From patchwork Wed Sep 18 17:19:15 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bjorn Andersson X-Patchwork-Id: 173988 Delivered-To: patch@linaro.org Received: by 2002:a92:7e96:0:0:0:0:0 with SMTP id q22csp2731982ill; Wed, 18 Sep 2019 10:19:34 -0700 (PDT) X-Google-Smtp-Source: APXvYqzqaSiwkRObbDMGpXduhKDwZSAFqAgSK7Hlrh6x07Wi8K29M1LmNQJoSq+kwJEo2tlrhoby X-Received: by 2002:a17:906:6bd5:: with SMTP id t21mr9308253ejs.128.1568827174342; Wed, 18 Sep 2019 10:19:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1568827174; cv=none; d=google.com; s=arc-20160816; b=bz0N86i3oH1fvNh7tIlL2GeZPMvMmKA8NOqqQkLQOREhhEmUkwX3FHbwXplzZpmT4p lFFG26ogtlC2Z97h7eUtODG7rIyU1cecQMklqLMy1Mf4leu2bFwXuCX6Nay3TcnArvy4 sxXGwuYO9V15Nw2zappeQVrlKVdEO4uL/tm4sXz5AdVpRrFzjVYvg6cvEILRV4G51oCs DE4FOqw9r8bFVabhyNzMPxh+uNIcPl0YI40ww2Qxx/vg2NwugelA9a8Z4s+RYqpJu/ua 8Z9ZRPkzf8Oguyj6Gj9BuXKAGFort3awQTjDgnHwzxsyDGONedcPF3u8U6+rOb4FhbEk CnIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature; bh=Zted6byoUjfvi72VSDIhM8pesVU1cPbkC92rYkmfs6k=; b=yoRl07HsNuyAvncIDUlABEcJ9uYFqa8AU2dRwRgXodLFAX1k8S2khO6N54MhRTbFIz bOG5KlNwfi6eY4OiCmBeUGS3lI/1XCgge54KZN9oj8kng6FpqG7Lxxnhfr0MuALrgrdX X5B5vX8y1LAEBNpEG8diAYTzJEpk4nSko0Ip/IrSD9L0pc+akA/9Ub2hMrmuvco2SeWF VBjt5ewLuu2/WwfhUYB5Vd6v0Rw845CeynkuUZ8KIP9bXtVb6EYdeeAl//wu9pbW7xR2 Hign1o1mJ6XOpewxgKGbWuoV4mbHqsh7hwzEX8ju/2LvjdGdGoUqHTktzru5qVcOkvcz m9Og== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=rYhSObq4; spf=pass (google.com: best guess record for domain of linux-arm-msm-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-arm-msm-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id r18si1604702ejr.189.2019.09.18.10.19.34; Wed, 18 Sep 2019 10:19:34 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-arm-msm-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=rYhSObq4; spf=pass (google.com: best guess record for domain of linux-arm-msm-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-arm-msm-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732143AbfIRRT2 (ORCPT + 15 others); Wed, 18 Sep 2019 13:19:28 -0400 Received: from mail-pl1-f196.google.com ([209.85.214.196]:34235 "EHLO mail-pl1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732129AbfIRRT1 (ORCPT ); Wed, 18 Sep 2019 13:19:27 -0400 Received: by mail-pl1-f196.google.com with SMTP id d3so277481plr.1 for ; Wed, 18 Sep 2019 10:19:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Zted6byoUjfvi72VSDIhM8pesVU1cPbkC92rYkmfs6k=; b=rYhSObq4evGVg356bza5zIWCf7uvuBbpf4HCEDLaZ/lBqNwdVQZDZZoJiUCg5d1A6b cmF677BmCdEDLLgmJKuII4SBexOEnJwmuqvItJo7DaeE8IDlhRrFU1xI9PNu54Am5Nsq 8O0JANibva5B7rlPn5iBN4STl/6PWnmXYTPwCkim8kiqhcs1bBXjWFga1BqcQvhJ+3jx 6H3jIg+C1VUq53LrNHDo9jwI4WZQH3nT2sDwFIIyNQGKmh9nDz2jmGUAUZmF6LsTpOp4 0UBsPBSdsE1TcqagQJhKslYjT7t1M6t8FJAsbCKRKUeRT04AaniPiAI5g229tX0I+wvt tjtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Zted6byoUjfvi72VSDIhM8pesVU1cPbkC92rYkmfs6k=; b=kTWbwXOgXwLfBV95BBPNPLmnfN9sl99ekotDMgonBlZKFohmlkdtrisGfM382G0Fk7 HqF4tudUfzfenT6Yhqa1AIcI5IM48+ssE9P7qG/n8kF+eqfPnRK7emrGD4kE5frD7YVx ddlRDvScH914rMU9I01uKL0QK0UDF6Qv4r3y6Hyxhp0XR3rBclCRCtMbj9IWxzcr44Ah p30LOPovcuOpOv6THc0zProdDwlSgbCvRe2cwYyu6kuZnbeJK5qR9ftHIfAOYN1szhQ4 NYmTiFZ3Oo+r7BngJ7q1YJVqusEfOpJcyocBulhCRK8XmiIiKdCDX7y6BFkZ+lMcIF5w EuSw== X-Gm-Message-State: APjAAAXSxcAqbaAPEe2gDZakaqdlYYKo/QmXXXp7tAt8Xn5C9wTU4bZk lH+dq6uTx8q1Y5+3g6lCEZSPzQ== X-Received: by 2002:a17:902:b497:: with SMTP id y23mr5286203plr.201.1568827166359; Wed, 18 Sep 2019 10:19:26 -0700 (PDT) Received: from localhost.localdomain (104-188-17-28.lightspeed.sndgca.sbcglobal.net. [104.188.17.28]) by smtp.gmail.com with ESMTPSA id y4sm2614981pjn.19.2019.09.18.10.19.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 18 Sep 2019 10:19:25 -0700 (PDT) From: Bjorn Andersson To: Ohad Ben-Cohen , Bjorn Andersson , Srinivas Kandagatla , Jorge Ramirez Cc: linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 5/6] rpmsg: glink: Don't send pending rx_done during remove Date: Wed, 18 Sep 2019 10:19:15 -0700 Message-Id: <20190918171916.4039-6-bjorn.andersson@linaro.org> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20190918171916.4039-1-bjorn.andersson@linaro.org> References: <20190918171916.4039-1-bjorn.andersson@linaro.org> Sender: linux-arm-msm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org Attempting to transmit rx_done messages after the GLINK instance is being torn down will cause use after free and memory leaks. So cancel the intent_work and free up the pending intents. Fixes: 1d2ea36eead9 ("rpmsg: glink: Add rx done command") Cc: stable@vger.kernel.org Signed-off-by: Bjorn Andersson --- drivers/rpmsg/qcom_glink_native.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) -- 2.18.0 diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c index 89e02baea2d0..0d7518a6ebf0 100644 --- a/drivers/rpmsg/qcom_glink_native.c +++ b/drivers/rpmsg/qcom_glink_native.c @@ -241,11 +241,23 @@ static void qcom_glink_channel_release(struct kref *ref) { struct glink_channel *channel = container_of(ref, struct glink_channel, refcount); + struct glink_core_rx_intent *intent; struct glink_core_rx_intent *tmp; unsigned long flags; int iid; + /* cancel pending rx_done work */ + cancel_work_sync(&channel->intent_work); + spin_lock_irqsave(&channel->intent_lock, flags); + /* Free all non-reuse intents pending rx_done work */ + list_for_each_entry_safe(intent, tmp, &channel->done_intents, node) { + if (!intent->reuse) { + kfree(intent->data); + kfree(intent); + } + } + idr_for_each_entry(&channel->liids, tmp, iid) { kfree(tmp->data); kfree(tmp);