mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-29 15:43:59 +08:00
ac5b705b22
There is a race condition
Assume we have *one* sync_fence object, with *one* sync_pt
which belongs to *one* sync_timeline, given this condition,
sync_timeline->kref will have two counts, one for sync_timeline
(implicit) and another for sync_pt.
Assume following is the situation on CPU
Theead-1 : (Thread which calls sync_timeline_destroy())
-> (some function calls)
-> sync_timeline_destory()
-> sync_timeline_signal() (CPU is inside this
function after putting reference to sync_timeline)
At this time Thread-2 comes and does following
Thread-2 : (fclose on fence fd)
> sync_fence_release() -> because of fclose() on fence object
-> sync_fence_free()
-> sync_pt_free()
-> kref_put(&pt->parent->kref, sync_timeline_free);
-> sync_timeline_free() (CPU is inside this because
this time kref will be zero after _put)
Thread-2 will free sync_timeline object before Thread-1
has finished its work inside sync_timeline_signal.
With this change we signals all sync_pt before putting
reference to sync_timeline object.
Cc: Colin Cross <ccross@android.com>
Cc: Android Kernel Team <kernel-team@android.com>
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
[jstultz: minor commit subject tweak]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|---|---|---|
| .. | ||
| ion | ||
| trace | ||
| uapi | ||
| alarm-dev.c | ||
| android_alarm.h | ||
| ashmem.c | ||
| ashmem.h | ||
| binder_trace.h | ||
| binder.c | ||
| binder.h | ||
| Kconfig | ||
| logger.c | ||
| logger.h | ||
| lowmemorykiller.c | ||
| Makefile | ||
| ram_console.h | ||
| sw_sync.c | ||
| sw_sync.h | ||
| sync.c | ||
| sync.h | ||
| timed_gpio.c | ||
| timed_gpio.h | ||
| timed_output.c | ||
| timed_output.h | ||
| TODO | ||