From 7a7d99de04b5c73d239e2f06ea582b31063528ef Mon Sep 17 00:00:00 2001 From: Pankaj Gupta Date: Fri, 19 Feb 2021 17:23:05 +0530 Subject: [PATCH] msm: kgsl: Signal dump_gate only when worker finishes work Currently we are accessing snapshot structure after signaling dump_gate. In corner cases this worker can get preempted before driver reads this variable, and eventually client dumps the snapshot and snapshot object gets released. When worker gets back in execution it will read freed memory and will case kernel panic. To fix this race, do completion for dump_gate after finishing work in worker kgsl_snapshot_save_frozen_objs. Change-Id: Iaf3c9f9e75a6e3e19653d2d166e2da624796ec98 Signed-off-by: Pankaj Gupta Signed-off-by: Deepak Kumar --- drivers/gpu/msm/kgsl_snapshot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/msm/kgsl_snapshot.c b/drivers/gpu/msm/kgsl_snapshot.c index 2dc91e5986a9..40809f909ffe 100644 --- a/drivers/gpu/msm/kgsl_snapshot.c +++ b/drivers/gpu/msm/kgsl_snapshot.c @@ -1331,7 +1331,7 @@ done: snapshot->ib2base); gmu_only: - complete_all(&snapshot->dump_gate); BUG_ON(!snapshot->device->skip_ib_capture && snapshot->device->force_panic); + complete_all(&snapshot->dump_gate); }