tree 6ee17859f71369573b8b459fdf22063ec4bec49f
parent 4fe492a34ebdca2444cbe357767de65f89aad4ae
author Liam Mark <lmark@codeaurora.org> 1547836664 -0800
committer Jonas Larsson <ljonas@google.com> 1579825238 +0000

staging: android: ion: Support cpu access during dma_buf_detach

Often userspace doesn't know when the kernel will be calling dma_buf_detach
on the buffer.
If userpace starts its CPU access at the same time as the sg list is being
freed it could end up accessing the sg list after it has been freed.

Thread A				Thread B
- DMA_BUF_IOCTL_SYNC IOCT
 - ion_dma_buf_begin_cpu_access
  - list_for_each_entry
					- ion_dma_buf_detatch
					 - free_duped_table
   - dma_sync_sg_for_cpu

Fix this by getting the ion_buffer lock before freeing the sg table memory.

Fixes: 2a55e7b5e544 ("staging: android: ion: Call dma_map_sg for syncing and mapping")
Change-Id: I70ad1be3bc334c5a2b3a393bd7d95084bd9e8d62
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Acked-by: Laura Abbott <labbott@redhat.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>