From 347ad49d35a1c65d509e7ef5b0760e97ede41ec2 Mon Sep 17 00:00:00 2001 From: Thierry Reding Date: Thu, 9 Mar 2017 20:04:56 +0100 Subject: drm/tegra: Protect IOMMU operations by mutex IOMMU support is currently not thread-safe, which can cause crashes, amongst other things, under certain workloads. Signed-off-by: Thierry Reding --- drivers/gpu/drm/tegra/gem.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'drivers/gpu/drm/tegra/gem.c') diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c index 17e62ecb5d4d..050ba78d3fab 100644 --- a/drivers/gpu/drm/tegra/gem.c +++ b/drivers/gpu/drm/tegra/gem.c @@ -128,12 +128,14 @@ static int tegra_bo_iommu_map(struct tegra_drm *tegra, struct tegra_bo *bo) if (!bo->mm) return -ENOMEM; + mutex_lock(&tegra->mm_lock); + err = drm_mm_insert_node_generic(&tegra->mm, bo->mm, bo->gem.size, PAGE_SIZE, 0, 0); if (err < 0) { dev_err(tegra->drm->dev, "out of I/O virtual memory: %zd\n", err); - goto free; + goto unlock; } bo->paddr = bo->mm->start; @@ -147,11 +149,14 @@ static int tegra_bo_iommu_map(struct tegra_drm *tegra, struct tegra_bo *bo) bo->size = err; + mutex_unlock(&tegra->mm_lock); + return 0; remove: drm_mm_remove_node(bo->mm); -free: +unlock: + mutex_unlock(&tegra->mm_lock); kfree(bo->mm); return err; } @@ -161,8 +166,11 @@ static int tegra_bo_iommu_unmap(struct tegra_drm *tegra, struct tegra_bo *bo) if (!bo->mm) return 0; + mutex_lock(&tegra->mm_lock); iommu_unmap(tegra->domain, bo->paddr, bo->size); drm_mm_remove_node(bo->mm); + mutex_unlock(&tegra->mm_lock); + kfree(bo->mm); return 0; -- cgit v1.2.3-55-g7522