LWIS: fix race conditionandroid-u-qpr2-beta-3_r0.7android-u-qpr2-beta-3_r0.6android-u-qpr2-beta-3_r0.5android-u-qpr2-beta-3_r0.4android-u-qpr2-beta-3_r0.3android-u-qpr2-beta-3_r0.2android-u-qpr2-beta-3.1_r0.7android-u-qpr2-beta-3.1_r0.5android-u-qpr2-beta-3.1_r0.4android-u-qpr2-beta-3.1_r0.3android-u-qpr2-beta-3.1_r0.2android-u-qpr2-beta-3.1_r0.1android-14.0.0_r0.76android-14.0.0_r0.75android-14.0.0_r0.74android-14.0.0_r0.73android-14.0.0_r0.72android-14.0.0_r0.71android-14.0.0_r0.66android-14.0.0_r0.65android-14.0.0_r0.64android-14.0.0_r0.63android-14.0.0_r0.62android-14.0.0_r0.61android-14.0.0_r0.56android-14.0.0_r0.55android-14.0.0_r0.54android-14.0.0_r0.53android-14.0.0_r0.52android-14.0.0_r0.51android-gs-tangorpro-5.10-android14-qpr2-betaandroid-gs-tangorpro-5.10-android14-qpr2android-gs-raviole-5.10-android14-qpr2-betaandroid-gs-raviole-5.10-android14-qpr2android-gs-pantah-5.10-android14-qpr2-betaandroid-gs-pantah-5.10-android14-qpr2android-gs-lynx-5.10-android14-qpr2-betaandroid-gs-lynx-5.10-android14-qpr2android-gs-felix-5.10-android14-qpr2-betaandroid-gs-felix-5.10-android14-qpr2android-gs-bluejay-5.10-android14-qpr2-betaandroid-gs-bluejay-5.10-android14-qpr2

To prevent ramdumps caused by accessing invalid DMA address,
we have made sure that the dma addr is valid and add a lock to
avoid race condition when multiple clients access the DMA address.

Bug: 315986225
Test: CTS, GCA, Force to ramdump to check it.
Change-Id: Iba1b9850f0aefa8025fe51504a1b39374ec385ae
Signed-off-by: Nick Chung <nickchung@google.com>
(cherry picked from commit ccfcf1ed071f43c12a61e8c096a61353d45ace22)

3 files changed, 12 insertions, 2 deletions

diff --git a/lwis_debug.c b/lwis_debug.c
index f3f9501..59d83de 100644
--- a/lwis_debug.c
+++ b/lwis_debug.c
@@ -160,6 +160,13 @@ static void list_enrolled_buffers(struct lwis_client *client, char *k_buf, size_
 	hash_for_each (client->enrolled_buffers, i, enrollment_list, node) {
 		list_for_each (it_enrollment, &enrollment_list->list) {
 			buffer = list_entry(it_enrollment, struct lwis_enrolled_buffer, list_node);
+			if (IS_ERR_VALUE(buffer->info.dma_vaddr)) {
+				scnprintf(tmp_buf, sizeof(tmp_buf),
+					  "Enrolled buffers: dma_vaddr %pad is invalid\n",
+					  &buffer->info.dma_vaddr);
+				strlcat(k_buf, tmp_buf, k_buf_size);
+				continue;
+			}
 			end_dma_vaddr = buffer->info.dma_vaddr + (buffer->dma_buf->size - 1);
 			scnprintf(tmp_buf, sizeof(tmp_buf),
 				  "[%2d] FD: %d Mode: %s%s Addr:[%pad ~ %pad] Size: %zu\n", idx++,
@@ -296,15 +303,15 @@ static int generate_buffer_info(struct lwis_device *lwis_dev, char *buffer, size
 		return 0;
 	}
 
-	spin_lock_irqsave(&lwis_dev->lock, flags);
 	list_for_each_entry (client, &lwis_dev->clients, node) {
 		scnprintf(tmp_buf, sizeof(tmp_buf), "Client %d:\n", idx);
 		strlcat(buffer, tmp_buf, buffer_size);
+		spin_lock_irqsave(&client->buffer_lock, flags);
 		list_allocated_buffers(client, buffer, buffer_size);
 		list_enrolled_buffers(client, buffer, buffer_size);
+		spin_unlock_irqrestore(&client->buffer_lock, flags);
 		idx++;
 	}
-	spin_unlock_irqrestore(&lwis_dev->lock, flags);
 
 	return 0;
 }
diff --git a/lwis_device.c b/lwis_device.c
index 6017095..309584d 100644
--- a/lwis_device.c
+++ b/lwis_device.c
@@ -123,6 +123,7 @@ static int lwis_open(struct inode *node, struct file *fp)
 	spin_lock_init(&lwis_client->periodic_io_lock);
 	spin_lock_init(&lwis_client->event_lock);
 	spin_lock_init(&lwis_client->flush_lock);
+	spin_lock_init(&lwis_client->buffer_lock);
 
 	/* Empty hash table for client event states */
 	hash_init(lwis_client->event_states);
diff --git a/lwis_device.h b/lwis_device.h
index 1313587..c70b98d 100644
--- a/lwis_device.h
+++ b/lwis_device.h
@@ -366,6 +366,8 @@ struct lwis_client {
 	enum lwis_client_flush_state flush_state;
 	/* Lock to guard client's flush state changes */
 	spinlock_t flush_lock;
+	/* Lock to guard client's buffer changes */
+	spinlock_t buffer_lock;
 };
 
 /*