Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933142AbbLOBeN (ORCPT ); Mon, 14 Dec 2015 20:34:13 -0500 Received: from mail-pa0-f46.google.com ([209.85.220.46]:36058 "EHLO mail-pa0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932869AbbLOBeL (ORCPT ); Mon, 14 Dec 2015 20:34:11 -0500 Date: Mon, 14 Dec 2015 17:34:08 -0800 From: Dmitry Torokhov To: Greg Kroah-Hartman Cc: Arve =?iso-8859-1?B?SGr4bm5lduVn?= , Riley Andrews , Andrew Bresticker , devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Subject: [PATCH] android: unconditionally remove callbacks in sync_fence_free() Message-ID: <20151215013408.GA28746@dtor-ws> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1603 Lines: 44 Using fence->status to determine whether or not there are callbacks remaining on the sync_fence is racy since fence->status may have been decremented to 0 on another CPU before fence_check_cb_func() has completed. By unconditionally calling fence_remove_callback() for each fence in the sync_fence, we guarantee that each callback has either completed (since fence_remove_callback() grabs the fence lock) or been removed. Signed-off-by: Andrew Bresticker Signed-off-by: Dmitry Torokhov --- drivers/staging/android/sync.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/staging/android/sync.c b/drivers/staging/android/sync.c index f8566c1..f3814a8 100644 --- a/drivers/staging/android/sync.c +++ b/drivers/staging/android/sync.c @@ -527,12 +527,10 @@ static const struct fence_ops android_fence_ops = { static void sync_fence_free(struct kref *kref) { struct sync_fence *fence = container_of(kref, struct sync_fence, kref); - int i, status = atomic_read(&fence->status); + int i; for (i = 0; i < fence->num_fences; ++i) { - if (status) - fence_remove_callback(fence->cbs[i].sync_pt, - &fence->cbs[i].cb); + fence_remove_callback(fence->cbs[i].sync_pt, &fence->cbs[i].cb); fence_put(fence->cbs[i].sync_pt); } -- 2.6.0.rc2.230.g3dd15c0 -- Dmitry -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/