diff options
| author | Bjorn Andersson <bjorn.andersson@linaro.org> | 2019-07-18 10:36:56 +0200 |
|---|---|---|
| committer | Julan Hsu <julanhsu@google.com> | 2019-08-21 15:29:09 +0000 |
| commit | 30a137bf7531cbf62607d2393815c202757d26b2 (patch) | |
| tree | d13196e371bcbd0cbcb77c47b6478962317eb3da | |
| parent | e2eaa8c7c5207d8af026f820657cc0b767a1470e (diff) | |
CHROMIUM: WAR: misc: fastrpc: Don't reference rpmsg_device after remove
As fastrpc_rpmsg_remove() returns the rpdev of the channel context is no
longer a valid object, so ensure to update the channel context to no
longer reference the old object and guard in the invoke code path
against dereferencing it.
BUG=b:136289132
TEST=stop and start remote proc1 using sysfs
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Mayank Chopra <mak.chopra@codeaurora.org>
Signed-off-by: Abhinav Asati <asatiabhi@codeaurora.org>
(cherry picked from commit d96f76d8690c8f520b42977ad1ff81f9bbf80b98
https://github.com/ldts/qualcomm-lt-kernel/commits/chromiumos-4.14-iommu-mmap-for-next)
Change-Id: If44721aa5df37fcf74056cb1babd1856dfbe4c49
Signed-off-by: Vamsi Singamsetty <vamssi@codeaurora.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1724472
Reviewed-by: Julan Hsu <julanhsu@google.com>
Tested-by: Julan Hsu <julanhsu@google.com>
Legacy-Commit-Queue: Commit Bot <commit-bot@chromium.org>
| -rw-r--r-- | drivers/misc/fastrpc.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index b5aaa7f6cd83..1fa5ae38da8d 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -916,6 +916,9 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel, if (!fl->sctx) return -EINVAL; + if (!fl->cctx->rpdev) + return -EPIPE; + if (!_ctx) { ctx = fastrpc_context_alloc(fl, kernel, sc, args); if (IS_ERR(ctx)) @@ -1505,6 +1508,7 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) misc_deregister(&cctx->miscdev); of_platform_depopulate(&rpdev->dev); + cctx->rpdev = NULL; fastrpc_channel_ctx_put(cctx); } |