samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

securemsm-kernel: smcinvoke: Release map objs if invoke call fails

Browse Source 
This change is a correction on top of commit: b1c6f1e9
which provided the fix for same issue but had a catch.
In the previous change, kref_put was being done on an
empty list. This change fixes that issue and deletes the
list after kref_put is done.

Root cause of original issue:
If invoke call fails due to some reason, map objects created
for memory objects should also be released. Failing to do so,
creates a memory leak as TZ is unaware of these objects and
no one calls release on these.

Change-Id: Ibad583f6c45fbed05539757eb50a39289d532328
Signed-off-by: Anmolpreet Kaur <quic_anmolpre@quicinc.com>
This commit is contained in:
Anmolpreet Kaur
2023-08-11 00:30:30 +05:30
committed by Gerrit - the friendly Code Review server
parent f20c65ab0e
commit e2e161b34c
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
smcinvoke/smcinvoke.c
View File

@@ -2800,7 +2800,6 @@ static long process_invoke_req(struct file *filp, unsigned int cmd,
if (mem_obj_async_support) { if (mem_obj_async_support) {
mutex_lock(&g_smcinvoke_lock); mutex_lock(&g_smcinvoke_lock);
add_mem_obj_info_to_async_side_channel_locked(out_msg, outmsg_size, &l_mem_objs_pending_async); add_mem_obj_info_to_async_side_channel_locked(out_msg, outmsg_size, &l_mem_objs_pending_async);
delete_pending_async_list_locked(&l_mem_objs_pending_async);
mutex_unlock(&g_smcinvoke_lock); mutex_unlock(&g_smcinvoke_lock);
} }
@@ -2858,6 +2857,7 @@ out:
release_map_obj_pending_async_list_locked(&l_mem_objs_pending_async); release_map_obj_pending_async_list_locked(&l_mem_objs_pending_async);
release_tzhandles(tzhandles_to_release, OBJECT_COUNTS_MAX_OO); release_tzhandles(tzhandles_to_release, OBJECT_COUNTS_MAX_OO);
} }
delete_pending_async_list_locked(&l_mem_objs_pending_async);
qtee_shmbridge_free_shm(&in_shm); qtee_shmbridge_free_shm(&in_shm);
qtee_shmbridge_free_shm(&out_shm); qtee_shmbridge_free_shm(&out_shm);
kfree(args_buf); kfree(args_buf);