diff mbox series

[3/3] qmi: Allow QRTR services to be destroyed

Message ID 20240311232036.49381-3-steve.schrock@getcruise.com (mailing list archive)
State Superseded
Headers show
Series [1/3] qmi: Discover timeout could cause a crash | expand

Commit Message

Steve Schrock March 11, 2024, 11:20 p.m. UTC
QRTR services were never being destroyed because they were being
created with a reference count of 1 and immediately incrementing the
count to 2.
---
 drivers/qmimodem/qmi.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)
diff mbox series

Patch

diff --git a/drivers/qmimodem/qmi.c b/drivers/qmimodem/qmi.c
index 15324e6a..b3f05ada 100644
--- a/drivers/qmimodem/qmi.c
+++ b/drivers/qmimodem/qmi.c
@@ -2573,6 +2573,15 @@  bool qmi_service_create_shared(struct qmi_device *device, uint16_t type,
 	if (!device->ops->client_create) {
 		struct service_create_shared_data *data;
 
+		data = l_new(struct service_create_shared_data, 1);
+
+		data->super.destroy = service_create_shared_data_free;
+		data->super.type = DISCOVERY_TYPE_SERVICE_CREATE_SHARED;
+		data->device = device;
+		data->func = func;
+		data->user_data = user_data;
+		data->destroy = destroy;
+
 		/*
 		 * The hash id is simply the service type in this case. There
 		 * is no "pending" state for discovery and no client id.
@@ -2589,18 +2598,11 @@  bool qmi_service_create_shared(struct qmi_device *device, uint16_t type,
 			service = service_create(device, info, 0);
 			l_hashmap_insert(device->service_list,
 					L_UINT_TO_PTR(type_val), service);
-		}
 
-		data = l_new(struct service_create_shared_data, 1);
-
-		data->super.destroy = service_create_shared_data_free;
-		data->super.type = DISCOVERY_TYPE_SERVICE_CREATE_SHARED;
-		data->device = device;
-		data->func = func;
-		data->user_data = user_data;
-		data->destroy = destroy;
+			data->service = service; /* ref_count starts at 1 */
+		} else
+			data->service = qmi_service_ref(service);
 
-		data->service = qmi_service_ref(service);
 		data->idle = l_idle_create(service_create_shared_reply,
 							data, NULL);