diff options
author | Zhizhou Zhang <zhizhouzhang@asrmicro.com> | 2018-11-21 11:01:43 +0800 |
---|---|---|
committer | Jens Wiklander <jens.wiklander@linaro.org> | 2018-12-11 14:38:21 +0100 |
commit | b2d102bd0146d9eb1fa630ca0cd19a15ef2f74c8 (patch) | |
tree | b72e8dbe029487643c5150e5360c04ebebeb4446 /scripts/dtc | |
parent | 40e020c129cfc991e8ab4736d2665351ffd1468d (diff) |
tee: optee: avoid possible double list_del()
This bug occurs when:
- a new request arrives, one thread(let's call it A) is pending in
optee_supp_req() with req->busy is initial value false.
- tee-supplicant is killed, then optee_supp_release() is called, this
function calls list_del(&req->link), and set supp->ctx to NULL. And
it also wake up process A.
- process A continues, it firstly checks supp->ctx which is NULL,
then checks req->busy which is false, at last run list_del(&req->link).
This triggers double list_del() and results kernel panic.
For solve this problem, we rename req->busy to req->in_queue, and
associate it with state of whether req is linked to supp->reqs. So we
can just only check req->in_queue to make decision calling list_del()
or not.
Signed-off-by: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Diffstat (limited to 'scripts/dtc')
0 files changed, 0 insertions, 0 deletions