From 2db040946ff8340485b2b33fe5a46f3166fa96f6 Mon Sep 17 00:00:00 2001 From: Debarshi Dutta Date: Wed, 21 Jun 2017 16:15:09 +0530 Subject: gpu: nvgpu: Remove IOCTL FREE_OBJ_CTX We have never used the IOCTL FREE_OBJ_CTX. Using it leads to context being only partially available, and can lead to use-after-free. Bug 1885775 Change-Id: I9d2b632ab79760f8186d02e0f35861b3a6aae649 Signed-off-by: Debarshi Dutta Reviewed-on: https://git-master.nvidia.com/r/1506479 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu --- drivers/gpu/nvgpu/gk20a/channel_gk20a.c | 14 +------------- drivers/gpu/nvgpu/gk20a/channel_gk20a.h | 3 +-- drivers/gpu/nvgpu/gk20a/gr_gk20a.c | 28 +--------------------------- drivers/gpu/nvgpu/gk20a/gr_gk20a.h | 5 +---- include/linux/nvhost_ioctl.h | 8 +------- 5 files changed, 5 insertions(+), 53 deletions(-) diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c index 947b1dc668bf..3065e8403559 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c @@ -3,7 +3,7 @@ * * GK20A Graphics channel * - * Copyright (c) 2011-2015, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -2066,18 +2066,6 @@ long gk20a_channel_ioctl(struct file *filp, (struct nvhost_alloc_obj_ctx_args *)buf); gk20a_idle(dev); break; - case NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX: - err = gk20a_busy(dev); - if (err) { - dev_err(&dev->dev, - "%s: failed to host gk20a for ioctl cmd: 0x%x", - __func__, cmd); - return err; - } - err = gk20a_free_obj_ctx(ch, - (struct nvhost_free_obj_ctx_args *)buf); - gk20a_idle(dev); - break; case NVHOST_IOCTL_CHANNEL_ALLOC_GPFIFO: err = gk20a_busy(dev); if (err) { diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.h b/drivers/gpu/nvgpu/gk20a/channel_gk20a.h index 547bb064fd63..831db0f4986a 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.h +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.h @@ -3,7 +3,7 @@ * * GK20A graphics channel * - * Copyright (c) 2011-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -98,7 +98,6 @@ struct channel_gk20a { u64 userd_iova; u64 userd_gpu_va; - s32 num_objects; u32 obj_class; /* we support only one obj per channel */ struct priv_cmd_queue priv_cmd_q; diff --git a/drivers/gpu/nvgpu/gk20a/gr_gk20a.c b/drivers/gpu/nvgpu/gk20a/gr_gk20a.c index 9e032e03a153..d5a3bbd34a78 100644 --- a/drivers/gpu/nvgpu/gk20a/gr_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/gr_gk20a.c @@ -1,7 +1,7 @@ /* * GK20A Graphics * - * Copyright (c) 2011-2015, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -2697,7 +2697,6 @@ void gk20a_free_channel_ctx(struct channel_gk20a *c) memset(&c->ch_ctx, 0, sizeof(struct channel_ctx_gk20a)); - c->num_objects = 0; c->first_init = false; } @@ -2848,8 +2847,6 @@ int gk20a_alloc_obj_ctx(struct channel_gk20a *c, c->first_init = true; } - c->num_objects++; - gk20a_dbg_fn("done"); return 0; out: @@ -2861,29 +2858,6 @@ out: return err; } -int gk20a_free_obj_ctx(struct channel_gk20a *c, - struct nvhost_free_obj_ctx_args *args) -{ - unsigned long timeout = gk20a_get_gr_idle_timeout(c->g); - - gk20a_dbg_fn(""); - - if (c->num_objects == 0) - return 0; - - c->num_objects--; - - if (c->num_objects == 0) { - c->first_init = false; - gk20a_disable_channel(c, - !c->has_timedout, - timeout); - gr_gk20a_unmap_channel_patch_ctx(c); - } - - return 0; -} - static void gk20a_remove_gr_support(struct gr_gk20a *gr) { struct gk20a *g = gr->g; diff --git a/drivers/gpu/nvgpu/gk20a/gr_gk20a.h b/drivers/gpu/nvgpu/gk20a/gr_gk20a.h index 2a31aa0b830f..526eefb46b6f 100644 --- a/drivers/gpu/nvgpu/gk20a/gr_gk20a.h +++ b/drivers/gpu/nvgpu/gk20a/gr_gk20a.h @@ -1,7 +1,7 @@ /* * GK20A Graphics Engine * - * Copyright (c) 2011-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -324,12 +324,9 @@ int gk20a_init_gr_channel(struct channel_gk20a *ch_gk20a); int gr_gk20a_init_ctx_vars(struct gk20a *g, struct gr_gk20a *gr); struct nvhost_alloc_obj_ctx_args; -struct nvhost_free_obj_ctx_args; int gk20a_alloc_obj_ctx(struct channel_gk20a *c, struct nvhost_alloc_obj_ctx_args *args); -int gk20a_free_obj_ctx(struct channel_gk20a *c, - struct nvhost_free_obj_ctx_args *args); void gk20a_free_channel_ctx(struct channel_gk20a *c); int gk20a_gr_isr(struct gk20a *g); diff --git a/include/linux/nvhost_ioctl.h b/include/linux/nvhost_ioctl.h index b060864ff1d1..a1011e5a1daf 100644 --- a/include/linux/nvhost_ioctl.h +++ b/include/linux/nvhost_ioctl.h @@ -3,7 +3,7 @@ * * Tegra graphics host driver * - * Copyright (c) 2009-2014, NVIDIA Corporation. All rights reserved. + * Copyright (c) 2009-2017, NVIDIA Corporation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -118,10 +118,6 @@ struct nvhost_alloc_obj_ctx_args { __u64 obj_id; /* output, used to free later */ }; -struct nvhost_free_obj_ctx_args { - __u64 obj_id; /* obj ctx to free */ -}; - struct nvhost_alloc_gpfifo_args { __u32 num_entries; #define NVHOST_ALLOC_GPFIFO_FLAGS_VPR_ENABLED (1 << 0) /* set owner channel of this gpfifo as a vpr channel */ @@ -390,8 +386,6 @@ struct nvhost_set_ctxswitch_args { _IOWR(NVHOST_IOCTL_MAGIC, 107, struct nvhost_submit_gpfifo_args) #define NVHOST_IOCTL_CHANNEL_ALLOC_OBJ_CTX \ _IOWR(NVHOST_IOCTL_MAGIC, 108, struct nvhost_alloc_obj_ctx_args) -#define NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX \ - _IOR(NVHOST_IOCTL_MAGIC, 109, struct nvhost_free_obj_ctx_args) #define NVHOST_IOCTL_CHANNEL_ZCULL_BIND \ _IOWR(NVHOST_IOCTL_MAGIC, 110, struct nvhost_zcull_bind_args) #define NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER \ -- cgit v1.2.3