Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3141ffab authored by Dhoat Harpal's avatar Dhoat Harpal Committed by Gerrit - the friendly Code Review server
Browse files

soc: qcom: glink: Modify ipc logging for error case 



In tx_common function, logging for error case is done using GLINK_ERR_CH.
Which can lead to use after free scenerio, if transport pointer of channel
context is already freed.

Use GLINK_ERR for error logging, to avoid using context pointer.

CRs-Fixed: 2192645
Change-Id: I947dba2b22749a271ac468ab5af13bc27767d00c
Signed-off-by: default avatarDhoat Harpal <hdhoat@codeaurora.org>
parent b26a24c8

drivers/soc/qcom/glink.c

+28 −25
Original line number Original line Diff line number Diff line
@@ -37,6 +37,7 @@ 
#define GLINK_QOS_DEF_NUM_PRIORITY	1

#define GLINK_QOS_DEF_NUM_PRIORITY	1

#define GLINK_QOS_DEF_MTU		2048

#define GLINK_QOS_DEF_MTU		2048





#define GLINK_CH_XPRT_NAME_SIZE ((3 * GLINK_NAME_SIZE) + 4)

#define GLINK_KTHREAD_PRIO 1

#define GLINK_KTHREAD_PRIO 1





/**

/**
@@ -2867,6 +2868,7 @@ static int glink_tx_common(void *handle, void *pkt_priv, 
	size_t intent_size;

	size_t intent_size;

	bool is_atomic =

	bool is_atomic =

		tx_flags & (GLINK_TX_SINGLE_THREADED | GLINK_TX_ATOMIC);

		tx_flags & (GLINK_TX_SINGLE_THREADED | GLINK_TX_ATOMIC);

	char glink_name[GLINK_CH_XPRT_NAME_SIZE];

	unsigned long flags;

	unsigned long flags;

	void *cookie = NULL;

	void *cookie = NULL;
@@ -2901,21 +2903,22 @@ static int glink_tx_common(void *handle, void *pkt_priv, 
		tracer_pkt_log_event(data, GLINK_CORE_TX);

		tracer_pkt_log_event(data, GLINK_CORE_TX);

	}

	}





	/* find matching rx intent (best-fit algorithm for now) */

	scnprintf(glink_name, GLINK_CH_XPRT_NAME_SIZE, "%s_%s_%s", ctx->name,

			ctx->transport_ptr->edge, ctx->transport_ptr->name);

	/* find matching rx intent (first-fit algorithm for now) */

	if (ch_pop_remote_rx_intent(ctx, size, &riid, &intent_size, &cookie)) {

	if (ch_pop_remote_rx_intent(ctx, size, &riid, &intent_size, &cookie)) {

		if (!(tx_flags & GLINK_TX_REQ_INTENT)) {

		if (!(tx_flags & GLINK_TX_REQ_INTENT)) {

			/* no rx intent available */

			/* no rx intent available */

			GLINK_ERR_CH(ctx,

			GLINK_ERR(

				"%s: R[%u]:%zu Intent not present for lcid\n",

				"%s: %s: R[%u]:%zu Intent not present\n",

				__func__, riid, size);

				glink_name, __func__, riid, size);

			ret = -EAGAIN;

			ret = -EAGAIN;

			goto glink_tx_common_err;

			goto glink_tx_common_err;

		}

		}

		if (is_atomic && !(ctx->transport_ptr->capabilities &

		if (is_atomic && !(ctx->transport_ptr->capabilities &

					  GCAP_AUTO_QUEUE_RX_INT)) {

					  GCAP_AUTO_QUEUE_RX_INT)) {

			GLINK_ERR_CH(ctx,

			GLINK_ERR("%s: %s: %s\n", glink_name, __func__,

				"%s: Cannot request intent in atomic context\n",

				"Cannot request intent in atomic context");

				__func__);

			ret = -EINVAL;

			ret = -EINVAL;

			goto glink_tx_common_err;

			goto glink_tx_common_err;

		}

		}
@@ -2925,8 +2928,8 @@ static int glink_tx_common(void *handle, void *pkt_priv, 
		ret = ctx->transport_ptr->ops->tx_cmd_rx_intent_req(

		ret = ctx->transport_ptr->ops->tx_cmd_rx_intent_req(

				ctx->transport_ptr->ops, ctx->lcid, size);

				ctx->transport_ptr->ops, ctx->lcid, size);

		if (ret) {

		if (ret) {

			GLINK_ERR_CH(ctx, "%s: Request intent failed %d\n",

			GLINK_ERR("%s: %s: Request intent failed %d\n",

					__func__, ret);

					glink_name, __func__, ret);

			goto glink_tx_common_err;

			goto glink_tx_common_err;

		}

		}
@@ -2934,18 +2937,18 @@ static int glink_tx_common(void *handle, void *pkt_priv, 
						&intent_size, &cookie)) {

						&intent_size, &cookie)) {

			rwref_read_put(&ctx->ch_state_lhb2);

			rwref_read_put(&ctx->ch_state_lhb2);

			if (is_atomic) {

			if (is_atomic) {

				GLINK_ERR_CH(ctx,

				GLINK_ERR("%s: %s: Intent of size %zu %s\n",

				    "%s Intent of size %zu not ready\n",

					glink_name, __func__, size,

				    __func__, size);

					"not ready");

				ret = -EAGAIN;

				ret = -EAGAIN;

				goto glink_tx_common_err_2;

				goto glink_tx_common_err_2;

			}

			}





			if (ctx->transport_ptr->local_state == GLINK_XPRT_DOWN

			if (ctx->transport_ptr->local_state == GLINK_XPRT_DOWN

			    || !ch_is_fully_opened(ctx)) {

			    || !ch_is_fully_opened(ctx)) {

				GLINK_ERR_CH(ctx,

				GLINK_ERR("%s: %s: %s %s\n", glink_name,

					"%s: Channel closed while waiting for intent\n",

					 __func__, "Channel closed while",

					__func__);

					"waiting for intent");

				ret = -EBUSY;

				ret = -EBUSY;

				goto glink_tx_common_err_2;

				goto glink_tx_common_err_2;

			}

			}
@@ -2954,18 +2957,18 @@ static int glink_tx_common(void *handle, void *pkt_priv, 
			if (!wait_for_completion_timeout(

			if (!wait_for_completion_timeout(

					&ctx->int_req_ack_complete,

					&ctx->int_req_ack_complete,

					ctx->rx_intent_req_timeout_jiffies)) {

					ctx->rx_intent_req_timeout_jiffies)) {

				GLINK_ERR_CH(ctx,

				GLINK_ERR(

					"%s: Intent request ack with size: %zu not granted for lcid\n",

					"%s: %s: %s %zu not granted for lcid\n",

					__func__, size);

					glink_name, __func__,

					"Intent request ack with size:", size);

				ret = -ETIMEDOUT;

				ret = -ETIMEDOUT;

				goto glink_tx_common_err_2;

				goto glink_tx_common_err_2;

			}

			}





			if (!ctx->int_req_ack) {

			if (!ctx->int_req_ack) {

				GLINK_ERR_CH(ctx,

				GLINK_ERR("%s: %s: %s %zu %s\n", glink_name,

				    "%s: Intent Request with size: %zu %s",

					__func__, "Intent Request with size:",

				    __func__, size,

					size, "not granted for lcid");

				    "not granted for lcid\n");

				ret = -EAGAIN;

				ret = -EAGAIN;

				goto glink_tx_common_err_2;

				goto glink_tx_common_err_2;

			}

			}
@@ -2974,9 +2977,9 @@ static int glink_tx_common(void *handle, void *pkt_priv, 
			if (!wait_for_completion_timeout(

			if (!wait_for_completion_timeout(

					&ctx->int_req_complete,

					&ctx->int_req_complete,

					ctx->rx_intent_req_timeout_jiffies)) {

					ctx->rx_intent_req_timeout_jiffies)) {

				GLINK_ERR_CH(ctx,

				GLINK_ERR("%s: %s: %s %zu %s\n", glink_name,

					"%s: Intent request with size: %zu not granted for lcid\n",

					 __func__, "Intent request with size: ",

					__func__, size);

					size, "not granted for lcid");

				ret = -ETIMEDOUT;

				ret = -ETIMEDOUT;

				goto glink_tx_common_err_2;

				goto glink_tx_common_err_2;

			}

			}