Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 86135ee1 authored by Rajesh Kemisetti's avatar Rajesh Kemisetti Committed by Gerrit - the friendly Code Review server
Browse files

msm: kgsl: Fix race condition during mem_entry detach 



kgsl_mem_entry_detach_process() makes gpuaddr to NULL and then
removes the entry from mem_idr list.

Sometimes this can cause kgsl_sharedmem_find() to return the
same entry for a different gpuaddr/thread if it satisfies
GPUADDR_IN_MEMDESC().

To avoid this, first remove the entry from mem_idr list and
proceed with unmap/untrack calls.

Change-Id: Ib9f2bc0fdaecd394735dd61b18fdc7de57aa3748
Signed-off-by: default avatarRajesh Kemisetti <rajeshk@codeaurora.org>
parent 53d1dd96

drivers/gpu/msm/kgsl.c

+9 −5
Original line number Diff line number Diff line
@@ -465,11 +465,10 @@ static void kgsl_mem_entry_detach_process(struct kgsl_mem_entry *entry) 
	if (entry == NULL)

		return;



	/* Unmap here so that below we can call kgsl_mmu_put_gpuaddr */

	kgsl_mmu_unmap(entry->memdesc.pagetable, &entry->memdesc);



	kgsl_mem_entry_untrack_gpuaddr(entry->priv, entry);



	/*

	 * First remove the entry from mem_idr list

	 * so that no one can operate on obsolete values

	 */

	spin_lock(&entry->priv->mem_lock);

	if (entry->id != 0)

		idr_remove(&entry->priv->mem_idr, entry->id);
@@ -478,6 +477,11 @@ static void kgsl_mem_entry_detach_process(struct kgsl_mem_entry *entry) 
	type = kgsl_memdesc_usermem_type(&entry->memdesc);

	entry->priv->stats[type].cur -= entry->memdesc.size;

	spin_unlock(&entry->priv->mem_lock);



	kgsl_mmu_unmap(entry->memdesc.pagetable, &entry->memdesc);



	kgsl_mem_entry_untrack_gpuaddr(entry->priv, entry);



	kgsl_process_private_put(entry->priv);



	entry->priv = NULL;