mirror of
git://nv-tegra.nvidia.com/linux-nv-oot.git
synced 2025-12-22 09:11:26 +03:00
cc74d1fe1b
nvmap uses pid of group_leader task to indicate a client process. During create_client operation, whenever any client with the same group_leader pid already exists in clients list of nvmap_device, then nvmap increments the count field of nvmap_client struct. Otherwise, create a new nvmap_client. Both of the operations i.e. checking the list for client and incrementing the counter happen inside lock. On the other hand, during nvmap_release, first the counter is decremented and checked if it's zero or not. If it's zero then the lock is taken and client is removed from client list of nvmap_device. As both the operations i.e. decrementing the counter value and removing client from list (if the counter becomes 0) are not happening inside a lock, it's resulting into the following data race scenario. 1) nvmap_release on existing client process 1 - decrement client's counter - counter value has become zero - client is yet to be removed from the dev->clients list - context switch happen to __nvmap_create_client as another namespace/thread with same with same group_leader pid is created. 2) __nvmap_create_client - as the client with same pid exists in dev->client list, it increments counter value to 1, instead of creating a new client struct. - context switch happen to nvmap_release from step 1 3) nvmap_release - It calls destroy_client and remove the client from dev->client list. - Completes rest of the operations in destroy_client and returns. - Context switch to remaining operations from step 2 4) nvmap_release - Now, when the nvmap_release will be called for the thread/namespace which was created in step 2, then list_del operation would fail as the client struct was already removed from dev->client list. Fix the above issue by doing both operations i.e. decrementing the counter value and removing the client struct from dev->client list in a single lock. Bug 4829958 Change-Id: I87ebbcb45b18114d0ec75520443bee010f88d59e Signed-off-by: Ketan Patil <ketanp@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3209794 Reviewed-by: Brad Griffis <bgriffis@nvidia.com> Reviewed-by: Pritesh Raithatha <praithatha@nvidia.com> GVS: buildbot_gerritrpt <buildbot_gerritrpt@nvidia.com> Reviewed-by: Ashish Mhetre <amhetre@nvidia.com>