gpu: ion: Fix race between ion_import and ion_free
authorRebecca Schultz Zavin <rebecca@android.com>
Mon, 20 Aug 2012 22:41:11 +0000 (15:41 -0700)
committerArve Hjønnevåg <arve@android.com>
Mon, 1 Jul 2013 21:16:05 +0000 (14:16 -0700)
commit3122d079e38b31d02e4814eee1b772a90ab88375
tree1ad7377db6e10225728ac217410c34008a0d309e
parentc33bcd377203feb708cb02673731e70c14ef8c91
gpu: ion: Fix race between ion_import and ion_free

If preemted during ion_free after the refcount is updated but
before the handle can be removed from the rb_tree, import
might find that handle in the tree and try to reuse it
when execution returns to free, the handle will be cleaned
up leaving the caller of import with a corrupt handle.
This patch modifies the locking to protect agains this race.

Change-Id: I31d18cc6398f0ca18e05cd919e2bcf86fa18d568
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
drivers/gpu/ion/ion.c