]> git.itanic.dy.fi Git - linux-stable/commit
misc: fastrpc: reject new invocations during device removal
authorRichard Acayan <mailingradian@gmail.com>
Tue, 23 May 2023 15:25:50 +0000 (16:25 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 9 Jun 2023 08:34:20 +0000 (10:34 +0200)
commit2e787e5153b7a43b09d8272999fda6375fed3686
tree1cf2103a3290838f52d69c382b1d4b18fc2b9d4d
parent93f2aa05af2dd0a0a685b194fbb7cd7c9fa8651f
misc: fastrpc: reject new invocations during device removal

commit 46248400d81e2aa0b65cd659d6f40188192a58b6 upstream.

The channel's rpmsg object allows new invocations to be made. After old
invocations are already interrupted, the driver shouldn't try to invoke
anymore. Invalidating the rpmsg at the end of the driver removal
function makes it easy to cause a race condition in userspace. Even
closing a file descriptor before the driver finishes its cleanup can
cause an invocation via fastrpc_release_current_dsp_process() and
subsequent timeout.

Invalidate the channel before the invocations are interrupted to make
sure that no invocations can be created to hang after the device closes.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable <stable@kernel.org>
Signed-off-by: Richard Acayan <mailingradian@gmail.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20230523152550.438363-5-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/fastrpc.c