diff options
author | Olof Johansson <olof@lixom.net> | 2019-01-01 00:05:53 +0300 |
---|---|---|
committer | Olof Johansson <olof@lixom.net> | 2019-01-01 00:05:53 +0300 |
commit | 6ae284ab58a2e990a5f4daba1eb42fc600cf004b (patch) | |
tree | 3267b665949186f9e568ddfaaae4db7666436f09 /drivers/tee/optee | |
parent | 8fe28cb58bcb235034b64cbbb7550a8a43fd88be (diff) | |
parent | b2d102bd0146d9eb1fa630ca0cd19a15ef2f74c8 (diff) | |
download | linux-6ae284ab58a2e990a5f4daba1eb42fc600cf004b.tar.xz |
Merge tag 'tee-subsys-fix-for-4.21' of https://git.linaro.org/people/jens.wiklander/linux-tee into next/late
Avoid possible double list_del in supplicant comms
A fix for the OP-TEE driver to avoid possible double list_del during
tee-supplicant communication while the system is shutting down.
* tag 'tee-subsys-fix-for-4.21' of https://git.linaro.org/people/jens.wiklander/linux-tee:
tee: optee: avoid possible double list_del()
Signed-off-by: Olof Johansson <olof@lixom.net>
Diffstat (limited to 'drivers/tee/optee')
-rw-r--r-- | drivers/tee/optee/supp.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/drivers/tee/optee/supp.c b/drivers/tee/optee/supp.c index df35fc01fd3e..43626e15703a 100644 --- a/drivers/tee/optee/supp.c +++ b/drivers/tee/optee/supp.c @@ -19,7 +19,7 @@ struct optee_supp_req { struct list_head link; - bool busy; + bool in_queue; u32 func; u32 ret; size_t num_params; @@ -54,7 +54,6 @@ void optee_supp_release(struct optee_supp *supp) /* Abort all request retrieved by supplicant */ idr_for_each_entry(&supp->idr, req, id) { - req->busy = false; idr_remove(&supp->idr, id); req->ret = TEEC_ERROR_COMMUNICATION; complete(&req->c); @@ -63,6 +62,7 @@ void optee_supp_release(struct optee_supp *supp) /* Abort all queued requests */ list_for_each_entry_safe(req, req_tmp, &supp->reqs, link) { list_del(&req->link); + req->in_queue = false; req->ret = TEEC_ERROR_COMMUNICATION; complete(&req->c); } @@ -103,6 +103,7 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params, /* Insert the request in the request list */ mutex_lock(&supp->mutex); list_add_tail(&req->link, &supp->reqs); + req->in_queue = true; mutex_unlock(&supp->mutex); /* Tell an eventual waiter there's a new request */ @@ -130,9 +131,10 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params, * will serve all requests in a timely manner and * interrupting then wouldn't make sense. */ - interruptable = !req->busy; - if (!req->busy) + if (req->in_queue) { list_del(&req->link); + req->in_queue = false; + } } mutex_unlock(&supp->mutex); @@ -176,7 +178,7 @@ static struct optee_supp_req *supp_pop_entry(struct optee_supp *supp, return ERR_PTR(-ENOMEM); list_del(&req->link); - req->busy = true; + req->in_queue = false; return req; } @@ -318,7 +320,6 @@ static struct optee_supp_req *supp_pop_req(struct optee_supp *supp, if ((num_params - nm) != req->num_params) return ERR_PTR(-EINVAL); - req->busy = false; idr_remove(&supp->idr, id); supp->req_id = -1; *num_meta = nm; |