diff options
| author | Alex Waterman <alexw@nvidia.com> | 2016-10-13 10:03:59 -0700 |
|---|---|---|
| committer | Winnie Hsu <whsu@nvidia.com> | 2018-03-26 11:37:57 -0700 |
| commit | 763ada650d0d24dde8d4ec90f665f16c8d7edab7 (patch) | |
| tree | ee35ea8b75a4222d9c8c38ea4a0372c8e8a2de13 /drivers/gpu | |
| parent | 7b67aa2c06e6906c6c190aabb1fa9722fd3cfb36 (diff) | |
gpu: nvgpu: Add ref counting to channels
Make sure that the VM owned by a channel lives for at least
as long as that channel does. If the channel's VM is cleaned
up before the channel then use-after-free bugs can occur.
Bug: 31680980
NvBug 1825464
Bug: 1885921
Change-Id: I0711781492a764b643c2ed1da1b3ba87fda72744
Signed-off-by: Alex Waterman <alexw@nvidia.com>
Reviewed-on: https://git-psac.nvidia.com/r/#/c/9261
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
(cherry picked from commit e205f2720fcee61886e7979e9588602d691507ea)
Reviewed-on: https://git-master.nvidia.com/r/1681801
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/nvgpu/gk20a/channel_gk20a.c | 5 | ||||
| -rw-r--r-- | drivers/gpu/nvgpu/gk20a/mm_gk20a.c | 1 |
2 files changed, 4 insertions, 2 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c index 947b1dc668bf..0a48f6a551ae 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c @@ -669,7 +669,7 @@ void gk20a_free_channel(struct channel_gk20a *ch, bool finish) memset(&ch->ramfc, 0, sizeof(struct mem_desc_sub)); /* free gpfifo */ - if (ch->gpfifo.gpu_va) + if (ch->vm && ch->gpfifo.gpu_va) gk20a_gmmu_unmap(ch_vm, ch->gpfifo.gpu_va, ch->gpfifo.size, gk20a_mem_flag_none); if (ch->gpfifo.cpu_va) @@ -698,8 +698,9 @@ unbind: channel_gk20a_unbind(ch); channel_gk20a_free_inst(g, ch); - ch->vpr = false; + gk20a_vm_put(ch->vm); /* Don't use VM after this. */ ch->vm = NULL; + ch->vpr = false; WARN_ON(ch->sync); /* unlink all debug sessions */ diff --git a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c index 59dc3656f486..5a828d394bfc 100644 --- a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c @@ -2427,6 +2427,7 @@ int gk20a_vm_bind_channel(struct gk20a_as_share *as_share, gk20a_dbg_fn(""); + gk20a_vm_get(vm); ch->vm = vm; err = channel_gk20a_commit_va(ch); if (err) |