diff options
author | Sagar Kamble <skamble@nvidia.com> | 2021-08-02 23:41:33 -0400 |
---|---|---|
committer | mobile promotions <svcmobile_promotions@nvidia.com> | 2021-08-03 14:39:44 -0400 |
commit | ce8548ec056022c4feccacc9eb09a4e8619bdefa (patch) | |
tree | aa419fc8b0287d85727854c8a98e87453dde7258 /drivers/gpu/nvgpu/gp106/clk_arb_gp106.c | |
parent | 2c441a83d44857b71a599acfe76395942ea936bf (diff) |
gpu: nvgpu: fix clk_arb completion file private data access race
clk_arb completion file descriptor can get closed immediately after
poll finishes in the work item gp10b_clk_arb_run_arbiter_cb. In
that case, the refcount for nvgpu_clk_dev can become zero in
the work item and can lead to invalid access while removing
nvgpu_clk_dev from the lists.
Remove nvgpu_clk_dev from the list before dropping the reference to
it.
Also, delete the nvgpu_clk_dev in completion file release handler
within the session and requests spinlocks to avoid race with
gp10b_clk_arb_run_arbiter_cb using it.
bug 200757277
Change-Id: I054eee547f2a6fa633d7ef55df216ec36647a826
Signed-off-by: Sagar Kamble <skamble@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvgpu/+/2569522
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
Reviewed-by: Debarshi Dutta <ddutta@nvidia.com>
Reviewed-by: Deepak Nibade <dnibade@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Diffstat (limited to 'drivers/gpu/nvgpu/gp106/clk_arb_gp106.c')
-rw-r--r-- | drivers/gpu/nvgpu/gp106/clk_arb_gp106.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/gpu/nvgpu/gp106/clk_arb_gp106.c b/drivers/gpu/nvgpu/gp106/clk_arb_gp106.c index ce0c03b9..2dd5651c 100644 --- a/drivers/gpu/nvgpu/gp106/clk_arb_gp106.c +++ b/drivers/gpu/nvgpu/gp106/clk_arb_gp106.c | |||
@@ -1,5 +1,5 @@ | |||
1 | /* | 1 | /* |
2 | * Copyright (c) 2016-2018, NVIDIA CORPORATION. All rights reserved. | 2 | * Copyright (c) 2016-2021, NVIDIA CORPORATION. All rights reserved. |
3 | * | 3 | * |
4 | * Permission is hereby granted, free of charge, to any person obtaining a | 4 | * Permission is hereby granted, free of charge, to any person obtaining a |
5 | * copy of this software and associated documentation files (the "Software"), | 5 | * copy of this software and associated documentation files (the "Software"), |
@@ -730,8 +730,8 @@ exit_arb: | |||
730 | nvgpu_atomic_set(&dev->poll_mask, | 730 | nvgpu_atomic_set(&dev->poll_mask, |
731 | NVGPU_POLLIN | NVGPU_POLLRDNORM); | 731 | NVGPU_POLLIN | NVGPU_POLLRDNORM); |
732 | nvgpu_clk_arb_event_post_event(dev); | 732 | nvgpu_clk_arb_event_post_event(dev); |
733 | nvgpu_ref_put(&dev->refcount, nvgpu_clk_arb_free_fd); | ||
734 | nvgpu_list_del(&dev->node); | 733 | nvgpu_list_del(&dev->node); |
734 | nvgpu_ref_put(&dev->refcount, nvgpu_clk_arb_free_fd); | ||
735 | } | 735 | } |
736 | nvgpu_spinlock_release(&arb->requests_lock); | 736 | nvgpu_spinlock_release(&arb->requests_lock); |
737 | 737 | ||
@@ -768,4 +768,4 @@ void gp106_clk_arb_cleanup(struct nvgpu_clk_arb *arb) | |||
768 | nvgpu_kfree(g, g->clk_arb); | 768 | nvgpu_kfree(g, g->clk_arb); |
769 | 769 | ||
770 | g->clk_arb = NULL; | 770 | g->clk_arb = NULL; |
771 | } \ No newline at end of file | 771 | } |