rpmsg services: should release the tx buffer when rpmsg_send_nocopy failed

Otherwise, the tx buffer will be discarded and can no longer be obtained

Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>

drivers/clk/clk_rpmsg.c

@@ -497,6 +497,10 @@ static int64_t clk_rpmsg_sendrecv(FAR struct rpmsg_endpoint *ept,
           ret = cookie.result;
         }
     }
+  else
+    {
+      rpmsg_release_tx_buffer(ept, msg);
+    }
 
   nxsem_destroy(&cookie.sem);
   return ret;

drivers/misc/rpmsgblk.c

@@ -395,6 +395,7 @@ static ssize_t rpmsgblk_write(FAR struct inode *inode,
                               sizeof(*msg) - 1 + msg->nsectors * sectorsize);
       if (ret < 0)
         {
+          rpmsg_release_tx_buffer(&priv->ept, msg);
           goto out;
         }
     }
@@ -859,6 +860,11 @@ static int rpmsgblk_send_recv(FAR struct rpmsgblk_s *priv,
 
   if (ret < 0)
     {
+      if (copy == false)
+        {
+          rpmsg_release_tx_buffer(&priv->ept, msg);
+        }
+
       goto fail;
     }
 

drivers/misc/rpmsgblk_server.c

@@ -224,8 +224,12 @@ static int rpmsgblk_read_handler(FAR struct rpmsg_endpoint *ept,
                                (FAR unsigned char *)rsp->buf,
                                msg->startsector, nsectors);
       rsp->header.result = ret;
-      rpmsg_send_nocopy(ept, rsp, (ret < 0 ? 0 : ret * msg->sectorsize) +
-                        sizeof(*rsp) - 1);
+      if (rpmsg_send_nocopy(ept, rsp, (ret < 0 ? 0 : ret * msg->sectorsize) +
+                                      sizeof(*rsp) - 1) < 0)
+        {
+          rpmsg_release_tx_buffer(ept, rsp);
+        }
+
       if (ret <= 0)
         {
           ferr("mtd block read failed\n");
@@ -327,6 +331,7 @@ static int rpmsgblk_mmc_cmd_handler(FAR struct rpmsg_endpoint *ept,
   size_t rsplen;
   size_t arglen;
   uint32_t space;
+  int ret;
 
   arglen = sizeof(struct mmc_ioc_cmd);
   if (!ioc->write_flag)
@@ -358,8 +363,13 @@ static int rpmsgblk_mmc_cmd_handler(FAR struct rpmsg_endpoint *ept,
 
   rsp->header.result = server->bops->ioctl(server->blknode, rsp->request,
                                            (unsigned long)rsp->buf);
+  ret = rpmsg_send_nocopy(ept, rsp, rsplen);
+  if (ret < 0)
+    {
+      rpmsg_release_tx_buffer(ept, rsp);
+    }
 
-  return rpmsg_send_nocopy(ept, rsp, rsplen);
+  return ret;
 }
 
 /****************************************************************************
@@ -380,6 +390,7 @@ static int rpmsgblk_mmc_multi_cmd_handler(FAR struct rpmsg_endpoint *ept,
   size_t rsp_off;
   uint32_t space;
   uint64_t i;
+  int ret;
 
   arglen = sizeof(struct mmc_ioc_multi_cmd) +
            mioc->num_of_cmds * sizeof(struct mmc_ioc_cmd);
@@ -427,8 +438,13 @@ static int rpmsgblk_mmc_multi_cmd_handler(FAR struct rpmsg_endpoint *ept,
 
   rsp->header.result = server->bops->ioctl(server->blknode, rsp->request,
                                            (unsigned long)rsp->buf);
+  ret = rpmsg_send_nocopy(ept, rsp, rsplen);
+  if (ret < 0)
+    {
+      rpmsg_release_tx_buffer(ept, rsp);
+    }
 
-  return rpmsg_send_nocopy(ept, rsp, rsplen);
+  return ret;
 }
 
 /****************************************************************************

drivers/mtd/rpmsgmtd_server.c

@@ -166,8 +166,9 @@ static int rpmsgmtd_bread_handler(FAR struct rpmsg_endpoint *ept,
       rsp->header.result = ret;
       rpmsg_send_nocopy(ept, rsp, (ret < 0 ? 0 : ret * msg->blocksize) +
                         sizeof(*rsp) - 1);
-      if (ret <= 0)
+      if (ret < 0)
         {
+          rpmsg_release_tx_buffer(ept, rsp);
           ferr("mtd block read failed\n");
           break;
         }
@@ -246,8 +247,9 @@ static int rpmsgmtd_read_handler(FAR struct rpmsg_endpoint *ept,
 
       rsp->header.result = ret;
       rpmsg_send_nocopy(ept, rsp, (ret < 0 ? 0 : ret) + sizeof(*rsp) - 1);
-      if (ret <= 0)
+      if (ret < 0)
         {
+          rpmsg_release_tx_buffer(ept, rsp);
           break;
         }
 

drivers/net/rpmsgdrv.c

@@ -214,6 +214,11 @@ static int net_rpmsg_drv_transmit(FAR struct net_driver_s *dev, bool nocopy)
 
   if (ret < 0)
     {
+      if (nocopy)
+        {
+          rpmsg_release_tx_buffer(&priv->ept, msg);
+        }
+
       NETDEV_TXERRORS(dev);
       return ret;
     }

drivers/note/noterpmsg_driver.c

@@ -151,7 +151,11 @@ static bool noterpmsg_transfer(FAR struct noterpmsg_driver_s *drv,
       memcpy(buffer, drv->buffer + drv->tail, space);
       memcpy(buffer + space, drv->buffer, len - space);
 
-      rpmsg_send_nocopy(&drv->ept, buffer, len);
+      if (rpmsg_send_nocopy(&drv->ept, buffer, len) < 0)
+        {
+          rpmsg_release_tx_buffer(&drv->ept, buffer);
+        }
+
       drv->tail = noterpmsg_next(drv, drv->tail, len);
     }
 }

drivers/power/supply/regulator_rpmsg.c

@@ -546,6 +546,10 @@ static int regulator_rpmsg_sendrecv(FAR struct rpmsg_endpoint *ept,
           ret = cookie.result;
         }
     }
+  else
+    {
+      rpmsg_release_tx_buffer(ept, msg);
+    }
 
   nxsem_destroy(&cookie.sem);
   return ret;

drivers/rpmsg/rpmsg_ping.c

@@ -168,6 +168,11 @@ static int rpmsg_ping_once(FAR struct rpmsg_endpoint *ept,
       ret = rpmsg_send_nocopy(ept, msg, len);
     }
 
+  if (ret < 0)
+    {
+      rpmsg_release_tx_buffer(ept, msg);
+    }
+
   return ret;
 }
 

drivers/sensors/sensor_rpmsg.c

@@ -328,6 +328,7 @@ static void sensor_rpmsg_advsub_one(FAR struct sensor_rpmsg_dev_s *dev,
   ret = rpmsg_send_nocopy(ept, msg, sizeof(*msg) + len);
   if (ret < 0)
     {
+      rpmsg_release_tx_buffer(ept, msg);
       snerr("ERROR: advsub:%d rpmsg send failed:%s, %d, %s\n",
             command, dev->path, ret, rpmsg_get_cpuname(ept->rdev));
     }
@@ -406,6 +407,7 @@ static int sensor_rpmsg_ioctl(FAR struct sensor_rpmsg_dev_s *dev,
       ret = rpmsg_send_nocopy(ept, msg, sizeof(*msg) + len);
       if (ret < 0)
         {
+          rpmsg_release_tx_buffer(ept, msg);
           snerr("ERROR: ioctl rpmsg send failed:%s, %d, %s\n",
                 dev->path, ret, rpmsg_get_cpuname(ept->rdev));
           break;
@@ -803,11 +805,19 @@ static int sensor_rpmsg_control(FAR struct sensor_lowerhalf_s *lower,
 static void sensor_rpmsg_data_worker(FAR void *arg)
 {
   FAR struct sensor_rpmsg_ept_s *sre = arg;
+  int ret;
 
   nxrmutex_lock(&sre->lock);
   if (sre->buffer)
     {
-      rpmsg_send_nocopy(&sre->ept, sre->buffer, sre->written);
+      ret = rpmsg_send_nocopy(&sre->ept, sre->buffer, sre->written);
+      if (ret < 0)
+        {
+          rpmsg_release_tx_buffer(&sre->ept, sre->buffer);
+          snerr("ERROR: push event rpmsg send failed:%d, %s\n",
+                ret, rpmsg_get_cpuname(sre->ept.rdev));
+        }
+
       sre->buffer = NULL;
     }
 
@@ -916,12 +926,14 @@ static void sensor_rpmsg_push_event_one(FAR struct sensor_rpmsg_dev_s *dev,
   if (sre->expire <= now && sre->buffer)
     {
       ret = rpmsg_send_nocopy(&sre->ept, sre->buffer, sre->written);
-      sre->buffer = NULL;
       if (ret < 0)
         {
+          rpmsg_release_tx_buffer(&sre->ept, sre->buffer);
           snerr("ERROR: push event rpmsg send failed:%d, %s\n",
                 ret, rpmsg_get_cpuname(sre->ept.rdev));
         }
+
+      sre->buffer = NULL;
     }
   else
     {

drivers/serial/uart_rpmsg.c

@@ -217,7 +217,10 @@ static void uart_rpmsg_dmasend(FAR struct uart_dev_s *dev)
   msg->header.result  = -ENXIO;
   msg->header.cookie  = (uintptr_t)dev;
 
-  rpmsg_send_nocopy(&priv->ept, msg, sizeof(*msg) + len);
+  if (rpmsg_send_nocopy(&priv->ept, msg, sizeof(*msg) + len) < 0)
+    {
+      rpmsg_release_tx_buffer(&priv->ept, msg);
+    }
 }
 
 static void uart_rpmsg_dmareceive(FAR struct uart_dev_s *dev)

drivers/syslog/syslog_rpmsg.c

@@ -168,7 +168,11 @@ static bool syslog_rpmsg_transfer(FAR struct syslog_rpmsg_s *priv, bool wait)
       msg->count          = len;
       priv->tail         += len;
       msg->header.command = SYSLOG_RPMSG_TRANSFER;
-      rpmsg_send_nocopy(&priv->ept, msg, sizeof(*msg) + len);
+      if (rpmsg_send_nocopy(&priv->ept, msg, sizeof(*msg) + len) < 0)
+        {
+          rpmsg_release_tx_buffer(&priv->ept, msg);
+        }
+
       len                 = SYSLOG_RPMSG_COUNT(priv);
 
       leave_critical_section(flags);

drivers/usrsock/usrsock_rpmsg.c

@@ -100,6 +100,10 @@ static int usrsock_rpmsg_send_dns_request(FAR void *arg,
   net_lock();
   ret = rpmsg_send_nocopy(ept, dns, sizeof(*dns) + addrlen);
   net_unlock();
+  if (ret < 0)
+    {
+      rpmsg_release_tx_buffer(ept, dns);
+    }
 
   return ret;
 }
@@ -225,6 +229,7 @@ int usrsock_request(FAR struct iovec *iov, unsigned int iovcnt)
       ret = rpmsg_send_nocopy(&priv->ept, buf, ret);
       if (ret < 0)
         {
+          rpmsg_release_tx_buffer(&priv->ept, buf);
           break;
         }
 

drivers/usrsock/usrsock_rpmsg_server.c

@@ -228,6 +228,8 @@ static int usrsock_rpmsg_send_data_ack(FAR struct rpmsg_endpoint *ept,
                               uint16_t valuelen_nontrunc,
                               int32_t datalen)
 {
+  int ret;
+
   ack->reqack.head.msgid  = USRSOCK_MESSAGE_RESPONSE_DATA_ACK;
   ack->reqack.head.flags  = 0;
   ack->reqack.head.events = events;
@@ -249,7 +251,13 @@ static int usrsock_rpmsg_send_data_ack(FAR struct rpmsg_endpoint *ept,
   ack->valuelen          = valuelen;
   ack->valuelen_nontrunc = valuelen_nontrunc;
 
-  return rpmsg_send_nocopy(ept, ack, sizeof(*ack) + valuelen + datalen);
+  ret = rpmsg_send_nocopy(ept, ack, sizeof(*ack) + valuelen + datalen);
+  if (ret < 0)
+    {
+      rpmsg_release_tx_buffer(ept, ack);
+    }
+
+  return ret;
 }
 
 static int usrsock_rpmsg_send_frag_ack(FAR struct rpmsg_endpoint *ept,
@@ -980,6 +988,7 @@ static int usrsock_rpmsg_send_dns_event(FAR void *arg,
   FAR struct rpmsg_endpoint *ept = arg;
   FAR struct usrsock_rpmsg_dns_event_s *dns;
   uint32_t len;
+  int ret;
 
   dns = rpmsg_get_tx_payload_buffer(ept, &len, true);
   if (dns == NULL)
@@ -993,7 +1002,13 @@ static int usrsock_rpmsg_send_dns_event(FAR void *arg,
   dns->addrlen = addrlen;
   memcpy(dns + 1, addr, addrlen);
 
-  return rpmsg_send_nocopy(ept, dns, sizeof(*dns) + addrlen);
+  ret = rpmsg_send_nocopy(ept, dns, sizeof(*dns) + addrlen);
+  if (ret < 0)
+    {
+      rpmsg_release_tx_buffer(ept, dns);
+    }
+
+  return ret;
 }
 #endif
 

drivers/wireless/bluetooth/bt_rpmsghci.c

@@ -130,6 +130,7 @@ static int rpmsghci_send(FAR struct rpmsghci_s *priv, uint32_t command,
   ret = rpmsg_send_nocopy(&priv->ept, msg, len);
   if (ret < 0)
     {
+      rpmsg_release_tx_buffer(&priv->ept, msg);
       goto errout;
     }
 

drivers/wireless/bluetooth/bt_rpmsghci_server.c

@@ -132,6 +132,7 @@ static int rpmsghci_send(FAR struct rpmsghci_server_s *priv,
   ret = rpmsg_send_nocopy(&priv->ept, msg, len);
   if (ret < 0)
     {
+      rpmsg_release_tx_buffer(&priv->ept, msg);
       goto errout;
     }
 

fs/rpmsgfs/rpmsgfs_client.c

@@ -373,6 +373,11 @@ static int rpmsgfs_send_recv(FAR struct rpmsgfs_s *priv,
 
   if (ret < 0)
     {
+      if (copy == false)
+        {
+          rpmsg_release_tx_buffer(&priv->ept, msg);
+        }
+
       goto fail;
     }
 
@@ -550,6 +555,7 @@ ssize_t rpmsgfs_client_write(FAR void *handle, int fd,
       ret = rpmsg_send_nocopy(&priv->ept, msg, sizeof(*msg) + space);
       if (ret < 0)
         {
+          rpmsg_release_tx_buffer(&priv->ept, msg);
           goto out;
         }
 

fs/rpmsgfs/rpmsgfs_server.c

@@ -391,7 +391,11 @@ static int rpmsgfs_read_handler(FAR struct rpmsg_endpoint *ept,
         }
 
       rsp->header.result = ret;
-      rpmsg_send_nocopy(ept, rsp, (ret < 0 ? 0 : ret) + sizeof(*rsp));
+      if (rpmsg_send_nocopy(ept, rsp, (ret < 0 ? 0 : ret) + sizeof(*rsp))
+          < 0)
+        {
+          rpmsg_release_tx_buffer(ept, rsp);
+        }
 
       if (ret <= 0)
         {