summaryrefslogtreecommitdiffstats
path: root/drivers/firmware
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2017-05-05 08:37:23 +0300
committerThierry Reding <treding@nvidia.com>2017-06-14 17:17:32 +0200
commitcd307124ad9bb01019920c2053696218d161f4a1 (patch)
treebc8a092a7fcb19ec75b79f4405ef53d62855a3cc /drivers/firmware
parent2ea659a9ef488125eb46da6eb571de5eae5c43f6 (diff)
downloadlinux-cd307124ad9bb01019920c2053696218d161f4a1.tar.bz2
firmware: tegra: Fix locking bugs in BPMP
There are a bunch of error paths were we don't unlock the bpmp->threaded lock. Also if __tegra_bpmp_channel_write() fails then we returned success instead of an error code. Fixes: 983de5f97169 ("firmware: tegra: Add BPMP support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
Diffstat (limited to 'drivers/firmware')
-rw-r--r--drivers/firmware/tegra/bpmp.c28
1 files changed, 18 insertions, 10 deletions
diff --git a/drivers/firmware/tegra/bpmp.c b/drivers/firmware/tegra/bpmp.c
index 84e4c9a58a0c..fd18f03b3201 100644
--- a/drivers/firmware/tegra/bpmp.c
+++ b/drivers/firmware/tegra/bpmp.c
@@ -211,14 +211,17 @@ static ssize_t tegra_bpmp_channel_read(struct tegra_bpmp_channel *channel,
int index;
index = tegra_bpmp_channel_get_thread_index(channel);
- if (index < 0)
- return index;
+ if (index < 0) {
+ err = index;
+ goto unlock;
+ }
spin_lock_irqsave(&bpmp->lock, flags);
err = __tegra_bpmp_channel_read(channel, data, size);
clear_bit(index, bpmp->threaded.allocated);
spin_unlock_irqrestore(&bpmp->lock, flags);
+unlock:
up(&bpmp->threaded.lock);
return err;
@@ -256,18 +259,18 @@ tegra_bpmp_write_threaded(struct tegra_bpmp *bpmp, unsigned int mrq,
index = find_first_zero_bit(bpmp->threaded.allocated, count);
if (index == count) {
- channel = ERR_PTR(-EBUSY);
+ err = -EBUSY;
goto unlock;
}
channel = tegra_bpmp_channel_get_thread(bpmp, index);
if (!channel) {
- channel = ERR_PTR(-EINVAL);
+ err = -EINVAL;
goto unlock;
}
if (!tegra_bpmp_master_free(channel)) {
- channel = ERR_PTR(-EBUSY);
+ err = -EBUSY;
goto unlock;
}
@@ -275,16 +278,21 @@ tegra_bpmp_write_threaded(struct tegra_bpmp *bpmp, unsigned int mrq,
err = __tegra_bpmp_channel_write(channel, mrq, MSG_ACK | MSG_RING,
data, size);
- if (err < 0) {
- clear_bit(index, bpmp->threaded.allocated);
- goto unlock;
- }
+ if (err < 0)
+ goto clear_allocated;
set_bit(index, bpmp->threaded.busy);
-unlock:
spin_unlock_irqrestore(&bpmp->lock, flags);
return channel;
+
+clear_allocated:
+ clear_bit(index, bpmp->threaded.allocated);
+unlock:
+ spin_unlock_irqrestore(&bpmp->lock, flags);
+ up(&bpmp->threaded.lock);
+
+ return ERR_PTR(err);
}
static ssize_t tegra_bpmp_channel_write(struct tegra_bpmp_channel *channel,