Merge "staging/android/ion : fix a race condition in the ion driver" (58b948b1) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/staging/android/ion/ion.c

100644 → 100755

+41 −12

Original line number	Diff line number	Diff line
		@@ -406,13 +406,22 @@ static void ion_handle_get(struct ion_handle *handle)
		kref_get(&handle->ref);
		}

		static int ion_handle_put_nolock(struct ion_handle *handle)
		{
		int ret;

		ret = kref_put(&handle->ref, ion_handle_destroy);

		return ret;
		}

		int ion_handle_put(struct ion_handle *handle)
		{
		struct ion_client *client = handle->client;
		int ret;

		mutex_lock(&client->lock);
		ret = kref_put(&handle->ref, ion_handle_destroy);
		ret = ion_handle_put_nolock(handle);
		mutex_unlock(&client->lock);

		return ret;
		@@ -436,20 +445,30 @@ static struct ion_handle ion_handle_lookup(struct ion_client client,
		return ERR_PTR(-EINVAL);
		}

		struct ion_handle ion_handle_get_by_id(struct ion_client client,
		static struct ion_handle ion_handle_get_by_id_nolock(struct ion_client client,
		int id)
		{
		struct ion_handle *handle;

		mutex_lock(&client->lock);
		handle = idr_find(&client->idr, id);
		if (handle)
		ion_handle_get(handle);
		mutex_unlock(&client->lock);

		return handle ? handle : ERR_PTR(-EINVAL);
		}

		struct ion_handle ion_handle_get_by_id(struct ion_client client,
		int id)
		{
		struct ion_handle *handle;

		mutex_lock(&client->lock);
		handle = ion_handle_get_by_id_nolock(client, id);
		mutex_unlock(&client->lock);

		return handle;
		}

		static bool ion_handle_validate(struct ion_client *client,
		struct ion_handle *handle)
		{
		@@ -596,21 +615,27 @@ struct ion_handle ion_alloc(struct ion_client client, size_t len,
		}
		EXPORT_SYMBOL(ion_alloc);

		void ion_free(struct ion_client client, struct ion_handle handle)
		static void ion_free_nolock(struct ion_client client, struct ion_handle handle)
		{
		bool valid_handle;

		BUG_ON(client != handle->client);

		mutex_lock(&client->lock);
		valid_handle = ion_handle_validate(client, handle);
		if (!valid_handle) {
		WARN(1, "%s: invalid handle passed to free.\n", __func__);
		mutex_unlock(&client->lock);
		return;
		}
		ion_handle_put_nolock(handle);
		}

		void ion_free(struct ion_client client, struct ion_handle handle)
		{
		BUG_ON(client != handle->client);

		mutex_lock(&client->lock);
		ion_free_nolock(client, handle);
		mutex_unlock(&client->lock);
		ion_handle_put(handle);
		}
		EXPORT_SYMBOL(ion_free);

		@@ -1479,11 +1504,15 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
		{
		struct ion_handle *handle;

		handle = ion_handle_get_by_id(client, data.handle.handle);
		if (IS_ERR(handle))
		mutex_lock(&client->lock);
		handle = ion_handle_get_by_id_nolock(client, data.handle.handle);
		if (IS_ERR(handle)) {
		mutex_unlock(&client->lock);
		return PTR_ERR(handle);
		ion_free(client, handle);
		ion_handle_put(handle);
		}
		ion_free_nolock(client, handle);
		ion_handle_put_nolock(handle);
		mutex_unlock(&client->lock);
		break;
		}
		case ION_IOC_SHARE: