linux-stable.git/drivers/rpmsg, branch v4.14.166

rpmsg: glink: Free pending deferred work on remove

2019-12-21T09:47:47+00:00

commit 278bcb7300f61785dba63840bd2a8cf79f14554c upstream.

By just cancelling the deferred rx worker during GLINK instance teardown
any pending deferred commands are leaked, so free them.

Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Acked-by: Chris Lew 
Tested-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Don't send pending rx_done during remove

2019-12-21T09:47:47+00:00

commit c3dadc19b7564c732598b30d637c6f275c3b77b6 upstream.

Attempting to transmit rx_done messages after the GLINK instance is
being torn down will cause use after free and memory leaks. So cancel
the intent_work and free up the pending intents.

With this there are no concurrent accessors of the channel left during
qcom_glink_native_remove() and there is therefor no need to hold the
spinlock during this operation - which would prohibit the use of
cancel_work_sync() in the release function. So remove this.

Fixes: 1d2ea36eead9 ("rpmsg: glink: Add rx done command")
Cc: stable@vger.kernel.org
Acked-by: Chris Lew 
Tested-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Fix rpmsg_register_device err handling

2019-12-21T09:47:46+00:00

commit f7e714988edaffe6ac578318e99501149b067ba0 upstream.

The device release function is set before registering with rpmsg. If
rpmsg registration fails, the framework will call device_put(), which
invokes the release function. The channel create logic does not need to
free rpdev if rpmsg_register_device() fails and release is called.

Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Tested-by: Srinivas Kandagatla 
Signed-off-by: Chris Lew 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Put an extra reference during cleanup

2019-12-21T09:47:46+00:00

commit b646293e272816dd0719529dcebbd659de0722f7 upstream.

In a remote processor crash scenario, there is no guarantee the remote
processor sent close requests before it went into a bad state. Remove
the reference that is normally handled by the close command in the
so channel resources can be released.

Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Tested-by: Srinivas Kandagatla 
Signed-off-by: Chris Lew 
Reported-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Fix use after free in open_ack TIMEOUT case

2019-12-21T09:47:45+00:00

commit ac74ea01860170699fb3b6ea80c0476774c8e94f upstream.

Extra channel reference put when remote sending OPEN_ACK after timeout
causes use-after-free while handling next remote CLOSE command.

Remove extra reference put in timeout case to avoid use-after-free.

Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Tested-by: Srinivas Kandagatla 
Signed-off-by: Arun Kumar Neelakantam 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Fix reuse intents memory leak issue

2019-12-21T09:47:44+00:00

commit b85f6b601407347f5425c4c058d1b7871f5bf4f0 upstream.

Memory allocated for re-usable intents are not freed during channel
cleanup which causes memory leak in system.

Check and free all re-usable memory to avoid memory leak.

Fixes: 933b45da5d1d ("rpmsg: glink: Add support for TX intents")
Cc: stable@vger.kernel.org
Acked-By: Chris Lew 
Tested-by: Srinivas Kandagatla 
Signed-off-by: Arun Kumar Neelakantam 
Reported-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Set tail pointer to 0 at end of FIFO

2019-12-21T09:47:44+00:00

commit 4623e8bf1de0b86e23a56cdb39a72f054e89c3bd upstream.

When wrapping around the FIFO, the remote expects the tail pointer to
be reset to 0 on the edge case where the tail equals the FIFO length.

Fixes: caf989c350e8 ("rpmsg: glink: Introduce glink smem based transport")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Lew 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: smd: fix memory leak on channel create

2018-11-13T19:15:12+00:00

commit 940c620d6af8fca7d115de40f19870fba415efac upstream.

Currently a failed allocation of channel->name leads to an
immediate return without freeing channel. Fix this by setting
ret to -ENOMEM and jumping to an exit path that kfree's channel.

Detected by CoverityScan, CID#1473692 ("Resource Leak")

Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend")
Cc: stable@vger.kernel.org
Signed-off-by: Colin Ian King 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

Revert "rpmsg: core: add support to power domains for devices"

2018-09-29T10:06:04+00:00

This reverts commit 1ed3a93072307265d6385031b72929a904b50f87 which is
commit fe782affd0f440a4e60e2cc81b8f2eccb2923113 upstream

Rafael reports that this patch causes problems:
	> -rc2 looks good. There is a problem on dragonboard during boot that was
	> introduced in v4.14.71 that I didn't notice last week. We'll bisect it
	> and report back later this week. dragonboard on the other branches (4.9,
	> 4.18, mainline) looks fine.

	As Dan pointed out, during validation, we have bisected this issue on
	a dragonboard 410c (can't find root device) to the following commit
	for v4.14:

	[1ed3a9307230] rpmsg: core: add support to power domains for devices

	There is an on-going discussion on "[PATCH] rpmsg: core: add support
	to power domains for devices" about this patch having other
	dependencies and breaking something else on v4.14 as well.

so drop it.

Reported-by: Rafael Tinoco 
Cc: Srinivas Kandagatla 
Cc: Bjorn Andersson 
Cc: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

rpmsg: core: add support to power domains for devices

2018-09-19T20:43:41+00:00

[ Upstream commit fe782affd0f440a4e60e2cc81b8f2eccb2923113 ]

Some of the rpmsg devices need to switch on power domains to communicate
with remote processor. For example on Qualcomm DB820c platform LPASS
power domain needs to switched on for any kind of audio services.
This patch adds the missing power domain support in rpmsg core.

Without this patch attempting to play audio via QDSP on DB820c would
reboot the system.

Signed-off-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman