Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b2a0ae2d authored by Karthikeyan Ramasubramanian's avatar Karthikeyan Ramasubramanian
Browse files

drivers: qcom: qmi: Copy the out-of-band data and process it 



The address to out-of-band data provided by the underlying data is copied.
The underlying transport frees the address before QMI interface can process
that out-of-band data. This leads to QMI interface accessing stale/invalid
data.

Copy the out-of-band data and process it.

CRs-Fixed: 723919
Change-Id: I375cd7403ee95870fd26c4d6bcc6a4a70fb202c8
Signed-off-by: default avatarKarthikeyan Ramasubramanian <kramasub@codeaurora.org>
parent 3511ae2a

drivers/soc/qcom/qmi_interface.c

+16 −2
Original line number Diff line number Diff line
@@ -331,7 +331,18 @@ static void qmi_event_notify(unsigned event, void *oob_data, 
		return;

	}

	notify_work->event = event;

	notify_work->oob_data = oob_data;

	if (oob_data) {

		notify_work->oob_data = kmalloc(oob_data_len, GFP_KERNEL);

		if (!notify_work->oob_data) {

			pr_err("%s: Couldn't allocate oob_data @ %d to %p\n",

				__func__, event, priv);

			kfree(notify_work);

			return;

		}

		memcpy(notify_work->oob_data, oob_data, oob_data_len);

	} else {

		notify_work->oob_data = NULL;

	}

	notify_work->oob_data_len = oob_data_len;

	notify_work->priv = priv;

	INIT_WORK(&notify_work->work, qmi_notify_event_worker);
@@ -346,6 +357,7 @@ static void qmi_event_notify(unsigned event, void *oob_data, 
		}

	}

	mutex_unlock(&handle_hash_tbl_lock);

	kfree(notify_work->oob_data);

	kfree(notify_work);

}
@@ -362,6 +374,7 @@ static void qmi_notify_event_worker(struct work_struct *work) 
	mutex_lock(&handle->handle_lock);

	if (handle->handle_reset) {

		mutex_unlock(&handle->handle_lock);

		kfree(notify_work->oob_data);

		kfree(notify_work);

		return;

	}
@@ -379,7 +392,7 @@ static void qmi_notify_event_worker(struct work_struct *work) 
					   &handle->resume_tx_work,

					   msecs_to_jiffies(0));

		} else if (handle->handle_type == QMI_SERVICE_HANDLE) {

			struct msm_ipc_addr rtx_addr;

			struct msm_ipc_addr rtx_addr = {0};

			struct qmi_svc_clnt_conn *conn_h;

			union rr_control_msg *msg;
@@ -406,6 +419,7 @@ static void qmi_notify_event_worker(struct work_struct *work) 
		break;

	}

	mutex_unlock(&handle->handle_lock);

	kfree(notify_work->oob_data);

	kfree(notify_work);

}