diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2017-05-05 07:37:23 +0200 |
|---|---|---|
| committer | Thierry Reding <treding@nvidia.com> | 2017-06-14 17:17:32 +0200 |
| commit | cd307124ad9bb01019920c2053696218d161f4a1 (patch) | |
| tree | bc8a092a7fcb19ec75b79f4405ef53d62855a3cc /drivers/firmware | |
| parent | Linux 4.12-rc1 (diff) | |
| download | linux-cd307124ad9bb01019920c2053696218d161f4a1.tar.xz linux-cd307124ad9bb01019920c2053696218d161f4a1.zip | |
firmware: tegra: Fix locking bugs in BPMP
There are a bunch of error paths were we don't unlock the bpmp->threaded
lock. Also if __tegra_bpmp_channel_write() fails then we returned
success instead of an error code.
Fixes: 983de5f97169 ("firmware: tegra: Add BPMP support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Diffstat (limited to 'drivers/firmware')
| -rw-r--r-- | drivers/firmware/tegra/bpmp.c | 28 |
1 files changed, 18 insertions, 10 deletions
diff --git a/drivers/firmware/tegra/bpmp.c b/drivers/firmware/tegra/bpmp.c index 84e4c9a58a0c..fd18f03b3201 100644 --- a/drivers/firmware/tegra/bpmp.c +++ b/drivers/firmware/tegra/bpmp.c @@ -211,14 +211,17 @@ static ssize_t tegra_bpmp_channel_read(struct tegra_bpmp_channel *channel, int index; index = tegra_bpmp_channel_get_thread_index(channel); - if (index < 0) - return index; + if (index < 0) { + err = index; + goto unlock; + } spin_lock_irqsave(&bpmp->lock, flags); err = __tegra_bpmp_channel_read(channel, data, size); clear_bit(index, bpmp->threaded.allocated); spin_unlock_irqrestore(&bpmp->lock, flags); +unlock: up(&bpmp->threaded.lock); return err; @@ -256,18 +259,18 @@ tegra_bpmp_write_threaded(struct tegra_bpmp *bpmp, unsigned int mrq, index = find_first_zero_bit(bpmp->threaded.allocated, count); if (index == count) { - channel = ERR_PTR(-EBUSY); + err = -EBUSY; goto unlock; } channel = tegra_bpmp_channel_get_thread(bpmp, index); if (!channel) { - channel = ERR_PTR(-EINVAL); + err = -EINVAL; goto unlock; } if (!tegra_bpmp_master_free(channel)) { - channel = ERR_PTR(-EBUSY); + err = -EBUSY; goto unlock; } @@ -275,16 +278,21 @@ tegra_bpmp_write_threaded(struct tegra_bpmp *bpmp, unsigned int mrq, err = __tegra_bpmp_channel_write(channel, mrq, MSG_ACK | MSG_RING, data, size); - if (err < 0) { - clear_bit(index, bpmp->threaded.allocated); - goto unlock; - } + if (err < 0) + goto clear_allocated; set_bit(index, bpmp->threaded.busy); -unlock: spin_unlock_irqrestore(&bpmp->lock, flags); return channel; + +clear_allocated: + clear_bit(index, bpmp->threaded.allocated); +unlock: + spin_unlock_irqrestore(&bpmp->lock, flags); + up(&bpmp->threaded.lock); + + return ERR_PTR(err); } static ssize_t tegra_bpmp_channel_write(struct tegra_bpmp_channel *channel, |