diff options
author | Luka Perkov <luka.perkov@sartura.hr> | 2016-06-23 13:57:21 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2016-06-23 13:57:21 +0200 |
commit | 282b917e47d9ae5017e1e426face9b75cb7aabd0 (patch) | |
tree | 3284ca2d20d9c8d7a4563c6446675c1ecf3feac2 /target/linux/brcm2708/patches-4.4/0210-vchiq_arm-Access-the-dequeue_pending-flag-locked.patch | |
parent | 34d432b05312de6d9575c559db8209809489096d (diff) | |
parent | 441a9c879ba6562ea9f431cf33bbb0c0400d5fd0 (diff) | |
download | master-187ad058-282b917e47d9ae5017e1e426face9b75cb7aabd0.tar.gz master-187ad058-282b917e47d9ae5017e1e426face9b75cb7aabd0.tar.bz2 master-187ad058-282b917e47d9ae5017e1e426face9b75cb7aabd0.zip |
Merge pull request #11 from wigyori/master
pull req for 4.4.12, ar71xx/mediatek updates, package upgrades
Diffstat (limited to 'target/linux/brcm2708/patches-4.4/0210-vchiq_arm-Access-the-dequeue_pending-flag-locked.patch')
-rw-r--r-- | target/linux/brcm2708/patches-4.4/0210-vchiq_arm-Access-the-dequeue_pending-flag-locked.patch | 58 |
1 files changed, 58 insertions, 0 deletions
diff --git a/target/linux/brcm2708/patches-4.4/0210-vchiq_arm-Access-the-dequeue_pending-flag-locked.patch b/target/linux/brcm2708/patches-4.4/0210-vchiq_arm-Access-the-dequeue_pending-flag-locked.patch new file mode 100644 index 0000000000..29f09a6ca4 --- /dev/null +++ b/target/linux/brcm2708/patches-4.4/0210-vchiq_arm-Access-the-dequeue_pending-flag-locked.patch @@ -0,0 +1,58 @@ +From 1111ae49a509d672b43194d2e483f297f98d78ad Mon Sep 17 00:00:00 2001 +From: Phil Elwell <phil@raspberrypi.org> +Date: Wed, 23 Mar 2016 14:16:25 +0000 +Subject: [PATCH 210/381] vchiq_arm: Access the dequeue_pending flag locked + +Reading through this code looking for another problem (now found in userland) +the use of dequeue_pending outside a lock didn't seem safe. + +Signed-off-by: Phil Elwell <phil@raspberrypi.org> +--- + .../misc/vc04_services/interface/vchiq_arm/vchiq_arm.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_arm.c ++++ b/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_arm.c +@@ -279,6 +279,7 @@ service_callback(VCHIQ_REASON_T reason, + USER_SERVICE_T *user_service; + VCHIQ_SERVICE_T *service; + VCHIQ_INSTANCE_T instance; ++ int skip_completion = 0; + DEBUG_INITIALISE(g_state.local) + + DEBUG_TRACE(SERVICE_CALLBACK_LINE); +@@ -345,9 +346,6 @@ service_callback(VCHIQ_REASON_T reason, + user_service->msg_queue[user_service->msg_insert & + (MSG_QUEUE_SIZE - 1)] = header; + user_service->msg_insert++; +- spin_unlock(&msg_queue_spinlock); +- +- up(&user_service->insert_event); + + /* If there is a thread waiting in DEQUEUE_MESSAGE, or if + ** there is a MESSAGE_AVAILABLE in the completion queue then +@@ -356,13 +354,22 @@ service_callback(VCHIQ_REASON_T reason, + if (((user_service->message_available_pos - + instance->completion_remove) >= 0) || + user_service->dequeue_pending) { +- DEBUG_TRACE(SERVICE_CALLBACK_LINE); + user_service->dequeue_pending = 0; +- return VCHIQ_SUCCESS; ++ skip_completion = 1; + } + ++ spin_unlock(&msg_queue_spinlock); ++ ++ up(&user_service->insert_event); ++ + header = NULL; + } ++ ++ if (skip_completion) { ++ DEBUG_TRACE(SERVICE_CALLBACK_LINE); ++ return VCHIQ_SUCCESS; ++ } ++ + DEBUG_TRACE(SERVICE_CALLBACK_LINE); + + return add_completion(instance, reason, header, user_service, |