linux-stable.git/drivers/rpmsg, branch v4.19.166

rpmsg: glink: Use complete_all for open states

2020-11-05T10:08:43+00:00

[ Upstream commit 4fcdaf6e28d11e2f3820d54dd23cd12a47ddd44e ]

The open_req and open_ack completion variables are the state variables
to represet a remote channel as open. Use complete_all so there are no
races with waiters and using completion_done.

Signed-off-by: Chris Lew 
Signed-off-by: Arun Kumar Neelakantam 
Signed-off-by: Deepak Kumar Singh 
Link: https://lore.kernel.org/r/1593017121-7953-2-git-send-email-deesin@codeaurora.org
Signed-off-by: Bjorn Andersson 
Signed-off-by: Sasha Levin

rpmsg: smd: Fix a kobj leak in in qcom_smd_parse_edge()

2020-10-30T09:38:21+00:00

[ Upstream commit e69ee0cf655e8e0c4a80f4319e36019b74f17639 ]

We need to call of_node_put(node) on the error paths for this function.

Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend")
Signed-off-by: Dan Carpenter 
Link: https://lore.kernel.org/r/20200908071841.GA294938@mwanda
Signed-off-by: Bjorn Andersson 
Signed-off-by: Sasha Levin

rpmsg: glink: Remove chunk size word align warning

2020-04-13T08:45:16+00:00

commit f0beb4ba9b185d497c8efe7b349363700092aee0 upstream.

It is possible for the chunk sizes coming from the non RPM remote procs
to not be word aligned. Remove the alignment warning and continue to
read from the FIFO so execution is not stalled.

Signed-off-by: Chris Lew 
Signed-off-by: Arun Kumar Neelakantam 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Lee Jones 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Free pending deferred work on remove

2019-12-21T09:57:30+00:00

commit 278bcb7300f61785dba63840bd2a8cf79f14554c upstream.

By just cancelling the deferred rx worker during GLINK instance teardown
any pending deferred commands are leaked, so free them.

Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Acked-by: Chris Lew 
Tested-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Don't send pending rx_done during remove

2019-12-21T09:57:29+00:00

commit c3dadc19b7564c732598b30d637c6f275c3b77b6 upstream.

Attempting to transmit rx_done messages after the GLINK instance is
being torn down will cause use after free and memory leaks. So cancel
the intent_work and free up the pending intents.

With this there are no concurrent accessors of the channel left during
qcom_glink_native_remove() and there is therefor no need to hold the
spinlock during this operation - which would prohibit the use of
cancel_work_sync() in the release function. So remove this.

Fixes: 1d2ea36eead9 ("rpmsg: glink: Add rx done command")
Cc: stable@vger.kernel.org
Acked-by: Chris Lew 
Tested-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Fix rpmsg_register_device err handling

2019-12-21T09:57:28+00:00

commit f7e714988edaffe6ac578318e99501149b067ba0 upstream.

The device release function is set before registering with rpmsg. If
rpmsg registration fails, the framework will call device_put(), which
invokes the release function. The channel create logic does not need to
free rpdev if rpmsg_register_device() fails and release is called.

Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Tested-by: Srinivas Kandagatla 
Signed-off-by: Chris Lew 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Put an extra reference during cleanup

2019-12-21T09:57:28+00:00

commit b646293e272816dd0719529dcebbd659de0722f7 upstream.

In a remote processor crash scenario, there is no guarantee the remote
processor sent close requests before it went into a bad state. Remove
the reference that is normally handled by the close command in the
so channel resources can be released.

Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Tested-by: Srinivas Kandagatla 
Signed-off-by: Chris Lew 
Reported-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Fix use after free in open_ack TIMEOUT case

2019-12-21T09:57:27+00:00

commit ac74ea01860170699fb3b6ea80c0476774c8e94f upstream.

Extra channel reference put when remote sending OPEN_ACK after timeout
causes use-after-free while handling next remote CLOSE command.

Remove extra reference put in timeout case to avoid use-after-free.

Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable@vger.kernel.org
Tested-by: Srinivas Kandagatla 
Signed-off-by: Arun Kumar Neelakantam 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Fix reuse intents memory leak issue

2019-12-21T09:57:26+00:00

commit b85f6b601407347f5425c4c058d1b7871f5bf4f0 upstream.

Memory allocated for re-usable intents are not freed during channel
cleanup which causes memory leak in system.

Check and free all re-usable memory to avoid memory leak.

Fixes: 933b45da5d1d ("rpmsg: glink: Add support for TX intents")
Cc: stable@vger.kernel.org
Acked-By: Chris Lew 
Tested-by: Srinivas Kandagatla 
Signed-off-by: Arun Kumar Neelakantam 
Reported-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Set tail pointer to 0 at end of FIFO

2019-12-21T09:57:26+00:00

commit 4623e8bf1de0b86e23a56cdb39a72f054e89c3bd upstream.

When wrapping around the FIFO, the remote expects the tail pointer to
be reset to 0 on the edge case where the tail equals the FIFO length.

Fixes: caf989c350e8 ("rpmsg: glink: Introduce glink smem based transport")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Lew 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman