이름 없는 문서

From aa4225b7015d513e6e688781fd7aadbf04659139 Mon Sep 17 00:00:00 2001
From: Wei Wang <wvw@google.com>
Date: Tue, 6 Sep 2016 15:40:55 -0700
Subject: [PATCH] sps: add spinlock protection for pipes_q being tainted

Bug: 31119496
Change-Id: I7d71f58e37d5ea85f15625078ab0d6cfa0362bff
---
 drivers/platform/msm/sps/sps_bam.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/platform/msm/sps/sps_bam.c b/drivers/platform/msm/sps/sps_bam.c
index 11fd94a3572..c207a7fe4c5 100644
--- a/drivers/platform/msm/sps/sps_bam.c
+++ b/drivers/platform/msm/sps/sps_bam.c
@@ -715,6 +715,7 @@ int sps_bam_pipe_connect(struct sps_pipe *bam_pipe,
 	void *desc_buf = NULL;
 	u32 pipe_index;
 	int result;
+	unsigned long flags;
 
 	/* Clear the client pipe state and hw init struct */
 	pipe_clear(bam_pipe);
@@ -908,8 +909,10 @@ int sps_bam_pipe_connect(struct sps_pipe *bam_pipe,
 
 	/* Indicate initialization is complete */
 	dev->pipes[pipe_index] = bam_pipe;
+	spin_lock_irqsave(&dev->isr_lock, flags);
 	dev->pipe_active_mask |= 1UL << pipe_index;
 	list_add_tail(&bam_pipe->list, &dev->pipes_q);
+	spin_unlock_irqrestore(&dev->isr_lock, flags);
 
 	bam_pipe->state |= BAM_STATE_INIT;
 	result = 0;
@@ -938,6 +941,7 @@ int sps_bam_pipe_disconnect(struct sps_bam *dev, u32 pipe_index)
 {
 	struct sps_pipe *pipe;
 	int result;
+	unsigned long flags;
 
 	if (pipe_index >= dev->props.num_pipes) {
 		SPS_ERR("sps:Invalid BAM %pa pipe: %d\n", BAM_ID(dev),
@@ -949,8 +953,10 @@ int sps_bam_pipe_disconnect(struct sps_bam *dev, u32 pipe_index)
 	pipe = dev->pipes[pipe_index];
 	if (BAM_PIPE_IS_ASSIGNED(pipe)) {
 		if ((dev->pipe_active_mask & (1UL << pipe_index))) {
+			spin_lock_irqsave(&dev->isr_lock, flags);
 			list_del(&pipe->list);
 			dev->pipe_active_mask &= ~(1UL << pipe_index);
+			spin_unlock_irqrestore(&dev->isr_lock, flags);
 		}
 		dev->pipe_remote_mask &= ~(1UL << pipe_index);
 		if (pipe->connect.options & SPS_O_NO_DISABLE)
@@ -2018,6 +2024,7 @@ int sps_bam_get_free_count(struct sps_bam *dev, u32 pipe_index,
 int sps_bam_set_satellite(struct sps_bam *dev, u32 pipe_index)
 {
 	struct sps_pipe *pipe = dev->pipes[pipe_index];
+	unsigned long flags;
 
 	/*
 	 * Switch to satellite control is only supported on processor
@@ -2059,8 +2066,10 @@ int sps_bam_set_satellite(struct sps_bam *dev, u32 pipe_index)
 	}
 
 	/* Indicate satellite control */
+	spin_lock_irqsave(&dev->isr_lock, flags);
 	list_del(&pipe->list);
 	dev->pipe_active_mask &= ~(1UL << pipe_index);
+	spin_unlock_irqrestore(&dev->isr_lock, flags);
 	dev->pipe_remote_mask |= pipe->pipe_index_mask;
 	pipe->state |= BAM_STATE_REMOTE;