From ce8548ec056022c4feccacc9eb09a4e8619bdefa Mon Sep 17 00:00:00 2001 From: Sagar Kamble Date: Tue, 3 Aug 2021 09:11:33 +0530 Subject: gpu: nvgpu: fix clk_arb completion file private data access race clk_arb completion file descriptor can get closed immediately after poll finishes in the work item gp10b_clk_arb_run_arbiter_cb. In that case, the refcount for nvgpu_clk_dev can become zero in the work item and can lead to invalid access while removing nvgpu_clk_dev from the lists. Remove nvgpu_clk_dev from the list before dropping the reference to it. Also, delete the nvgpu_clk_dev in completion file release handler within the session and requests spinlocks to avoid race with gp10b_clk_arb_run_arbiter_cb using it. bug 200757277 Change-Id: I054eee547f2a6fa633d7ef55df216ec36647a826 Signed-off-by: Sagar Kamble Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvgpu/+/2569522 Tested-by: mobile promotions Reviewed-by: Debarshi Dutta Reviewed-by: Deepak Nibade Reviewed-by: Bibek Basu Reviewed-by: mobile promotions --- drivers/gpu/nvgpu/gp106/clk_arb_gp106.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers/gpu/nvgpu/gp106/clk_arb_gp106.c') diff --git a/drivers/gpu/nvgpu/gp106/clk_arb_gp106.c b/drivers/gpu/nvgpu/gp106/clk_arb_gp106.c index ce0c03b9..2dd5651c 100644 --- a/drivers/gpu/nvgpu/gp106/clk_arb_gp106.c +++ b/drivers/gpu/nvgpu/gp106/clk_arb_gp106.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2016-2018, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2016-2021, NVIDIA CORPORATION. All rights reserved. * * Permission is hereby granted, free of charge, to any person obtaining a * copy of this software and associated documentation files (the "Software"), @@ -730,8 +730,8 @@ exit_arb: nvgpu_atomic_set(&dev->poll_mask, NVGPU_POLLIN | NVGPU_POLLRDNORM); nvgpu_clk_arb_event_post_event(dev); - nvgpu_ref_put(&dev->refcount, nvgpu_clk_arb_free_fd); nvgpu_list_del(&dev->node); + nvgpu_ref_put(&dev->refcount, nvgpu_clk_arb_free_fd); } nvgpu_spinlock_release(&arb->requests_lock); @@ -768,4 +768,4 @@ void gp106_clk_arb_cleanup(struct nvgpu_clk_arb *arb) nvgpu_kfree(g, g->clk_arb); g->clk_arb = NULL; -} \ No newline at end of file +} -- cgit v1.2.2