hc
2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c
kernel/drivers/misc/fastrpc.c
....@@ -247,6 +247,13 @@
247247 dma_buf_put(map->buf);
248248 }
249249
250
+ if (map->fl) {
251
+ spin_lock(&map->fl->lock);
252
+ list_del(&map->node);
253
+ spin_unlock(&map->fl->lock);
254
+ map->fl = NULL;
255
+ }
256
+
250257 kfree(map);
251258 }
252259
....@@ -256,10 +263,12 @@
256263 kref_put(&map->refcount, fastrpc_free_map);
257264 }
258265
259
-static void fastrpc_map_get(struct fastrpc_map *map)
266
+static int fastrpc_map_get(struct fastrpc_map *map)
260267 {
261
- if (map)
262
- kref_get(&map->refcount);
268
+ if (!map)
269
+ return -ENOENT;
270
+
271
+ return kref_get_unless_zero(&map->refcount) ? 0 : -ENOENT;
263272 }
264273
265274 static int fastrpc_map_find(struct fastrpc_user *fl, int fd,
....@@ -1097,7 +1106,7 @@
10971106
10981107 sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE, 4, 0);
10991108 if (init.attrs)
1100
- sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_ATTR, 6, 0);
1109
+ sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_ATTR, 4, 0);
11011110
11021111 err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE,
11031112 sc, args);
....@@ -1112,12 +1121,7 @@
11121121 fl->init_mem = NULL;
11131122 fastrpc_buf_free(imem);
11141123 err_alloc:
1115
- if (map) {
1116
- spin_lock(&fl->lock);
1117
- list_del(&map->node);
1118
- spin_unlock(&fl->lock);
1119
- fastrpc_map_put(map);
1120
- }
1124
+ fastrpc_map_put(map);
11211125 err:
11221126 kfree(args);
11231127
....@@ -1194,10 +1198,8 @@
11941198 fastrpc_context_put(ctx);
11951199 }
11961200
1197
- list_for_each_entry_safe(map, m, &fl->maps, node) {
1198
- list_del(&map->node);
1201
+ list_for_each_entry_safe(map, m, &fl->maps, node)
11991202 fastrpc_map_put(map);
1200
- }
12011203
12021204 list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
12031205 list_del(&buf->node);
....@@ -1673,8 +1675,10 @@
16731675 struct fastrpc_invoke_ctx *ctx;
16741676
16751677 spin_lock(&user->lock);
1676
- list_for_each_entry(ctx, &user->pending, node)
1678
+ list_for_each_entry(ctx, &user->pending, node) {
1679
+ ctx->retval = -EPIPE;
16771680 complete(&ctx->work);
1681
+ }
16781682 spin_unlock(&user->lock);
16791683 }
16801684
....@@ -1684,7 +1688,9 @@
16841688 struct fastrpc_user *user;
16851689 unsigned long flags;
16861690
1691
+ /* No invocations past this point */
16871692 spin_lock_irqsave(&cctx->lock, flags);
1693
+ cctx->rpdev = NULL;
16881694 list_for_each_entry(user, &cctx->users, user)
16891695 fastrpc_notify_users(user);
16901696 spin_unlock_irqrestore(&cctx->lock, flags);
....@@ -1692,7 +1698,6 @@
16921698 misc_deregister(&cctx->miscdev);
16931699 of_platform_depopulate(&rpdev->dev);
16941700
1695
- cctx->rpdev = NULL;
16961701 fastrpc_channel_ctx_put(cctx);
16971702 }
16981703