]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
gpu: host1x: Fix race in syncpt alloc/free
authorMainak Sen <msen@nvidia.com>
Mon, 7 Jul 2025 09:17:39 +0000 (18:17 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 18 Dec 2025 13:02:25 +0000 (14:02 +0100)
commit79197c6007f2afbfd7bcf5b9b80ccabf8483d774
treef63d7a2fb8b48598e3e4b6b4ece2b5e5af0403bc
parentcf008f5bd3d5db210d1edd244e7cd1d879cb1a5e
gpu: host1x: Fix race in syncpt alloc/free

[ Upstream commit c7d393267c497502fa737607f435f05dfe6e3d9b ]

Fix race condition between host1x_syncpt_alloc()
and host1x_syncpt_put() by using kref_put_mutex()
instead of kref_put() + manual mutex locking.

This ensures no thread can acquire the
syncpt_mutex after the refcount drops to zero
but before syncpt_release acquires it.
This prevents races where syncpoints could
be allocated while still being cleaned up
from a previous release.

Remove explicit mutex locking in syncpt_release
as kref_put_mutex() handles this atomically.

Signed-off-by: Mainak Sen <msen@nvidia.com>
Fixes: f5ba33fb9690 ("gpu: host1x: Reserve VBLANK syncpoints at initialization")
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20250707-host1x-syncpt-race-fix-v1-1-28b0776e70bc@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/gpu/host1x/syncpt.c