evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

diag: dci: Protect the client list and command entries

Browse source 
Currently, on open and close notification for channels,
the dci clients are updated accordingly. The list
traversal for active dci clients are not mutex protected.
Also searching for command registration in table is not
properly protected. This patch mutex protect the list
traversal and command registration table search to avoid
stale entries.

Change-Id: I015d6674afd605c63cd01ceec0109d9da5462629
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
This commit is contained in:
Mohit Aggarwal 2016-01-04 17:10:30 +05:30 • committed by Gerrit - the friendly Code Review server
parent 3162449f7d
commit 4aaf2b8098
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/char/diag/diag_dci.c
View file

@ -1444,6 +1444,7 @@ void diag_dci_notify_client(int peripheral_mask, int data, int proc)
dci_ops_tbl[proc].peripheral_status &= ~peripheral_mask; dci_ops_tbl[proc].peripheral_status &= ~peripheral_mask;
/* Notify the DCI process that the peripheral DCI Channel is up */ /* Notify the DCI process that the peripheral DCI Channel is up */
mutex_lock(&driver->dci_mutex);
list_for_each_safe(start, temp, &driver->dci_client_list) { list_for_each_safe(start, temp, &driver->dci_client_list) {
entry = list_entry(start, struct diag_dci_client_tbl, track); entry = list_entry(start, struct diag_dci_client_tbl, track);
if (entry->client_info.token != proc) if (entry->client_info.token != proc)
@ -1466,6 +1467,7 @@ void diag_dci_notify_client(int peripheral_mask, int data, int proc)
info.si_int, stat); info.si_int, stat);
} }
} }
mutex_unlock(&driver->dci_mutex);
} }
static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry, static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry,
@ -1938,6 +1940,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
reg_entry.cmd_code_hi = header->subsys_cmd_code; reg_entry.cmd_code_hi = header->subsys_cmd_code;
reg_entry.cmd_code_lo = header->subsys_cmd_code; reg_entry.cmd_code_lo = header->subsys_cmd_code;
mutex_lock(&driver->cmd_reg_mutex);
temp_entry = diag_cmd_search(&reg_entry, ALL_PROC); temp_entry = diag_cmd_search(&reg_entry, ALL_PROC);
if (temp_entry) { if (temp_entry) {
reg_item = container_of(temp_entry, struct diag_cmd_reg_t, reg_item = container_of(temp_entry, struct diag_cmd_reg_t,
@ -1949,6 +1952,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
reg_entry.cmd_code, reg_entry.subsys_id, reg_entry.cmd_code, reg_entry.subsys_id,
reg_entry.cmd_code_hi); reg_entry.cmd_code_hi);
} }
mutex_unlock(&driver->cmd_reg_mutex);
return ret; return ret;
} }