Fix concurrent access to IDR in kernel driver
The IDR instance must be protected against concurrent access and the
device mutex in the kernel driver should be used to protect it. However,
the device mutex is not locked when an inference is released or when the
mailbox is cleared which means the IDR is not protected in these
instances.
To resolve this, the missing mutex locks have been added and the
functions using the IDR instance have been updated to make it clearer
that the device mutex is expected to be locked when called.
Change-Id: Id0b314db556836c36663d6481806b7c113e55e5f
Signed-off-by: Mikael Olsson <mikael.olsson@arm.com>
diff --git a/kernel/ethosu_mailbox.c b/kernel/ethosu_mailbox.c
index 3e7284b..5b105d8 100644
--- a/kernel/ethosu_mailbox.c
+++ b/kernel/ethosu_mailbox.c
@@ -31,6 +31,7 @@
#include <linux/jiffies.h>
#include <linux/resource.h>
#include <linux/uio.h>
+#include <linux/bug.h>
/****************************************************************************
* Includes
@@ -65,6 +66,7 @@
int ethosu_mailbox_register(struct ethosu_mailbox *mbox,
struct ethosu_mailbox_msg *msg)
{
+ WARN_ON_ONCE(!mutex_is_locked(&mbox->dev->mutex));
msg->id = idr_alloc_cyclic(&mbox->msg_idr, msg, 0, INT_MAX, GFP_KERNEL);
if (msg->id < 0)
return msg->id;
@@ -75,6 +77,7 @@
void ethosu_mailbox_deregister(struct ethosu_mailbox *mbox,
struct ethosu_mailbox_msg *msg)
{
+ WARN_ON_ONCE(!mutex_is_locked(&mbox->dev->mutex));
idr_remove(&mbox->msg_idr, msg->id);
}
@@ -82,8 +85,10 @@
int msg_id,
uint32_t msg_type)
{
- struct ethosu_mailbox_msg *ptr = (struct ethosu_mailbox_msg *)idr_find(
- &mbox->msg_idr, msg_id);
+ struct ethosu_mailbox_msg *ptr;
+
+ WARN_ON_ONCE(!mutex_is_locked(&mbox->dev->mutex));
+ ptr = (struct ethosu_mailbox_msg *)idr_find(&mbox->msg_idr, msg_id);
if (ptr == NULL)
return ERR_PTR(-ENOENT);
@@ -99,6 +104,7 @@
struct ethosu_mailbox_msg *cur;
int id;
+ WARN_ON_ONCE(!mutex_is_locked(&mbox->dev->mutex));
idr_for_each_entry(&mbox->msg_idr, cur, id) {
cur->fail(cur);
}