diff options
| author | Rebecca Schultz Zavin <rebecca@android.com> | 2012-08-20 15:41:11 -0700 |
|---|---|---|
| committer | Varun Wadekar <vwadekar@nvidia.com> | 2012-09-18 13:56:32 +0530 |
| commit | 01e3927277bc4c5124335be89a16ea4307f61807 (patch) | |
| tree | 8de4f8ca2fa3b471aab80127e73f7281ea77b043 /drivers/gpu | |
| parent | 909507818661d466fbbd37a4de943f3bcbeb192f (diff) | |
gpu: ion: Fix race between ion_import and ion_free
If preemted during ion_free after the refcount is updated but
before the handle can be removed from the rb_tree, import
might find that handle in the tree and try to reuse it
when execution returns to free, the handle will be cleaned
up leaving the caller of import with a corrupt handle.
This patch modifies the locking to protect agains this race.
Change-Id: I31d18cc6398f0ca18e05cd919e2bcf86fa18d568
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/ion/ion.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/drivers/gpu/ion/ion.c b/drivers/gpu/ion/ion.c index 8d14abacb570..132baaf6abe7 100644 --- a/drivers/gpu/ion/ion.c +++ b/drivers/gpu/ion/ion.c @@ -255,8 +255,6 @@ static void ion_handle_destroy(struct kref *kref) struct ion_client *client = handle->client; struct ion_buffer *buffer = handle->buffer; - mutex_lock(&client->lock); - mutex_lock(&buffer->lock); while (handle->kmap_cnt) ion_handle_kmap_put(handle); @@ -264,7 +262,6 @@ static void ion_handle_destroy(struct kref *kref) if (!RB_EMPTY_NODE(&handle->node)) rb_erase(&handle->node, &client->handles); - mutex_unlock(&client->lock); ion_buffer_put(buffer); kfree(handle); @@ -410,13 +407,13 @@ void ion_free(struct ion_client *client, struct ion_handle *handle) mutex_lock(&client->lock); valid_handle = ion_handle_validate(client, handle); - mutex_unlock(&client->lock); if (!valid_handle) { WARN(1, "%s: invalid handle passed to free.\n", __func__); return; } ion_handle_put(handle); + mutex_unlock(&client->lock); } EXPORT_SYMBOL(ion_free); |