Commit 1aea59a5 authored May 09, 2016 by Shiraz Hashim

ion: destroy ion handles under client->lock



ion handles associated with a client must be destroyed
under client->lock so as to prevent race where other path
use handle while being destroyed.

One such path is when user access heap details through
debugfs.

   |rb_next()
   |ion_debug_heap_total(inline)
   |ion_debug_heap_show()
   |seq_read()

CRs-Fixed: 1000492
Change-Id: I7bc7562400df0ae08b1aa232efe00b657339fcfb
Signed-off-by: Shiraz Hashim <shashim@codeaurora.org>

parent fbfdd7c9

drivers/staging/android/ion/ion.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -915,6 +915,7 @@ void ion_client_destroy(struct ion_client *client)
		struct rb_node *n;

		pr_debug("%s: %d\n", __func__, __LINE__);
		mutex_lock(&client->lock);
		while ((n = rb_first(&client->handles))) {
		struct ion_handle *handle = rb_entry(n, struct ion_handle,
		node);
		@@ -922,6 +923,7 @@ void ion_client_destroy(struct ion_client *client)
		}

		idr_destroy(&client->idr);
		mutex_unlock(&client->lock);

		down_write(&dev->lock);
		if (client->task)