From 093c26a745acc75c8d2467a94e244a9413fb941f Mon Sep 17 00:00:00 2001
From: Jeremy Gebben <jgebben@codeaurora.org>
Date: Thu, 26 Jan 2012 12:33:29 -0700
Subject: [PATCH] libgralloc: don't IonAlloc::close_device() on error

It is possible to use this object from multiple threads
and there could be a race between a failure in one thread
and another method call from a different thread which would
result in system calls being called with an invalid fd.

(cherry picked from commit 560ca6e8feb4f52c9aade34fa7cfcfed55288083)

Change-Id: Iefb94ba1ee7177ab20600bee4374daf8e818bdb9
---
 libgralloc/ionalloc.cpp | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/libgralloc/ionalloc.cpp b/libgralloc/ionalloc.cpp
index dbd8546..f89f853 100644
--- a/libgralloc/ionalloc.cpp
+++ b/libgralloc/ionalloc.cpp
@@ -87,7 +87,6 @@ int IonAlloc::alloc_buffer(alloc_data& data)
         if(ionSyncFd < 0) {
             LOGE("%s: Failed to open ion device - %s",
                     __FUNCTION__, strerror(errno));
-            close_device();
             return -errno;
         }
         iFd = ionSyncFd;
@@ -98,7 +97,6 @@ int IonAlloc::alloc_buffer(alloc_data& data)
     if(ioctl(iFd, ION_IOC_ALLOC, &ionAllocData)) {
         err = -errno;
         LOGE("ION_IOC_ALLOC failed with error - %s", strerror(errno));
-        close_device();
         if(ionSyncFd >= 0)
             close(ionSyncFd);
         ionSyncFd = FD_INIT;
@@ -112,7 +110,6 @@ int IonAlloc::alloc_buffer(alloc_data& data)
         LOGE("%s: ION_IOC_MAP failed with error - %s",
                 __FUNCTION__, strerror(errno));
         ioctl(mIonFd, ION_IOC_FREE, &handle_data);
-        close_device();
         if(ionSyncFd >= 0)
             close(ionSyncFd);
         ionSyncFd = FD_INIT;
@@ -128,7 +125,6 @@ int IonAlloc::alloc_buffer(alloc_data& data)
             LOGE("%s: Failed to map the allocated memory: %s",
                                     __FUNCTION__, strerror(errno));
             ioctl(mIonFd, ION_IOC_FREE, &handle_data);
-            close_device();
             ionSyncFd = FD_INIT;
             return err;
         }
@@ -219,7 +215,6 @@ int IonAlloc::clean_buffer(void *base, size_t size, int offset, int fd)
         err = -errno;
         LOGE("%s: ION_IOC_IMPORT failed with error - %s",
                 __FUNCTION__, strerror(errno));
-        close_device();
         return err;
     }
 
@@ -233,7 +228,6 @@ int IonAlloc::clean_buffer(void *base, size_t size, int offset, int fd)
         LOGE("%s: ION_IOC_CLEAN_INV_CACHES failed with error - %s",
                 __FUNCTION__, strerror(errno));
         ioctl(mIonFd, ION_IOC_FREE, &handle_data);
-        close_device();
         return err;
     }
     ioctl(mIonFd, ION_IOC_FREE, &handle_data);