Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fa64710c authored by Dhoat Harpal's avatar Dhoat Harpal
Browse files

soc: qcom: glink: Move channel to dummy xprt with lock 



In core_channel_cleanup function channel is moved to dummy xprt
without taking channel lock. This leads to race condition where
transport poniter is pointing to dummy but channel still belong
to old transport.

Channel is moved to dummy with channel lock.

CRs-Fixed: 2005731
Change-Id: I91903140c1bfa29d909847f318d1339bb717fffc
Signed-off-by: default avatarDhoat Harpal <hdhoat@codeaurora.org>
parent 43cc5f8b

drivers/soc/qcom/glink.c

+2 −3
Original line number Diff line number Diff line 
/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -4176,7 +4176,6 @@ static void glink_core_channel_cleanup(struct glink_core_xprt_ctx *xprt_ptr) 
		if (ctx->local_open_state == GLINK_CHANNEL_OPENED ||

			ctx->local_open_state == GLINK_CHANNEL_OPENING) {

			ctx->transport_ptr = dummy_xprt_ctx;

			rwref_write_put(&ctx->ch_state_lhb2);

			glink_core_move_ch_node(xprt_ptr, dummy_xprt_ctx, ctx);

		} else {

			/* local state is in either CLOSED or CLOSING */
@@ -4186,9 +4185,9 @@ static void glink_core_channel_cleanup(struct glink_core_xprt_ctx *xprt_ptr) 
			/* Channel should be fully closed now. Delete here */

			if (ch_is_fully_closed(ctx))

				glink_delete_ch_from_list(ctx, false);

			rwref_write_put(&ctx->ch_state_lhb2);

		}

		rwref_put(&ctx->ch_state_lhb2);

		rwref_write_put(&ctx->ch_state_lhb2);

		ctx = get_first_ch_ctx(xprt_ptr);

	}

	spin_lock_irqsave(&xprt_ptr->xprt_ctx_lock_lhb1, flags);