The write operations to "alloc->buffer" are protected by the lock on line 679 and 730, but the read operation to this data on line 712 is not protected by the lock. Thus, there may exist a data race for "alloc->buffer". To fix this data race, the read operation to "alloc->buffer" should be also protected by the lock. Signed-off-by: Jia-Ju Bai <baijiaju1990@xxxxxxxxx> --- drivers/android/binder_alloc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 5a426c877dfb..596acc3a84e4 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -709,7 +709,9 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc, goto err_alloc_buf_struct_failed; } + mutex_lock(&binder_alloc_mmap_lock); buffer->data = alloc->buffer; + mutex_unlock(&binder_alloc_mmap_lock); list_add(&buffer->entry, &alloc->buffers); buffer->free = 1; binder_insert_free_buffer(alloc, buffer); -- 2.17.0 _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
