staging: vc04_services: vc-sm-cma: Take spinlock for idr lookup

6by9 · 6by9 · commit bd5f8b97b2ca · 2025-03-05T17:29:29.000Z
Whilst the particular buffer object won't get destroyed whilst
being looked up, the idr structure itself could be modified by
another thread.

Take the spinlock for the lookup.

Signed-off-by: Dave Stevenson &lt;dave.stevenson@raspberrypi.com&gt;
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -138,7 +138,13 @@ static int get_kernel_id(struct vc_sm_buffer *buffer)
 
 static struct vc_sm_buffer *lookup_kernel_id(int handle)
 {
-	return idr_find(&sm_state->kernelid_map, handle);
+	struct vc_sm_buffer *buffer;
+
+	spin_lock(&sm_state->kernelid_map_lock);
+	buffer = idr_find(&sm_state->kernelid_map, handle);
+	spin_unlock(&sm_state->kernelid_map_lock);
+
+	return buffer;
 }
 
 static void free_kernel_id(int handle)

Original file line number	Diff line number	Diff line change
`@@ -138,7 +138,13 @@ static int get_kernel_id(struct vc_sm_buffer *buffer)`
`138`	`138`
`139`	`139`	`static struct vc_sm_buffer *lookup_kernel_id(int handle)`
`140`	`140`	`{`
`141`		`- return idr_find(&sm_state->kernelid_map, handle);`
	`141`	`+ struct vc_sm_buffer *buffer;`
	`142`	`+`
	`143`	`+ spin_lock(&sm_state->kernelid_map_lock);`
	`144`	`+ buffer = idr_find(&sm_state->kernelid_map, handle);`
	`145`	`+ spin_unlock(&sm_state->kernelid_map_lock);`
	`146`	`+`
	`147`	`+ return buffer;`
`142`	`148`	`}`
`143`	`149`
`144`	`150`	`static void free_kernel_id(int handle)`