OSDN Git Service

soc: qcom: service-notifier: fix object corruption
authorSatya Durga Srinivasu Prabhala <satyap@codeaurora.org>
Mon, 16 Jan 2017 18:37:08 +0000 (10:37 -0800)
committerSatya Durga Srinivasu Prabhala <satyap@codeaurora.org>
Mon, 16 Jan 2017 18:37:08 +0000 (10:37 -0800)
commit06a774048fd602e73279af771040608f32e0bdab
tree2631a48535df4909010acf222ff9f138ce23b3c4
parent2dc96b1cbbdcf5aef3780696708012d55fec57f2
soc: qcom: service-notifier: fix object corruption

Below object corruption observed from service-notifier while executing
WLAN PDR tests. While executing WLAN PDR tests, Modem crashed, which
resulted into use after free condition. Add mutex lock to fix the issue.

   ===============================================
   BUG kmalloc-1024 (Tainted: G        W  O   ): \
                              Poison overwritten
   -----------------------------------------------

   INFO: 0xffffffc0ba5c4d30-0xffffffc0ba5c4d3a. \
                   First byte 0xff instead of 0x6b
   INFO: Allocated in qmi_handle_create+0x4c/0x320 \
                      age=80203 cpu=0 pid=27134
        alloc_debug_processing+0x124/0x178
        ___slab_alloc.constprop.62+0x4ec/0x5d0
        __slab_alloc.isra.59.constprop.61+0x48/0x74
        kmem_cache_alloc_trace+0xd4/0x25c
        qmi_handle_create+0x4c/0x320
        root_service_service_arrive+0x3c/0x1e8
        process_one_work+0x234/0x40c
        worker_thread+0x2e0/0x410
        kthread+0xf4/0xfc
        ret_from_fork+0x10/0x40
   INFO: Freed in qmi_handle_destroy+0x154/0x16c \
                              age=50 cpu=1 pid=22765
        free_debug_processing+0x27c/0x354
        __slab_free+0x74/0x3ac
        kfree+0x21c/0x290
        qmi_handle_destroy+0x154/0x16c
        root_service_service_exit+0xf0/0x110
        ssr_event_notify+0x74/0x84
        notifier_call_chain+0x58/0x8c
        __srcu_notifier_call_chain+0x9c/0xc0
        srcu_notifier_call_chain+0x38/0x44
        subsys_notif_queue_notification+0x40/0x54
        notify_each_subsys_device.isra.9+0x18c/0x1b0
        subsystem_restart_wq_func+0x2f4/0x5a8
        process_one_work+0x234/0x40c
        worker_thread+0x2e0/0x410
        kthread+0xf4/0xfc
        ret_from_fork+0x10/0x40

Change-Id: Iebc0871220547c2d6f026db1dffafe30b854b199
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
drivers/soc/qcom/service-notifier.c