Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 20c8f1c3 authored by Sunil Khatri's avatar Sunil Khatri
Browse files

msm: kgsl: Fix kgsl memory allocation and free race condition 



When allocating userspace memory keep reference to memory
allocation till it is completely initialized and info is sent back
to userspace.

Change-Id: Id72c82bf98c094ecbd4722813c732a998dcbb188
Signed-off-by: default avatarTarun Karra <tkarra@codeaurora.org>
Signed-off-by: default avatarSunil Khatri <sunilkh@codeaurora.org>
parent fb9375d2

drivers/gpu/msm/kgsl.c

+16 −1
Original line number Diff line number Diff line
@@ -250,8 +250,11 @@ kgsl_mem_entry_create(void) 
{

	struct kgsl_mem_entry *entry = kzalloc(sizeof(*entry), GFP_KERNEL);



	if (entry != NULL)

	if (entry != NULL) {

		kref_init(&entry->refcount);

		/* put this ref in the caller functions after init */

		kref_get(&entry->refcount);

	}



	return entry;

}
@@ -2300,6 +2303,9 @@ long kgsl_ioctl_gpuobj_import(struct kgsl_device_private *dev_priv, 
	trace_kgsl_mem_map(entry, fd);



	kgsl_mem_entry_commit_process(entry);



	/* put the extra refcount for kgsl_mem_entry_create() */

	kgsl_mem_entry_put(entry);

	return 0;



unmap:
@@ -2606,6 +2612,9 @@ long kgsl_ioctl_map_user_mem(struct kgsl_device_private *dev_priv, 
	trace_kgsl_mem_map(entry, param->fd);



	kgsl_mem_entry_commit_process(entry);



	/* put the extra refcount for kgsl_mem_entry_create() */

	kgsl_mem_entry_put(entry);

	return result;



error_attach:
@@ -3044,6 +3053,8 @@ long kgsl_ioctl_gpuobj_alloc(struct kgsl_device_private *dev_priv, 
	param->mmapsize = kgsl_memdesc_footprint(&entry->memdesc);

	param->id = entry->id;



	/* put the extra refcount for kgsl_mem_entry_create() */

	kgsl_mem_entry_put(entry);

	return 0;

}
@@ -3067,6 +3078,8 @@ long kgsl_ioctl_gpumem_alloc(struct kgsl_device_private *dev_priv, 
	param->size = (size_t) entry->memdesc.size;

	param->flags = (unsigned int) entry->memdesc.flags;



	/* put the extra refcount for kgsl_mem_entry_create() */

	kgsl_mem_entry_put(entry);

	return 0;

}
@@ -3090,6 +3103,8 @@ long kgsl_ioctl_gpumem_alloc_id(struct kgsl_device_private *dev_priv, 
	param->mmapsize = (size_t) kgsl_memdesc_footprint(&entry->memdesc);

	param->gpuaddr = (unsigned long) entry->memdesc.gpuaddr;



	/* put the extra refcount for kgsl_mem_entry_create() */

	kgsl_mem_entry_put(entry);

	return 0;

}