gpu: ion: Fix race between ion_import and ion_free
authorRebecca Schultz Zavin <rebecca@android.com>
Fri, 13 Dec 2013 22:24:01 +0000 (14:24 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 14 Dec 2013 16:55:38 +0000 (08:55 -0800)
commit0e9c03a58ed599594780a69c988bd11e6459a752
tree0d20709366e4bbb2f6407fccdb6fc98824825045
parent12edf53db310345693fb7227c50e70a9b1fce434
gpu: ion: Fix race between ion_import and ion_free

If preemted during ion_free after the refcount is updated but
before the handle can be removed from the rb_tree, import
might find that handle in the tree and try to reuse it
when execution returns to free, the handle will be cleaned
up leaving the caller of import with a corrupt handle.
This patch modifies the locking to protect agains this race.

Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
[jstultz: modified patch to apply to staging directory]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/android/ion/ion.c