virtio_gpu_cmd_get_capset would check for the existence of an entry
under lock. If it was not found, it would unlock and call
virtio_gpu_cmd_get_capset to create a new entry. The new entry would
be added it to the list without checking if it was added by another
task during the period where the lock was not held resulting in
duplicate entries.
Compounding this issue, virtio_gpu_cmd_capset_cb would stop iterating
after find the first matching entry. Multiple callbacks would modify
the first entry, but any subsequent entries and their associated waiters
would eventually timeout since they don't become valid, also wasting
memory along the way.
Signed-off-by: David Riley <davidriley@chromium.org>
Link: http://patchwork.freedesktop.org/patch/msgid/20190605234423.11348-3-davidriley@chromium.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 5934ce998faf33277cc19522609577be835e80b1)
Signed-off-by: Greg Hartman <ghartman@google.com>
BUG: 139386237
Change-Id: I29e15059f0603a9723891d23ac27d44c932ef0ad
3240ebbba9