samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Introduce SSR protection wrapper to IPA callback APIs

Browse Source 
IPA driver calling WLAN driver callback, and in parallel WLAN
driver is unloading and freeing this callback, which leads to
a use after free scenario

Add SSR protection wrapper to all of IPA callback APIs in driver
to avoid racing against driver unload or SSR or self recovery

Change-Id: I5dcdfe4749b89104ec79eac060e60fe5aa7c2335
Crs-Fixed: 2307365
This commit is contained in:
jitiphil
2018-09-03 16:19:52 +05:30
committed by nshrivas
parent 80a4a1fcb8
commit ea80fa5597
3 changed files with 103 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ipa/core/inc/wlan_ipa_core.h
View File

@@ -322,8 +322,8 @@ QDF_STATUS wlan_ipa_uc_op_metering(struct wlan_ipa_priv *ipa_ctx,
struct op_msg_type *op_msg);
/**
* wlan_ipa_wdi_meter_notifier_cb() - WLAN to IPA callback handler.
* IPA calls to get WLAN stats or set quota limit.
* wlan_ipa_wdi_meter_notifier_cb() - SSR wrapper for
* __wlan_ipa_wdi_meter_notifier_cb
* @priv: pointer to private data registered with IPA (we register a
* pointer to the global IPA context)
* @evt: the IPA event which triggered the callback
@@ -332,7 +332,7 @@ QDF_STATUS wlan_ipa_uc_op_metering(struct wlan_ipa_priv *ipa_ctx,
* Return: None
*/
void wlan_ipa_wdi_meter_notifier_cb(qdf_ipa_wdi_meter_evt_type_t evt,
void *data);
void *data);
/**
* wlan_ipa_init_metering() - IPA metering stats completion event reset

81
ipa/core/src/wlan_ipa_core.c
View File

@@ -743,7 +743,7 @@ static enum wlan_ipa_forward_type wlan_ipa_intrabss_forward(
}
/**
* wlan_ipa_w2i_cb() - WLAN to IPA callback handler
* __wlan_ipa_w2i_cb() - WLAN to IPA callback handler
* @priv: pointer to private data registered with IPA (we register a
* pointer to the global IPA context)
* @evt: the IPA event which triggered the callback
@@ -751,8 +751,8 @@ static enum wlan_ipa_forward_type wlan_ipa_intrabss_forward(
*
* Return: None
*/
static void wlan_ipa_w2i_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
unsigned long data)
static void __wlan_ipa_w2i_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
unsigned long data)
{
struct wlan_ipa_priv *ipa_ctx = NULL;
qdf_nbuf_t skb;
@@ -761,6 +761,11 @@ static void wlan_ipa_w2i_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
struct wlan_ipa_iface_context *iface_context;
uint8_t fw_desc;
if (qdf_is_module_state_transitioning()) {
ipa_err("Module transition in progress");
return;
}
ipa_ctx = (struct wlan_ipa_priv *)priv;
if (!ipa_ctx)
@@ -834,7 +839,24 @@ static void wlan_ipa_w2i_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
}
/**
* wlan_ipa_i2w_cb() - IPA to WLAN callback
* wlan_ipa_w2i_cb() - SSR wrapper for __wlan_ipa_w2i_cb
* @priv: pointer to private data registered with IPA (we register a
* pointer to the global IPA context)
* @evt: the IPA event which triggered the callback
* @data: data associated with the event
*
* Return: None
*/
static void wlan_ipa_w2i_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
unsigned long data)
{
qdf_ssr_protect(__func__);
__wlan_ipa_w2i_cb(priv, evt, data);
qdf_ssr_unprotect(__func__);
}
/**
* __wlan_ipa_i2w_cb() - IPA to WLAN callback
* @priv: pointer to private data registered with IPA (we register a
* pointer to the interface-specific IPA context)
* @evt: the IPA event which triggered the callback
@@ -842,8 +864,8 @@ static void wlan_ipa_w2i_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
*
* Return: None
*/
static void wlan_ipa_i2w_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
unsigned long data)
static void __wlan_ipa_i2w_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
unsigned long data)
{
struct wlan_ipa_priv *ipa_ctx = NULL;
qdf_ipa_rx_data_t *ipa_tx_desc;
@@ -851,6 +873,11 @@ static void wlan_ipa_i2w_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
qdf_nbuf_t skb;
struct wlan_ipa_pm_tx_cb *pm_tx_cb = NULL;
if (qdf_is_module_state_transitioning()) {
ipa_err("Module transition in progress");
return;
}
iface_context = (struct wlan_ipa_iface_context *)priv;
ipa_tx_desc = (qdf_ipa_rx_data_t *)data;
ipa_ctx = iface_context->ipa_ctx;
@@ -903,6 +930,23 @@ static void wlan_ipa_i2w_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
return wlan_ipa_send_pkt_to_tl(iface_context, ipa_tx_desc);
}
/**
* wlan_ipa_i2w_cb() - IPA to WLAN callback
* @priv: pointer to private data registered with IPA (we register a
* pointer to the interface-specific IPA context)
* @evt: the IPA event which triggered the callback
* @data: data associated with the event
*
* Return: None
*/
static void wlan_ipa_i2w_cb(void *priv, qdf_ipa_dp_evt_type_t evt,
unsigned long data)
{
qdf_ssr_protect(__func__);
__wlan_ipa_i2w_cb(priv, evt, data);
qdf_ssr_unprotect(__func__);
}
QDF_STATUS wlan_ipa_suspend(struct wlan_ipa_priv *ipa_ctx)
{
/*
@@ -2674,18 +2718,23 @@ static void wlan_ipa_uc_op_cb(struct op_msg_type *op_msg,
}
/**
* wlan_ipa_uc_fw_op_event_handler - IPA uC FW OPvent handler
* @work: uC OP work
* __wlan_ipa_uc_fw_op_event_handler - IPA uC FW OPvent handler
* @data: uC OP work
*
* Return: None
*/
static void wlan_ipa_uc_fw_op_event_handler(void *data)
static void __wlan_ipa_uc_fw_op_event_handler(void *data)
{
struct op_msg_type *msg;
struct uc_op_work_struct *uc_op_work =
(struct uc_op_work_struct *)data;
struct wlan_ipa_priv *ipa_ctx = gp_ipa;
if (qdf_is_module_state_transitioning()) {
ipa_err("Module transition in progress");
return;
}
msg = uc_op_work->msg;
uc_op_work->msg = NULL;
ipa_debug("posted msg %d", msg->op_code);
@@ -2693,6 +2742,20 @@ static void wlan_ipa_uc_fw_op_event_handler(void *data)
wlan_ipa_uc_op_cb(msg, ipa_ctx);
}
/**
* wlan_ipa_uc_fw_op_event_handler - SSR wrapper for
* __wlan_ipa_uc_fw_op_event_handler
* @data: uC OP work
*
* Return: None
*/
static void wlan_ipa_uc_fw_op_event_handler(void *data)
{
qdf_ssr_protect(__func__);
__wlan_ipa_uc_fw_op_event_handler(data);
qdf_ssr_unprotect(__func__);
}
/**
* wlan_ipa_uc_op_event_handler() - IPA UC OP event handler
* @op_msg: operation message received from firmware

31
ipa/core/src/wlan_ipa_stats.c
View File

@@ -20,6 +20,7 @@
#include "wlan_ipa_main.h"
#include "wlan_ipa_core.h"
#include "cdp_txrx_ipa.h"
#include "qdf_platform.h"
/**
* wlan_ipa_uc_rt_debug_host_fill - fill rt debug buffer
@@ -845,7 +846,7 @@ QDF_STATUS wlan_ipa_uc_op_metering(struct wlan_ipa_priv *ipa_ctx,
}
/**
* wlan_ipa_wdi_meter_notifier_cb() - WLAN to IPA callback handler.
* __wlan_ipa_wdi_meter_notifier_cb() - WLAN to IPA callback handler.
* IPA calls to get WLAN stats or set quota limit.
* @priv: pointer to private data registered with IPA (we register a
* pointer to the IPA context)
@@ -854,8 +855,8 @@ QDF_STATUS wlan_ipa_uc_op_metering(struct wlan_ipa_priv *ipa_ctx,
*
* Return: None
*/
void wlan_ipa_wdi_meter_notifier_cb(qdf_ipa_wdi_meter_evt_type_t evt,
void *data)
static void __wlan_ipa_wdi_meter_notifier_cb(qdf_ipa_wdi_meter_evt_type_t evt,
void *data)
{
struct wlan_ipa_priv *ipa_ctx = wlan_ipa_get_obj_context();
struct wlan_ipa_iface_context *iface_ctx;
@@ -865,6 +866,11 @@ void wlan_ipa_wdi_meter_notifier_cb(qdf_ipa_wdi_meter_evt_type_t evt,
ipa_debug("event=%d", evt);
if (qdf_is_module_state_transitioning()) {
ipa_err("Module transition in progress");
return;
}
iface_ctx = wlan_ipa_get_iface(ipa_ctx, QDF_STA_MODE);
if (!iface_ctx) {
ipa_err("IPA uC share stats failed - no iface");
@@ -937,4 +943,23 @@ void wlan_ipa_wdi_meter_notifier_cb(qdf_ipa_wdi_meter_evt_type_t evt,
break;
}
}
/**
* wlan_ipa_wdi_meter_notifier_cb() - SSR wrapper for
* __wlan_ipa_wdi_meter_notifier_cb
* @priv: pointer to private data registered with IPA (we register a
* pointer to the IPA context)
* @evt: the IPA event which triggered the callback
* @data: data associated with the event
*
* Return: None
*/
void wlan_ipa_wdi_meter_notifier_cb(qdf_ipa_wdi_meter_evt_type_t evt,
void *data)
{
qdf_ssr_protect(__func__);
__wlan_ipa_wdi_meter_notifier_cb(evt, data);
qdf_ssr_unprotect(__func__);
}
#endif /* FEATURE_METERING */