[RAMEN9610-12171] android: ion: do not free secure addr on smc error

ion_secure_unprotect() first calls smc to release any protection to
the given buffer and frees secure address for H/Ws that needs to access
that buffer. However, if releasing protection fails, the given buffer
may not be usable in Linux forever because the buffer might be
protected by H/W.

Change-Id: I91fb007e3df9330240d8900b5dc2da88e9564f8b
Signed-off-by: Cho KyongHo <pullip.cho@samsung.com>

diff --git a/drivers/staging/android/ion/ion_buffer_protect.c b/drivers/staging/android/ion/ion_buffer_protect.c
index 5a259bfae0ee3e5dd150b5e463a6300e60b8f364..1a5c98c2539b1c6a3f55d6977013d5b76a627b25 100644 (file)
--- a/drivers/staging/android/ion/ion_buffer_protect.c
+++ b/drivers/staging/android/ion/ion_buffer_protect.c
@@ -156,14 +156,18 @@ static int ion_secure_unprotect(struct ion_buffer_prot_info *protdesc)
         */
        ret = exynos_smc(SMC_DRM_PPMP_UNPROT, virt_to_phys(protdesc), 0, 0);
 
-       ion_secure_iova_free(protdesc->dma_addr, size);
-
        if (ret != DRMDRV_OK) {
                perrfn("UNPROT:%d(err=%d,va=%#x,len=%#lx,cnt=%u,flg=%u)",
                       SMC_DRM_PPMP_UNPROT, ret, protdesc->dma_addr,
                       size, protdesc->chunk_count, protdesc->flags);
                return -EACCES;
        }
+       /*
+        * retain the secure device address if unprotection to its area fails.
+        * It might be unusable forever since we do not know the state o ft he
+        * secure world before returning error from exynos_smc() above.
+        */
+       ion_secure_iova_free(protdesc->dma_addr, size);
 
        return 0;
 }