shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 03:40:35 +09:00
Code Issues Packages Projects Releases Wiki Activity

ion: fix deadlock in ion driver [1/2]

Browse Source 
PD#SWPL-17365

Problem:
There exits deadlock between ion_client_destroy
and ion_debug_heap_show.
ion_client_destroy will take debugfs_mutex and then
call debugfs_remove_recursive, which will wait for
the finish of debugfs_srcu's GP.
sys_read will enter debugfs_srcu'critical section,
then ion_debug_heap_show will try to get debugfs_mutex.
At last, deadlock occurs.

Solution:
change mutex_unlock place in ion_client_destroy,
don't let the mutex lock synchronize_srcu.

Verify:
autoreboot test on tl1

Change-Id: I7008a6bf21421ab08d84754ae52d0840e53900c9
Signed-off-by: binqi zhang <binqi.zhang@amlogic.com>
This commit is contained in:
binqi zhang
2019-12-18 19:05:55 +08:00
committed by Chris
parent c543f0fd47
commit f34d9f958e
1 changed files with 1 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/staging/android/ion/ion.c
View File

@@ -1344,29 +1344,10 @@ static int ion_debug_heap_show(struct seq_file *s, void *unused)
struct rb_node *n;
size_t total_size = 0;
size_t total_orphaned_size = 0;
#ifdef CONFIG_AMLOGIC_MODIFY
mutex_lock(&debugfs_mutex);
mutex_lock(&dev->buffer_lock);
seq_puts(s, "All allocated buffers listed:\n");
for (n = rb_first(&dev->buffers); n; n = rb_next(n)) {
struct ion_buffer *buffer = rb_entry(n, struct ion_buffer,
node);
if (buffer->heap->id != heap->id)
continue;
seq_printf(s, "%s %p %8s %u %8s %zu %8s %d %8s %d\n",
"buf=", buffer,
"heap_id=", heap->id,
"size=", buffer->size,
"kmap=", buffer->kmap_cnt,
"dmap=", buffer->dmap_cnt);
}
seq_puts(s, "----------------------------------------------------\n");
mutex_unlock(&dev->buffer_lock);
#else
seq_printf(s, "%16s %16s %16s\n", "client", "pid", "size");
seq_puts(s, "----------------------------------------------------\n");
mutex_lock(&debugfs_mutex);
#endif
for (n = rb_first(&dev->clients); n; n = rb_next(n)) {
struct ion_client *client = rb_entry(n, struct ion_client,
node);