Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 948c4db4 authored by Neil Zhang's avatar Neil Zhang Committed by Greg Kroah-Hartman
Browse files

ion:synchronize debugfs callback and ion_client_destroy 



There are race condition B/T ion_client_destroy and debugfs callbacks.
Let's use a mutex to synchronize them.

Signed-off-by: default avatarNeil Zhang <neilzhang1123@hotmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9f90381b

drivers/staging/android/ion/ion.c

+44 −0
Original line number Original line Diff line number Diff line
@@ -677,6 +677,34 @@ void ion_unmap_kernel(struct ion_client *client, struct ion_handle *handle) 
}

}

EXPORT_SYMBOL(ion_unmap_kernel);

EXPORT_SYMBOL(ion_unmap_kernel);





static struct mutex debugfs_mutex;

static struct rb_root *ion_root_client;

static int is_client_alive(struct ion_client *client)

{

	struct rb_node *node;

	struct ion_client *tmp;

	struct ion_device *dev;



	node = ion_root_client->rb_node;

	dev = container_of(ion_root_client, struct ion_device, clients);



	down_read(&dev->lock);

	while (node) {

		tmp = rb_entry(node, struct ion_client, node);

		if (client < tmp) {

			node = node->rb_left;

		} else if (client > tmp) {

			node = node->rb_right;

		} else {

			up_read(&dev->lock);

			return 1;

		}

	}



	up_read(&dev->lock);

	return 0;

}



static int ion_debug_client_show(struct seq_file *s, void *unused)

static int ion_debug_client_show(struct seq_file *s, void *unused)

{

{

	struct ion_client *client = s->private;

	struct ion_client *client = s->private;
@@ -685,6 +713,14 @@ static int ion_debug_client_show(struct seq_file *s, void *unused) 
	const char *names[ION_NUM_HEAP_IDS] = {NULL};

	const char *names[ION_NUM_HEAP_IDS] = {NULL};

	int i;

	int i;





	mutex_lock(&debugfs_mutex);

	if (!is_client_alive(client)) {

		seq_printf(s, "ion_client 0x%p dead, can't dump its buffers\n",

			   client);

		mutex_unlock(&debugfs_mutex);

		return 0;

	}



	mutex_lock(&client->lock);

	mutex_lock(&client->lock);

	for (n = rb_first(&client->handles); n; n = rb_next(n)) {

	for (n = rb_first(&client->handles); n; n = rb_next(n)) {

		struct ion_handle *handle = rb_entry(n, struct ion_handle,

		struct ion_handle *handle = rb_entry(n, struct ion_handle,
@@ -696,6 +732,7 @@ static int ion_debug_client_show(struct seq_file *s, void *unused) 
		sizes[id] += handle->buffer->size;

		sizes[id] += handle->buffer->size;

	}

	}

	mutex_unlock(&client->lock);

	mutex_unlock(&client->lock);

	mutex_unlock(&debugfs_mutex);





	seq_printf(s, "%16.16s: %16.16s\n", "heap_name", "size_in_bytes");

	seq_printf(s, "%16.16s: %16.16s\n", "heap_name", "size_in_bytes");

	for (i = 0; i < ION_NUM_HEAP_IDS; i++) {

	for (i = 0; i < ION_NUM_HEAP_IDS; i++) {
@@ -832,6 +869,7 @@ void ion_client_destroy(struct ion_client *client) 
	struct rb_node *n;

	struct rb_node *n;





	pr_debug("%s: %d\n", __func__, __LINE__);

	pr_debug("%s: %d\n", __func__, __LINE__);

	mutex_lock(&debugfs_mutex);

	while ((n = rb_first(&client->handles))) {

	while ((n = rb_first(&client->handles))) {

		struct ion_handle *handle = rb_entry(n, struct ion_handle,

		struct ion_handle *handle = rb_entry(n, struct ion_handle,

						     node);

						     node);
@@ -850,6 +888,7 @@ void ion_client_destroy(struct ion_client *client) 
	kfree(client->display_name);

	kfree(client->display_name);

	kfree(client->name);

	kfree(client->name);

	kfree(client);

	kfree(client);

	mutex_unlock(&debugfs_mutex);

}

}

EXPORT_SYMBOL(ion_client_destroy);

EXPORT_SYMBOL(ion_client_destroy);
@@ -1415,6 +1454,7 @@ static int ion_debug_heap_show(struct seq_file *s, void *unused) 
	seq_printf(s, "%16s %16s %16s\n", "client", "pid", "size");

	seq_printf(s, "%16s %16s %16s\n", "client", "pid", "size");

	seq_puts(s, "----------------------------------------------------\n");

	seq_puts(s, "----------------------------------------------------\n");





	mutex_lock(&debugfs_mutex);

	for (n = rb_first(&dev->clients); n; n = rb_next(n)) {

	for (n = rb_first(&dev->clients); n; n = rb_next(n)) {

		struct ion_client *client = rb_entry(n, struct ion_client,

		struct ion_client *client = rb_entry(n, struct ion_client,

						     node);

						     node);
@@ -1433,6 +1473,8 @@ static int ion_debug_heap_show(struct seq_file *s, void *unused) 
				   client->pid, size);

				   client->pid, size);

		}

		}

	}

	}

	mutex_unlock(&debugfs_mutex);



	seq_puts(s, "----------------------------------------------------\n");

	seq_puts(s, "----------------------------------------------------\n");

	seq_puts(s, "orphaned allocations (info is from last known client):\n");

	seq_puts(s, "orphaned allocations (info is from last known client):\n");

	mutex_lock(&dev->buffer_lock);

	mutex_lock(&dev->buffer_lock);
@@ -1617,6 +1659,8 @@ struct ion_device *ion_device_create(long (*custom_ioctl) 
	init_rwsem(&idev->lock);

	init_rwsem(&idev->lock);

	plist_head_init(&idev->heaps);

	plist_head_init(&idev->heaps);

	idev->clients = RB_ROOT;

	idev->clients = RB_ROOT;

	ion_root_client = &idev->clients;

	mutex_init(&debugfs_mutex);

	return idev;

	return idev;

}

}

EXPORT_SYMBOL(ion_device_create);

EXPORT_SYMBOL(ion_device_create);