summaryrefslogtreecommitdiffstats
path: root/include/linux/rpmsg.h
diff options
context:
space:
mode:
authorOhad Ben-Cohen <ohad@wizery.com>2012-06-07 15:39:35 +0300
committerOhad Ben-Cohen <ohad@wizery.com>2012-07-04 11:51:59 +0300
commit15fd943af50dbc5f7f4de33835795c72595f7bf4 (patch)
treeb35e37da3edf0b0166f14cf1d71e665d506b7fdf /include/linux/rpmsg.h
parent5a081caa0414b9bbb82c17ffab9d6fe66edbb72f (diff)
downloadlinux-stable-15fd943af50dbc5f7f4de33835795c72595f7bf4.tar.gz
linux-stable-15fd943af50dbc5f7f4de33835795c72595f7bf4.tar.bz2
linux-stable-15fd943af50dbc5f7f4de33835795c72595f7bf4.zip
rpmsg: make sure inflight messages don't invoke just-removed callbacks
When inbound messages arrive, rpmsg core looks up their associated endpoint (by destination address) and then invokes their callback. We've made sure that endpoints will never be de-allocated after they were found by rpmsg core, but we also need to protect against the (rare) scenario where the rpmsg driver was just removed, and its callback function isn't available anymore. This is achieved by introducing a callback mutex, which must be taken before the callback is invoked, and, obviously, before it is removed. Cc: stable <stable@vger.kernel.org> Reported-by: Fernando Guzman Lugo <fernando.lugo@ti.com> Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Diffstat (limited to 'include/linux/rpmsg.h')
-rw-r--r--include/linux/rpmsg.h3
1 files changed, 3 insertions, 0 deletions
diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
index 195f373590b8..82a673905edb 100644
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -39,6 +39,7 @@
#include <linux/device.h>
#include <linux/mod_devicetable.h>
#include <linux/kref.h>
+#include <linux/mutex.h>
/* The feature bitmap for virtio rpmsg */
#define VIRTIO_RPMSG_F_NS 0 /* RP supports name service notifications */
@@ -123,6 +124,7 @@ typedef void (*rpmsg_rx_cb_t)(struct rpmsg_channel *, void *, int, void *, u32);
* @rpdev: rpmsg channel device
* @refcount: when this drops to zero, the ept is deallocated
* @cb: rx callback handler
+ * @cb_lock: must be taken before accessing/changing @cb
* @addr: local rpmsg address
* @priv: private data for the driver's use
*
@@ -144,6 +146,7 @@ struct rpmsg_endpoint {
struct rpmsg_channel *rpdev;
struct kref refcount;
rpmsg_rx_cb_t cb;
+ struct mutex cb_lock;
u32 addr;
void *priv;
};