diff options
| author | Stefan Wahren <stefan.wahren@i2se.com> | 2021-04-25 12:50:53 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-05-10 11:19:27 +0200 |
| commit | bdf2b26de6124a175d03092e89610f15ebc6a733 (patch) | |
| tree | a495b82101253fe07f9766a971ce974cad37a546 /drivers/staging | |
| parent | ad843f3920354871bb26a92a8511426a662c7526 (diff) | |
| download | linux-bdf2b26de6124a175d03092e89610f15ebc6a733.tar.bz2 | |
staging: vchiq_arm: avoid crashing the kernel
Using BUG_ON in a non-essential driver isn't recommend. So better
trigger a stacktrace and bailout.
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Link: https://lore.kernel.org/r/1619347863-16080-2-git-send-email-stefan.wahren@i2se.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c index e39897c38e6a..367fa3d371eb 100644 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c @@ -602,7 +602,9 @@ service_callback(enum vchiq_reason reason, struct vchiq_header *header, DEBUG_TRACE(SERVICE_CALLBACK_LINE); service = handle_to_service(handle); - BUG_ON(!service); + if (WARN_ON(!service)) + return VCHIQ_SUCCESS; + user_service = (struct user_service *)service->base.userdata; instance = user_service->instance; @@ -918,8 +920,12 @@ static int vchiq_ioc_dequeue_message(struct vchiq_instance *instance, goto out; } - BUG_ON((int)(user_service->msg_insert - - user_service->msg_remove) < 0); + if (WARN_ON_ONCE((int)(user_service->msg_insert - + user_service->msg_remove) < 0)) { + spin_unlock(&msg_queue_spinlock); + ret = -EINVAL; + goto out; + } header = user_service->msg_queue[user_service->msg_remove & (MSG_QUEUE_SIZE - 1)]; @@ -1937,7 +1943,10 @@ static int vchiq_release(struct inode *inode, struct file *file) wait_for_completion(&service->remove_event); - BUG_ON(service->srvstate != VCHIQ_SRVSTATE_FREE); + if (WARN_ON(service->srvstate != VCHIQ_SRVSTATE_FREE)) { + unlock_service(service); + break; + } spin_lock(&msg_queue_spinlock); |