RTAC_ASM_CAL:

		mutex_lock(&rtac_asm_cal_mutex);

		opcode = q6common_is_instance_id_supported() ?

		opcode = q6common_is_instance_id_supported() ?

				 ASM_STREAM_CMD_SET_PP_PARAMS_V3 :

				 ASM_STREAM_CMD_SET_PP_PARAMS_V3 :

				 ASM_STREAM_CMD_SET_PP_PARAMS_V2;

				 ASM_STREAM_CMD_SET_PP_PARAMS_V2;

		result = send_rtac_asm_apr((void *) arg, opcode);

		result = send_rtac_asm_apr((void *) arg, opcode);

		mutex_unlock(&rtac_asm_cal_mutex);

		break;

		break;

	case AUDIO_GET_RTAC_CVS_CAL:

	case AUDIO_GET_RTAC_CVS_CAL:

		mutex_lock(&rtac_voice_cal_mutex);

		opcode = q6common_is_instance_id_supported() ?

		opcode = q6common_is_instance_id_supported() ?

				 VSS_ICOMMON_CMD_GET_PARAM_V3 :

				 VSS_ICOMMON_CMD_GET_PARAM_V3 :

				 VSS_ICOMMON_CMD_GET_PARAM_V2;

				 VSS_ICOMMON_CMD_GET_PARAM_V2;

		result = send_voice_apr(RTAC_CVS, (void *) arg, opcode);

		result = send_voice_apr(RTAC_CVS, (void *) arg, opcode);

		mutex_unlock(&rtac_voice_cal_mutex);

		break;

		break;

	case AUDIO_SET_RTAC_CVS_CAL:

	case AUDIO_SET_RTAC_CVS_CAL:

		mutex_lock(&rtac_voice_cal_mutex);

		opcode = q6common_is_instance_id_supported() ?

		opcode = q6common_is_instance_id_supported() ?

				 VSS_ICOMMON_CMD_SET_PARAM_V3 :

				 VSS_ICOMMON_CMD_SET_PARAM_V3 :

				 VSS_ICOMMON_CMD_SET_PARAM_V2;

				 VSS_ICOMMON_CMD_SET_PARAM_V2;

		result = send_voice_apr(RTAC_CVS, (void *) arg, opcode);

		result = send_voice_apr(RTAC_CVS, (void *) arg, opcode);

		mutex_unlock(&rtac_voice_cal_mutex);

		break;

		break;

	case AUDIO_GET_RTAC_CVP_CAL:

	case AUDIO_GET_RTAC_CVP_CAL:

		mutex_lock(&rtac_voice_cal_mutex);

		opcode = q6common_is_instance_id_supported() ?

		opcode = q6common_is_instance_id_supported() ?

				 VSS_ICOMMON_CMD_GET_PARAM_V3 :

				 VSS_ICOMMON_CMD_GET_PARAM_V3 :

				 VSS_ICOMMON_CMD_GET_PARAM_V2;

				 VSS_ICOMMON_CMD_GET_PARAM_V2;

		result = send_voice_apr(RTAC_CVP, (void *) arg, opcode);

		result = send_voice_apr(RTAC_CVP, (void *) arg, opcode);

		mutex_unlock(&rtac_voice_cal_mutex);

		break;

		break;

	case AUDIO_SET_RTAC_CVP_CAL:

	case AUDIO_SET_RTAC_CVP_CAL:

		mutex_lock(&rtac_voice_cal_mutex);

		opcode = q6common_is_instance_id_supported() ?

		opcode = q6common_is_instance_id_supported() ?

				 VSS_ICOMMON_CMD_SET_PARAM_V3 :

				 VSS_ICOMMON_CMD_SET_PARAM_V3 :

				 VSS_ICOMMON_CMD_SET_PARAM_V2;

				 VSS_ICOMMON_CMD_SET_PARAM_V2;

		result = send_voice_apr(RTAC_CVP, (void *) arg, opcode);

		result = send_voice_apr(RTAC_CVP, (void *) arg, opcode);

		mutex_unlock(&rtac_voice_cal_mutex);

		break;

		break;

	case AUDIO_GET_RTAC_AFE_CAL:

	case AUDIO_GET_RTAC_AFE_CAL:

		mutex_lock(&rtac_afe_cal_mutex);

		opcode = q6common_is_instance_id_supported() ?

		opcode = q6common_is_instance_id_supported() ?

				 AFE_PORT_CMD_GET_PARAM_V3 :

				 AFE_PORT_CMD_GET_PARAM_V3 :

				 AFE_PORT_CMD_GET_PARAM_V2;

				 AFE_PORT_CMD_GET_PARAM_V2;

		result = send_rtac_afe_apr((void __user *) arg, opcode);

		result = send_rtac_afe_apr((void __user *) arg, opcode);

		mutex_unlock(&rtac_afe_cal_mutex);

		break;

		break;

	case AUDIO_SET_RTAC_AFE_CAL:

	case AUDIO_SET_RTAC_AFE_CAL:

		mutex_lock(&rtac_afe_cal_mutex);

		opcode = q6common_is_instance_id_supported() ?

		opcode = q6common_is_instance_id_supported() ?

				 AFE_PORT_CMD_SET_PARAM_V3 :

				 AFE_PORT_CMD_SET_PARAM_V3 :

				 AFE_PORT_CMD_SET_PARAM_V2;

				 AFE_PORT_CMD_SET_PARAM_V2;

		result = send_rtac_afe_apr((void __user *) arg, opcode);

		result = send_rtac_afe_apr((void __user *) arg, opcode);

		mutex_unlock(&rtac_afe_cal_mutex);

		break;

		break;

	default:

	default:

		pr_err("%s: Invalid IOCTL, command = %d!\n",

		pr_err("%s: Invalid IOCTL, command = %d!\n",
@@ -1900,6 +1883,7 @@ static long rtac_ioctl(struct file *f, 
{

{

	int result = 0;

	int result = 0;





	mutex_lock(&rtac_common.rtac_fops_mutex);

	if (!arg) {

	if (!arg) {

		pr_err("%s: No data sent to driver!\n", __func__);

		pr_err("%s: No data sent to driver!\n", __func__);

		result = -EFAULT;

		result = -EFAULT;
@@ -1907,6 +1891,7 @@ static long rtac_ioctl(struct file *f, 
		result = rtac_ioctl_shared(f, cmd, (void __user *)arg);

		result = rtac_ioctl_shared(f, cmd, (void __user *)arg);

	}

	}





	mutex_unlock(&rtac_common.rtac_fops_mutex);

	return result;

	return result;

}

}
@@ -1929,6 +1914,7 @@ static long rtac_compat_ioctl(struct file *f, 
{

{

	int result = 0;

	int result = 0;





	mutex_lock(&rtac_common.rtac_fops_mutex);

	if (!arg) {

	if (!arg) {

		pr_err("%s: No data sent to driver!\n", __func__);

		pr_err("%s: No data sent to driver!\n", __func__);

		result = -EINVAL;

		result = -EINVAL;
@@ -1981,6 +1967,7 @@ static long rtac_compat_ioctl(struct file *f, 
		break;

		break;

	}

	}

done:

done:

	mutex_unlock(&rtac_common.rtac_fops_mutex);

	return result;

	return result;

}

}

#else

#else
@@ -2008,6 +1995,7 @@ int __init rtac_init(void) 
	/* Driver */

	/* Driver */

	atomic_set(&rtac_common.usage_count, 0);

	atomic_set(&rtac_common.usage_count, 0);

	atomic_set(&rtac_common.apr_err_code, 0);

	atomic_set(&rtac_common.apr_err_code, 0);

	mutex_init(&rtac_common.rtac_fops_mutex);





	/* ADM */

	/* ADM */

	memset(&rtac_adm_data, 0, sizeof(rtac_adm_data));

	memset(&rtac_adm_data, 0, sizeof(rtac_adm_data));
@@ -2016,7 +2004,6 @@ int __init rtac_init(void) 
	init_waitqueue_head(&rtac_adm_apr_data.cmd_wait);

	init_waitqueue_head(&rtac_adm_apr_data.cmd_wait);

	mutex_init(&rtac_adm_mutex);

	mutex_init(&rtac_adm_mutex);

	mutex_init(&rtac_adm_apr_mutex);

	mutex_init(&rtac_adm_apr_mutex);

	mutex_init(&rtac_adm_cal_mutex);





	rtac_adm_buffer = kzalloc(

	rtac_adm_buffer = kzalloc(

		rtac_cal[ADM_RTAC_CAL].map_data.map_size, GFP_KERNEL);

		rtac_cal[ADM_RTAC_CAL].map_data.map_size, GFP_KERNEL);
@@ -2030,7 +2017,6 @@ int __init rtac_init(void) 
		init_waitqueue_head(&rtac_asm_apr_data[i].cmd_wait);

		init_waitqueue_head(&rtac_asm_apr_data[i].cmd_wait);

	}

	}

	mutex_init(&rtac_asm_apr_mutex);

	mutex_init(&rtac_asm_apr_mutex);

	mutex_init(&rtac_asm_cal_mutex);





	rtac_asm_buffer = kzalloc(

	rtac_asm_buffer = kzalloc(

		rtac_cal[ASM_RTAC_CAL].map_data.map_size, GFP_KERNEL);

		rtac_cal[ASM_RTAC_CAL].map_data.map_size, GFP_KERNEL);
@@ -2044,7 +2030,6 @@ int __init rtac_init(void) 
	atomic_set(&rtac_afe_apr_data.cmd_state, 0);

	atomic_set(&rtac_afe_apr_data.cmd_state, 0);

	init_waitqueue_head(&rtac_afe_apr_data.cmd_wait);

	init_waitqueue_head(&rtac_afe_apr_data.cmd_wait);

	mutex_init(&rtac_afe_apr_mutex);

	mutex_init(&rtac_afe_apr_mutex);

	mutex_init(&rtac_afe_cal_mutex);





	rtac_afe_buffer = kzalloc(

	rtac_afe_buffer = kzalloc(

		rtac_cal[AFE_RTAC_CAL].map_data.map_size, GFP_KERNEL);

		rtac_cal[AFE_RTAC_CAL].map_data.map_size, GFP_KERNEL);
@@ -2063,7 +2048,6 @@ int __init rtac_init(void) 
	}

	}

	mutex_init(&rtac_voice_mutex);

	mutex_init(&rtac_voice_mutex);

	mutex_init(&rtac_voice_apr_mutex);

	mutex_init(&rtac_voice_apr_mutex);

	mutex_init(&rtac_voice_cal_mutex);





	rtac_voice_buffer = kzalloc(

	rtac_voice_buffer = kzalloc(

		rtac_cal[VOICE_RTAC_CAL].map_data.map_size, GFP_KERNEL);

		rtac_cal[VOICE_RTAC_CAL].map_data.map_size, GFP_KERNEL);