gpu: nvgpu: hold ch ref when getting ch from fd

Fix a race condition in gk20a_get_channel_from_file() that returns a
channel pointer from an fd: take a reference to the channel before
putting the file ref back. Now the caller is responsible of releasing
the channel reference eventually.

Also document why dbg_session_channel_data has to hold a ref to the
channel file instead of just the channel: that might deadlock if the fds
were closed in "wrong" order.

Change-Id: I8e91b809f5f7b1cb0c1487bd955ad6d643727a53
Signed-off-by: Konsta Holtta <kholtta@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1549290
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>

1 files changed, 8 insertions, 1 deletions

diff --git a/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.h b/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.h
index 827fb42f..4d2c0f94 100644
--- a/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.h
+++ b/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.h
@@ -93,7 +93,14 @@ dbg_session_data_from_dbg_s_entry(struct nvgpu_list_node *node)
 };
 
 struct dbg_session_channel_data {
-        struct file          *ch_f;
+        /*
+         * We have to keep a ref to the _file_, not the channel, because
+         * close(channel_fd) is synchronous and would deadlock if we had an
+         * open debug session fd holding a channel ref at that time. Holding a
+         * ref to the file makes close(channel_fd) just drop a kernel ref to
+         * the file; the channel will close when the last file ref is dropped.
+         */
+        struct file *ch_f;
         int channel_fd;
         int chid;
         struct nvgpu_list_node ch_entry;