p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Avoid possible double list_del in supplicant comms 

A fix for the OP-TEE driver to avoid possible double list_del during
 tee-supplicant communication while the system is shutting down.
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCgA4FiEEcK3MsDvGvFp6zV9ztbC4QZeP7NMFAlwPyB8aHGplbnMud2lr
 bGFuZGVyQGxpbmFyby5vcmcACgkQtbC4QZeP7NNm7BAAvxkI/fvhWdWbBbu9E850
 m61XN7pqU171YmPnQeOLgYB0r7v7EJvw7CW2lIcWKXGzQYKZkDtnUD3U6dK0LLzU
 xFJbnQzD/oe28Ed3Q7IHscQs+GbGwqcGlLulGPQwhkEG1ubabbw7694phxXhkUu7
 kfPfoW+J9DRpSAihpU5JCKms5cSdvSirRzO/Rg5mxzQrjeZ/dMjdJM65H/w5qpOw
 mzCn9PxJzDNWCQpSR7OSVsKCqtKWKAQnoP7oT0ED9RSXtynWKx4yMT2Yikp4MG4V
 X5bxHPYxXb9Rso8xXF69/2u5FPAY9hQ7RgDrKVNOTDiNMPrxNYWIjsNrcihHKjOk
 cwcPiVw2LTlNQdUt6+NNDxSSKpzCaptxLmYAHgNm9zRlQw6n6XXz1AuuZux0BAqH
 2xEKbEFZ1PB/rWOkbD5Y4ZiebKVBEtY4VFQxFOcNVKtm/Ot9JvEQ8wBdOtkQBh3h
 gsCqwXtsRsbO4iLo8BhHsZnusT9MUYvVCyxQ0n9lOusTNX4l4TnadfNFn2B2nifx
 mKIK5P1zl6b3fWq84Cb1v5WEkJqM9iPxt0DFzhkp+4tHB5BSzDW4xrQJshRPiv4C
 Z3PfVnXsARxM6QpAGQzjYai/QO9Nzf76TBBiiD3ggFXI0ZU0v4RpztW0kP8ilqHO
 NVoGZOa+s+qgrm+chmPtxYo=
 =c05b
 -----END PGP SIGNATURE-----

Merge tag 'tee-subsys-fix-for-4.21' of https://git.linaro.org/people/jens.wiklander/linux-tee into next/late

Avoid possible double list_del in supplicant comms

A fix for the OP-TEE driver to avoid possible double list_del during
tee-supplicant communication while the system is shutting down.

* tag 'tee-subsys-fix-for-4.21' of https://git.linaro.org/people/jens.wiklander/linux-tee:
  tee: optee: avoid possible double list_del()

Signed-off-by: Olof Johansson <olof@lixom.net>
This commit is contained in:
Olof Johansson 2018-12-31 13:05:53 -08:00
parent 8fe28cb58b b2d102bd01
commit 6ae284ab58
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/tee/optee/supp.c
View File

@ -19,7 +19,7 @@
struct optee_supp_req {
struct list_head link;
bool busy;
bool in_queue;
u32 func;
u32 ret;
size_t num_params;
@ -54,7 +54,6 @@ void optee_supp_release(struct optee_supp *supp)
/* Abort all request retrieved by supplicant */
idr_for_each_entry(&supp->idr, req, id) {
req->busy = false;
idr_remove(&supp->idr, id);
req->ret = TEEC_ERROR_COMMUNICATION;
complete(&req->c);
@ -63,6 +62,7 @@ void optee_supp_release(struct optee_supp *supp)
/* Abort all queued requests */
list_for_each_entry_safe(req, req_tmp, &supp->reqs, link) {
list_del(&req->link);
req->in_queue = false;
req->ret = TEEC_ERROR_COMMUNICATION;
complete(&req->c);
}
@ -103,6 +103,7 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
/* Insert the request in the request list */
mutex_lock(&supp->mutex);
list_add_tail(&req->link, &supp->reqs);
req->in_queue = true;
mutex_unlock(&supp->mutex);
/* Tell an eventual waiter there's a new request */
@ -130,9 +131,10 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
* will serve all requests in a timely manner and
* interrupting then wouldn't make sense.
*/
interruptable = !req->busy;
if (!req->busy)
if (req->in_queue) {
list_del(&req->link);
req->in_queue = false;
}
}
mutex_unlock(&supp->mutex);
@ -176,7 +178,7 @@ static struct optee_supp_req *supp_pop_entry(struct optee_supp *supp,
return ERR_PTR(-ENOMEM);
list_del(&req->link);
req->busy = true;
req->in_queue = false;
return req;
}
@ -318,7 +320,6 @@ static struct optee_supp_req *supp_pop_req(struct optee_supp *supp,
if ((num_params - nm) != req->num_params)
return ERR_PTR(-EINVAL);
req->busy = false;
idr_remove(&supp->idr, id);
supp->req_id = -1;
*num_meta = nm;