samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

securemsm-kernel: smcinvoke: Add missing unlock on function return

Browse Source 
Also reset the output buffer after processing.

Change-Id: Ib8d9b3ffe4c25c3c699df561d7f37776a8fcd538
Signed-off-by: Amirreza Zarrabi <quic_azarrabi@quicinc.com>
This commit is contained in:
Amirreza Zarrabi
2023-08-16 14:41:03 -07:00
committed by V S Ganga VaraPrasad (VARA) Adabala
parent 310ff6aaa8
commit eaa3b491d8
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
smcinvoke/smcinvoke.c
View File

@@ -1639,7 +1639,8 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp)
* case of callback objects.
*/
} else if (!TZHANDLE_IS_CB_OBJ(cb_req->hdr.tzhandle)) {
pr_err("Request object is not a callback object\n");
pr_err("Request object is not a callback object %x\n",
cb_req->hdr.tzhandle);
cb_req->result = OBJECT_ERROR_INVALID;
return;
}
@@ -1684,6 +1685,7 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp)
mem_obj= find_mem_obj_locked(TZHANDLE_GET_OBJID(cb_req->hdr.tzhandle),SMCINVOKE_MEM_RGN_OBJ);
if(!mem_obj) {
pr_err("mem obj with tzhandle : %d not found",cb_req->hdr.tzhandle);
mutex_unlock(&g_smcinvoke_lock);
goto out;
}
server_id = mem_obj->server->server_id;
@@ -2329,7 +2331,17 @@ static void process_piggyback_data(void *buf, size_t buf_size)
struct smcinvoke_piggyback_msg *msg = buf;
int32_t *objs = msg->objs;
if (msg->version == 0) {
/* QTEE reset the buffer if it is unused. */
return;
}
for (i = 0; i < msg->counts; i++) {
if (msg->op != OBJECT_OP_RELEASE) {
/* We only support release handler. */
break;
}
req.hdr.op = msg->op;
req.hdr.counts = 0; /* release op does not require any args */
req.hdr.tzhandle = objs[i];
@@ -2338,6 +2350,9 @@ static void process_piggyback_data(void *buf, size_t buf_size)
process_tzcb_req(&req, sizeof(struct smcinvoke_tzcb_req), NULL);
/* cbobjs_in_flight will be adjusted during CB processing */
}
/* Reset output buffer after processing.*/
memset(buf, 0, buf_size);
}