video: tegra: host: use lock to get syncpt name
Gagan Grover [Tue, 22 Nov 2016 10:13:19 +0000 (15:13 +0530)]
Use sp->syncpt_mutex lock to get syncpt name in
syncpt_name_show()
Without the lock, it is possible for user to read
syncpt name in corrupted state if user read
coincides with syncpt free

Bug 1838598
Bug 1883567

Change-Id: I69ca5c1d80adaca4b93a337fe4a5debeb78f34fc
Reviewed-on: http://git-master/r/1252580
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1258020
Signed-off-bu: Debarshi Dutta <ddutta@nvidia.com>
(cherry picked from commit 9a7d12e49ca6c627dff2dc4c15fa9ba153e9265d in rel-24)
Reviewed-on: https://git-master.nvidia.com/r/1513005
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>

drivers/video/tegra/host/nvhost_syncpt.c

index 33a1243..7e8e2d7 100644 (file)
@@ -3,7 +3,7 @@
  *
  * Tegra Graphics Host Syncpoints
  *
- * Copyright (c) 2010-2016, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2010-2017, NVIDIA CORPORATION. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -628,13 +628,18 @@ static ssize_t syncpt_name_show(struct kobject *kobj,
 {
        struct nvhost_syncpt_attr *syncpt_attr =
                container_of(attr, struct nvhost_syncpt_attr, attr);
+       ssize_t count = 0;
 
        if (syncpt_attr->id < 0)
                return snprintf(buf, PAGE_SIZE, "\n");
 
-       return snprintf(buf, PAGE_SIZE, "%s\n",
+       mutex_lock(&syncpt_attr->host->syncpt.syncpt_mutex);
+       count = snprintf(buf, PAGE_SIZE, "%s\n",
                nvhost_syncpt_get_name(syncpt_attr->host->dev,
                                       syncpt_attr->id));
+       mutex_unlock(&syncpt_attr->host->syncpt.syncpt_mutex);
+
+       return count;
 }
 
 static ssize_t syncpt_min_show(struct kobject *kobj,