From 606fb649e161a6465d2cc7ffdf0e9695b12bded4 Mon Sep 17 00:00:00 2001
From: Krishna Chaitanya Devarakonda <kdevarak@codeaurora.org>
Date: Tue, 12 Sep 2017 13:57:16 +0530
Subject: [PATCH] msm: mdss: Fix potential race condition in rotator

There might be a possible race condition in rotator, where two
threads can free same perf structures. Adding proper locking
to avoid such race conditions.

Change-Id: I4976da6f176df24da2ec86c4c1f176cc43aba05b
Signed-off-by: Krishna Chaitanya Devarakonda <kdevarak@codeaurora.org>
---
 drivers/video/fbdev/msm/mdss_rotator.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/msm/mdss_rotator.c b/drivers/video/fbdev/msm/mdss_rotator.c
index 2028222748c3..78bccdbfee3b 100644
--- a/drivers/video/fbdev/msm/mdss_rotator.c
+++ b/drivers/video/fbdev/msm/mdss_rotator.c
@@ -1124,6 +1124,7 @@ static void mdss_rotator_release_from_work_distribution(
 		bool free_perf = false;
 		u32 wb_idx = entry->queue->hw->wb_id;
 
+		mutex_lock(&mgr->lock);
 		mutex_lock(&entry->perf->work_dis_lock);
 		if (entry->perf->work_distribution[wb_idx])
 			entry->perf->work_distribution[wb_idx]--;
@@ -1147,6 +1148,7 @@ static void mdss_rotator_release_from_work_distribution(
 			mdss_rotator_clk_ctrl(mgr, false);
 			entry->perf = NULL;
 		}
+		mutex_unlock(&mgr->lock);
 	}
 }
 
@@ -2043,7 +2045,6 @@ static int mdss_rotator_close_session(struct mdss_rot_mgr *mgr,
 	list_del_init(&perf->list);
 	mutex_unlock(&perf->work_dis_lock);
 	mutex_unlock(&private->perf_lock);
-	mutex_unlock(&mgr->lock);
 
 	if (offload_release_work)
 		goto done;
@@ -2056,6 +2057,7 @@ static int mdss_rotator_close_session(struct mdss_rot_mgr *mgr,
 done:
 	pr_debug("Closed session id:%u", id);
 	ATRACE_END(__func__);
+	mutex_unlock(&mgr->lock);
 	return 0;
 }