nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-22 09:11:26 +03:00
Code Issues Packages Projects Releases Wiki Activity

gpu: host1x: Fix race in syncpt alloc/free

Browse Source 
Fix riace condition between host1x_syncpt_alloc()
and host1x_syncpt_put() by using kref_put_mutex()
instead of kref_put() + manual mutex locking.

This ensures no thread can acquire the
syncpt_mutex after the refcount drops to zero
but before syncpt_release acquires it.
This prevents races where syncpoints could
be allocated while still being cleaned up
from a previous release.

Remove explicit mutex locking in syncpt_release
as kref_put_mutex() handles this atomically.

Bug 5170956

Change-Id: I9e2348482d5c9646556576772f6b90fa7df3acd2
Signed-off-by: Mainak Sen <msen@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3369121
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
GVS: buildbot_gerritrpt <buildbot_gerritrpt@nvidia.com>
This commit is contained in:
Mainak Sen
2025-05-22 05:31:52 +00:00
committed by Jon Hunter
parent fd42ccc45d
commit 3137fbd9b4
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/host1x/syncpt.c
View File

@@ -428,8 +428,6 @@ static void syncpt_release(struct kref *ref)
sp->locked = false; sp->locked = false;
mutex_lock(&sp->host->syncpt_mutex);
#ifdef CONFIG_HOST1X_HAVE_SYNCPT_BASE #ifdef CONFIG_HOST1X_HAVE_SYNCPT_BASE
host1x_syncpt_base_free(sp->base); host1x_syncpt_base_free(sp->base);
sp->base = NULL; sp->base = NULL;
@@ -454,7 +452,7 @@ void host1x_syncpt_put(struct host1x_syncpt *sp)
if (!sp) if (!sp)
return; return;
kref_put(&sp->ref, syncpt_release); kref_put_mutex(&sp->ref, syncpt_release, &sp->host->syncpt_mutex);
} }
EXPORT_SYMBOL(host1x_syncpt_put); EXPORT_SYMBOL(host1x_syncpt_put);