write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/drivers/misc/fastrpc.c
..
..
@@ -247,6 +247,13 @@
247
247
 		dma_buf_put(map->buf);
248
248
 	}
249
249
 
250
+	if (map->fl) {
251
+		spin_lock(&map->fl->lock);
252
+		list_del(&map->node);
253
+		spin_unlock(&map->fl->lock);
254
+		map->fl = NULL;
255
+	}
256
+
250
257
 	kfree(map);
251
258
 }
252
259
 
..
..
@@ -256,10 +263,12 @@
256
263
 		kref_put(&map->refcount, fastrpc_free_map);
257
264
 }
258
265
 
259
-static void fastrpc_map_get(struct fastrpc_map *map)
266
+static int fastrpc_map_get(struct fastrpc_map *map)
260
267
 {
261
-	if (map)
262
-		kref_get(&map->refcount);
268
+	if (!map)
269
+		return -ENOENT;
270
+
271
+	return kref_get_unless_zero(&map->refcount) ? 0 : -ENOENT;
263
272
 }
264
273
 
265
274
 static int fastrpc_map_find(struct fastrpc_user *fl, int fd,
..
..
@@ -1097,7 +1106,7 @@
1097
1106
 
1098
1107
 	sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE, 4, 0);
1099
1108
 	if (init.attrs)
1100
-		sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_ATTR, 6, 0);
1109
+		sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_ATTR, 4, 0);
1101
1110
 
1102
1111
 	err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE,
1103
1112
 				      sc, args);
..
..
@@ -1112,12 +1121,7 @@
1112
1121
 	fl->init_mem = NULL;
1113
1122
 	fastrpc_buf_free(imem);
1114
1123
 err_alloc:
1115
-	if (map) {
1116
-		spin_lock(&fl->lock);
1117
-		list_del(&map->node);
1118
-		spin_unlock(&fl->lock);
1119
-		fastrpc_map_put(map);
1120
-	}
1124
+	fastrpc_map_put(map);
1121
1125
 err:
1122
1126
 	kfree(args);
1123
1127
 
..
..
@@ -1194,10 +1198,8 @@
1194
1198
 		fastrpc_context_put(ctx);
1195
1199
 	}
1196
1200
 
1197
-	list_for_each_entry_safe(map, m, &fl->maps, node) {
1198
-		list_del(&map->node);
1201
+	list_for_each_entry_safe(map, m, &fl->maps, node)
1199
1202
 		fastrpc_map_put(map);
1200
-	}
1201
1203
 
1202
1204
 	list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
1203
1205
 		list_del(&buf->node);
..
..
@@ -1673,8 +1675,10 @@
1673
1675
 	struct fastrpc_invoke_ctx *ctx;
1674
1676
 
1675
1677
 	spin_lock(&user->lock);
1676
-	list_for_each_entry(ctx, &user->pending, node)
1678
+	list_for_each_entry(ctx, &user->pending, node) {
1679
+		ctx->retval = -EPIPE;
1677
1680
 		complete(&ctx->work);
1681
+	}
1678
1682
 	spin_unlock(&user->lock);
1679
1683
 }
1680
1684
 
..
..
@@ -1684,7 +1688,9 @@
1684
1688
 	struct fastrpc_user *user;
1685
1689
 	unsigned long flags;
1686
1690
 
1691
+	/* No invocations past this point */
1687
1692
 	spin_lock_irqsave(&cctx->lock, flags);
1693
+	cctx->rpdev = NULL;
1688
1694
 	list_for_each_entry(user, &cctx->users, user)
1689
1695
 		fastrpc_notify_users(user);
1690
1696
 	spin_unlock_irqrestore(&cctx->lock, flags);
..
..
@@ -1692,7 +1698,6 @@
1692
1698
 	misc_deregister(&cctx->miscdev);
1693
1699
 	of_platform_depopulate(&rpdev->dev);
1694
1700
 
1695
-	cctx->rpdev = NULL;
1696
1701
 	fastrpc_channel_ctx_put(cctx);
1697
1702
 }
1698
1703