firmware loader: fix pending_fw_head list corruption

[firefly-linux-kernel-4.4.55.git] / drivers / base / firmware_class.c

diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 4b1f9265887f1048ff5a64cc14fa3d04964b519b..d7872b96019d22db197554bfa9ae2102a96f1ba4 100644 (file)
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -27,6 +27,7 @@
 #include <linux/pm.h>
 #include <linux/suspend.h>
 #include <linux/syscore_ops.h>
+#include <linux/reboot.h>
 
 #include <generated/utsrelease.h>
 
@@ -130,6 +131,7 @@ struct firmware_buf {
        struct page **pages;
        int nr_pages;
        int page_array_size;
+       struct list_head pending_list;
 #endif
        char fw_id[];
 };
@@ -171,6 +173,9 @@ static struct firmware_buf *__allocate_fw_buf(const char *fw_name,
        strcpy(buf->fw_id, fw_name);
        buf->fwc = fwc;
        init_completion(&buf->completion);
+#ifdef CONFIG_FW_LOADER_USER_HELPER
+       INIT_LIST_HEAD(&buf->pending_list);
+#endif
 
        pr_debug("%s: fw-%s buf=%p\n", __func__, fw_name, buf);
 
@@ -446,17 +451,52 @@ static struct firmware_priv *to_firmware_priv(struct device *dev)
        return container_of(dev, struct firmware_priv, dev);
 }
 
-static void fw_load_abort(struct firmware_priv *fw_priv)
+static void __fw_load_abort(struct firmware_buf *buf)
 {
-       struct firmware_buf *buf = fw_priv->buf;
+       /*
+        * There is a small window in which user can write to 'loading'
+        * between loading done and disappearance of 'loading'
+        */
+       if (test_bit(FW_STATUS_DONE, &buf->status))
+               return;
 
+       list_del_init(&buf->pending_list);
        set_bit(FW_STATUS_ABORT, &buf->status);
        complete_all(&buf->completion);
 }
 
+static void fw_load_abort(struct firmware_priv *fw_priv)
+{
+       struct firmware_buf *buf = fw_priv->buf;
+
+       __fw_load_abort(buf);
+
+       /* avoid user action after loading abort */
+       fw_priv->buf = NULL;
+}
+
 #define is_fw_load_aborted(buf)        \
        test_bit(FW_STATUS_ABORT, &(buf)->status)
 
+static LIST_HEAD(pending_fw_head);
+
+/* reboot notifier for avoid deadlock with usermode_lock */
+static int fw_shutdown_notify(struct notifier_block *unused1,
+                             unsigned long unused2, void *unused3)
+{
+       mutex_lock(&fw_lock);
+       while (!list_empty(&pending_fw_head))
+               __fw_load_abort(list_first_entry(&pending_fw_head,
+                                              struct firmware_buf,
+                                              pending_list));
+       mutex_unlock(&fw_lock);
+       return NOTIFY_DONE;
+}
+
+static struct notifier_block fw_shutdown_nb = {
+       .notifier_call = fw_shutdown_notify,
+};
+
 static ssize_t firmware_timeout_show(struct class *class,
                                     struct class_attribute *attr,
                                     char *buf)
@@ -528,7 +568,12 @@ static ssize_t firmware_loading_show(struct device *dev,
                                     struct device_attribute *attr, char *buf)
 {
        struct firmware_priv *fw_priv = to_firmware_priv(dev);
-       int loading = test_bit(FW_STATUS_LOADING, &fw_priv->buf->status);
+       int loading = 0;
+
+       mutex_lock(&fw_lock);
+       if (fw_priv->buf)
+               loading = test_bit(FW_STATUS_LOADING, &fw_priv->buf->status);
+       mutex_unlock(&fw_lock);
 
        return sprintf(buf, "%d\n", loading);
 }
@@ -570,12 +615,12 @@ static ssize_t firmware_loading_store(struct device *dev,
                                      const char *buf, size_t count)
 {
        struct firmware_priv *fw_priv = to_firmware_priv(dev);
-       struct firmware_buf *fw_buf = fw_priv->buf;
+       struct firmware_buf *fw_buf;
        int loading = simple_strtol(buf, NULL, 10);
        int i;
 
        mutex_lock(&fw_lock);
-
+       fw_buf = fw_priv->buf;
        if (!fw_buf)
                goto out;
 
@@ -604,6 +649,7 @@ static ssize_t firmware_loading_store(struct device *dev,
                         * is completed.
                         * */
                        fw_map_pages_buf(fw_buf);
+                       list_del_init(&fw_buf->pending_list);
                        complete_all(&fw_buf->completion);
                        break;
                }
@@ -777,10 +823,6 @@ static void firmware_class_timeout_work(struct work_struct *work)
                        struct firmware_priv, timeout_work.work);
 
        mutex_lock(&fw_lock);
-       if (test_bit(FW_STATUS_DONE, &(fw_priv->buf->status))) {
-               mutex_unlock(&fw_lock);
-               return;
-       }
        fw_load_abort(fw_priv);
        mutex_unlock(&fw_lock);
 }
@@ -842,8 +884,15 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
                goto err_del_dev;
        }
 
+       mutex_lock(&fw_lock);
+       list_add(&buf->pending_list, &pending_fw_head);
+       mutex_unlock(&fw_lock);
+
        retval = device_create_file(f_dev, &dev_attr_loading);
        if (retval) {
+               mutex_lock(&fw_lock);
+               list_del_init(&buf->pending_list);
+               mutex_unlock(&fw_lock);
                dev_err(f_dev, "%s: device_create_file failed\n", __func__);
                goto err_del_bin_attr;
        }
@@ -861,8 +910,6 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
 
        cancel_delayed_work_sync(&fw_priv->timeout_work);
 
-       fw_priv->buf = NULL;
-
        device_remove_file(f_dev, &dev_attr_loading);
 err_del_bin_attr:
        device_remove_bin_file(f_dev, &firmware_attr_data);
@@ -1517,6 +1564,7 @@ static int __init firmware_class_init(void)
 {
        fw_cache_init();
 #ifdef CONFIG_FW_LOADER_USER_HELPER
+       register_reboot_notifier(&fw_shutdown_nb);
        return class_register(&firmware_class);
 #else
        return 0;
@@ -1530,6 +1578,7 @@ static void __exit firmware_class_exit(void)
        unregister_pm_notifier(&fw_cache.pm_notify);
 #endif
 #ifdef CONFIG_FW_LOADER_USER_HELPER
+       unregister_reboot_notifier(&fw_shutdown_nb);
        class_unregister(&firmware_class);
 #endif
 }