Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f71c1b1a authored by Manoj Prabhu B's avatar Manoj Prabhu B Committed by Bernhard Thoben
Browse files

diag: dci: Add protection while de-initializing clients 



Currently, while de-initializing dci clients, there is
a possibility to access stale entries. This patch fixes
this issue by adding proper protection mechanism.
CRs-Fixed: 961469

Bug: 62378232
Change-Id: I829c9497eeb356662a6531592c66108e615ce6e4
Signed-off-by: default avatarMohit Aggarwal <maggarwa@codeaurora.org>
Signed-off-by: default avatarManoj Prabhu B <bmanoj@codeaurora.org>
(cherry picked from commit 652f01eb8b5e24190c9ea0ca31e5fc7ff4150636)
parent 435b5558

drivers/char/diag/diag_dci.c

+8 −5
Original line number Diff line number Diff line
@@ -3010,13 +3010,14 @@ int diag_dci_deinit_client(struct diag_dci_client_tbl *entry) 
	if (!entry)

		return DIAG_DCI_NOT_SUPPORTED;



	token = entry->client_info.token;



	mutex_lock(&driver->dci_mutex);



	token = entry->client_info.token;

	/*

	 * Remove the entry from the list before freeing the buffers

	 * to ensure that we don't have any invalid access.

	 */

	if (!list_empty(&entry->track))

		list_del(&entry->track);

	driver->num_dci_client--;

	/*
@@ -3046,6 +3047,7 @@ int diag_dci_deinit_client(struct diag_dci_client_tbl *entry) 
		req_entry = list_entry(start, struct dci_pkt_req_entry_t,

				       track);

		if (req_entry->client_id == entry->client_info.client_id) {

			if (!list_empty(&req_entry->track))

				list_del(&req_entry->track);

			kfree(req_entry);

		}
@@ -3055,6 +3057,7 @@ int diag_dci_deinit_client(struct diag_dci_client_tbl *entry) 
	mutex_lock(&entry->write_buf_mutex);

	list_for_each_entry_safe(buf_entry, temp, &entry->list_write_buf,

							buf_track) {

		if (!list_empty(&buf_entry->buf_track))

			list_del(&buf_entry->buf_track);

		if (buf_entry->buf_type == DCI_BUF_SECONDARY) {

			mutex_lock(&buf_entry->data_mutex);