From d8b33a2dac2e94dda2f0a09975ec7db9a7d1fcff Mon Sep 17 00:00:00 2001 From: Amir Samuelov Date: Tue, 31 May 2016 10:13:26 +0300 Subject: [PATCH] spcom: fix lock ION buffer Check if ION buffer is locked based on comparing the kernel ion handle, rather than comparing the user file descriptor. Change-Id: I7a41df3eebf22de2cc6b14327978923bcdbb7142 Signed-off-by: Amir Samuelov --- drivers/soc/qcom/spcom.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/soc/qcom/spcom.c b/drivers/soc/qcom/spcom.c index a5e17991f122..24c8d911ef17 100644 --- a/drivers/soc/qcom/spcom.c +++ b/drivers/soc/qcom/spcom.c @@ -1520,12 +1520,6 @@ static int spcom_handle_lock_ion_buf_command(struct spcom_channel *ch, return -ENODEV; } - /* Check if this FD is already locked */ - for (i = 0 ; i < SPCOM_MAX_ION_BUF ; i++) - if (ch->ion_fd_table[i] == fd) { - pr_debug("fd [%d] is already locked.\n", fd); - return -EINVAL; - } /* Get ION handle from fd - this increments the ref count */ ion_handle = ion_import_dma_buf(spcom_dev->ion_client, fd); @@ -1535,6 +1529,17 @@ static int spcom_handle_lock_ion_buf_command(struct spcom_channel *ch, } pr_debug("ion handle ok.\n"); + /* Check if this ION buffer is already locked */ + for (i = 0 ; i < SPCOM_MAX_ION_BUF ; i++) { + if (ch->ion_handle_table[i] == ion_handle) { + pr_debug("fd [%d] ion buf is already locked.\n", fd); + /* decrement back the ref count */ + ion_free(spcom_dev->ion_client, ion_handle); + return -EINVAL; + } + } + + /* Store the ION handle */ for (i = 0 ; i < SPCOM_MAX_ION_BUF ; i++) { if (ch->ion_handle_table[i] == NULL) { ch->ion_handle_table[i] = ion_handle;