Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2136b67d authored by Neil Zhang's avatar Neil Zhang Committed by Prakash Gupta
Browse files

ion:synchronize debugfs callback and ion_client_destroy 



There are race condition B/T ion_client_destroy and debugfs callbacks.
Let's use a mutex to synchronize them.

Change-Id: I3373dc1dbb551b615105a485cc2d3c4bcc0e5e99
Signed-off-by: default avatarNeil Zhang <neilzhang1123@hotmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 948c4db4ee10d85fe78ed3755dcaeb85cd37a148
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git


[guptap@codeaurora.org: resolve trivial merge conflicts and
 change usage of %p with %pK]
Signed-off-by: default avatarPrakash Gupta <guptap@codeaurora.org>
parent 026cbd8d

drivers/staging/android/ion/ion.c

+44 −0
Original line number Diff line number Diff line
@@ -842,11 +842,47 @@ void ion_unmap_kernel(struct ion_client *client, struct ion_handle *handle) 
}

EXPORT_SYMBOL(ion_unmap_kernel);



static struct mutex debugfs_mutex;

static struct rb_root *ion_root_client;

static int is_client_alive(struct ion_client *client)

{

	struct rb_node *node;

	struct ion_client *tmp;

	struct ion_device *dev;



	node = ion_root_client->rb_node;

	dev = container_of(ion_root_client, struct ion_device, clients);



	down_read(&dev->lock);

	while (node) {

		tmp = rb_entry(node, struct ion_client, node);

		if (client < tmp) {

			node = node->rb_left;

		} else if (client > tmp) {

			node = node->rb_right;

		} else {

			up_read(&dev->lock);

			return 1;

		}

	}



	up_read(&dev->lock);

	return 0;

}



static int ion_debug_client_show(struct seq_file *s, void *unused)

{

	struct ion_client *client = s->private;

	struct rb_node *n;



	mutex_lock(&debugfs_mutex);

	if (!is_client_alive(client)) {

		seq_printf(s, "ion_client 0x%pK dead, can't dump its buffers\n",

			   client);

		mutex_unlock(&debugfs_mutex);

		return 0;

	}



	seq_printf(s, "%16.16s: %16.16s : %16.16s : %12.12s\n",

			"heap_name", "size_in_bytes", "handle refcount",

			"buffer");
@@ -865,6 +901,7 @@ static int ion_debug_client_show(struct seq_file *s, void *unused) 
		seq_printf(s, "\n");

	}

	mutex_unlock(&client->lock);

	mutex_unlock(&debugfs_mutex);

	return 0;

}
@@ -995,6 +1032,7 @@ void ion_client_destroy(struct ion_client *client) 
	struct rb_node *n;



	pr_debug("%s: %d\n", __func__, __LINE__);

	mutex_lock(&debugfs_mutex);

	while ((n = rb_first(&client->handles))) {

		struct ion_handle *handle = rb_entry(n, struct ion_handle,

						     node);
@@ -1014,6 +1052,7 @@ void ion_client_destroy(struct ion_client *client) 
	kfree(client->display_name);

	kfree(client->name);

	kfree(client);

	mutex_unlock(&debugfs_mutex);

}

EXPORT_SYMBOL(ion_client_destroy);
@@ -1810,6 +1849,7 @@ static int ion_debug_heap_show(struct seq_file *s, void *unused) 
	seq_printf(s, "%16s %16s %16s\n", "client", "pid", "size");

	seq_puts(s, "----------------------------------------------------\n");



	mutex_lock(&debugfs_mutex);

	for (n = rb_first(&dev->clients); n; n = rb_next(n)) {

		struct ion_client *client = rb_entry(n, struct ion_client,

						     node);
@@ -1828,6 +1868,8 @@ static int ion_debug_heap_show(struct seq_file *s, void *unused) 
				   client->pid, size);

		}

	}

	mutex_unlock(&debugfs_mutex);



	seq_puts(s, "----------------------------------------------------\n");

	seq_puts(s, "orphaned allocations (info is from last known client):\n");

	mutex_lock(&dev->buffer_lock);
@@ -2065,6 +2107,8 @@ debugfs_done: 
	init_rwsem(&idev->lock);

	plist_head_init(&idev->heaps);

	idev->clients = RB_ROOT;

	ion_root_client = &idev->clients;

	mutex_init(&debugfs_mutex);

	return idev;

}

EXPORT_SYMBOL(ion_device_create);