GitHub PushEvent at 2014-07-04 01:29:54
Repository: n5kernel
Actor: hohoxu
Payload: {"shas":[["1b226c394ad779c1ef073f9eba63ef624a4cc402","bec49d6bbc8eef9fde5fca0b80b483432bd597ca@codeaurora.org","USB: msm_otg: Process HOST disconnect only after system RESUME","Saket Saurabh",true],["4799d38e82b041fa14cd80c8576a8e6fd5dd824c","32f41aacb8b63fec32f7001294b88acbe16ae776@codeaurora.org","msm: kgsl: Take the pagetable reference count only when needed\n\nThere could be a race condition where one thread is iterating\nover ptlist inside kgsl_get_pagetable() with spinlock acquired\nand going to call kref_put(). At the same time another thread is\ninside kgsl_put_pagetable() without any spinlock calls kref_put()\nand returns without calling kgsl_destroy_pagetable(). The decrement\nof refcount by second thread leads to a situation where first thread\nenters kgsl_destroy_pagetable_locked() and hence destroying the pt\nnode from list. This causes the destroyed pt node's next and prev\npointers set to POISON value resulting in kernel panic while executing\nnext iteration of ptlist.\n\nTaking pt refcount while iterating over ptlist should be avoided if the\nspinlock is already held and the pt is not returned to the caller. In\nkgsl_get_pagetable(), since the loop is already holding the mutex, it\nis safe to look at pt before taking a reference.\n\nCRs-Fixed: 661374\nChange-Id: Ide1f57cc1eb3cbf66fa399b6b72491755b999c7a\nSigned-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>","Prabhat Awasthi",true]],"size":2,"ref":"refs/heads/n5stable","head":"4799d38e82b041fa14cd80c8576a8e6fd5dd824c"}