From 17451138cf60f5d64eed88cc5defd44981926d9d Mon Sep 17 00:00:00 2001 From: Konsta Holtta Date: Thu, 31 Aug 2017 13:01:26 +0300 Subject: gpu: nvgpu: hold ch ref when getting ch from fd Fix a race condition in gk20a_get_channel_from_file() that returns a channel pointer from an fd: take a reference to the channel before putting the file ref back. Now the caller is responsible of releasing the channel reference eventually. Also document why dbg_session_channel_data has to hold a ref to the channel file instead of just the channel: that might deadlock if the fds were closed in "wrong" order. Change-Id: I8e91b809f5f7b1cb0c1487bd955ad6d643727a53 Signed-off-by: Konsta Holtta Reviewed-on: https://git-master.nvidia.com/r/1549290 Reviewed-by: mobile promotions Tested-by: mobile promotions --- drivers/gpu/nvgpu/common/linux/ioctl_as.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'drivers/gpu/nvgpu/common/linux/ioctl_as.c') diff --git a/drivers/gpu/nvgpu/common/linux/ioctl_as.c b/drivers/gpu/nvgpu/common/linux/ioctl_as.c index 6fd0a3d2..d4242955 100644 --- a/drivers/gpu/nvgpu/common/linux/ioctl_as.c +++ b/drivers/gpu/nvgpu/common/linux/ioctl_as.c @@ -42,14 +42,19 @@ static int gk20a_as_ioctl_bind_channel( gk20a_dbg_fn(""); ch = gk20a_get_channel_from_file(args->channel_fd); - if (!ch || gk20a_channel_as_bound(ch)) + if (!ch) return -EINVAL; + if (gk20a_channel_as_bound(ch)) { + err = -EINVAL; + goto out; + } + /* this will set channel_gk20a->vm */ err = ch->g->ops.mm.vm_bind_channel(as_share, ch); - if (err) - return err; +out: + gk20a_channel_put(ch); return err; } -- cgit v1.2.2