diff options
authorPrakash Kamliya <pkamliya@codeaurora.org>2013-10-04 17:50:50 +0530
committerColin Cross <ccross@android.com>2013-10-13 00:36:03 +0000
commit763b334bd467a1f9453fe19ab19354e3b8c351e2 (patch)
parent4fe1f96d0bc0cce09c41a6818153fea81d645a39 (diff)
sync: signal pt before sync_timeline object gets destroyed
There is a race condition Assume we have *one* sync_fence object, with *one* sync_pt which belongs to *one* sync_timeline, given this condition, sync_timeline->kref will have two counts, one for sync_timeline (implicit) and another for sync_pt. Assume following is the situation on CPU Theead-1 : (Thread which calls sync_timeline_destroy()) -> (some function calls) -> sync_timeline_destory() -> sync_timeline_signal() (CPU is inside this function after putting reference to sync_timeline) At this time Thread-2 comes and does following Thread-2 : (fclose on fence fd) > sync_fence_release() -> because of fclose() on fence object -> sync_fence_free() -> sync_pt_free() -> kref_put(&pt->parent->kref, sync_timeline_free); -> sync_timeline_free() (CPU is inside this because this time kref will be zero after _put) Thread-2 will free sync_timeline object before Thread-1 has finished its work inside sync_timeline_signal. With this change we signals all sync_pt before putting reference to sync_timeline object. Change-Id: Ic680e4d0bbef1c46bcb7cfba693395645241d203 Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/staging/android/sync.c b/drivers/staging/android/sync.c
index 3893a357476..c5a43934e85 100644
--- a/drivers/staging/android/sync.c
+++ b/drivers/staging/android/sync.c
@@ -92,14 +92,14 @@ static void sync_timeline_free(struct kref *kref)
void sync_timeline_destroy(struct sync_timeline *obj)
obj->destroyed = true;
+ smp_wmb();
- * If this is not the last reference, signal any children
- * that their parent is going away.
+ * signal any children that their parent is going away.
+ sync_timeline_signal(obj);
- if (!kref_put(&obj->kref, sync_timeline_free))
- sync_timeline_signal(obj);
+ kref_put(&obj->kref, sync_timeline_free);