diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-09-21 18:12:17 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-09-21 18:12:17 -0400 |
| commit | 256c5308423befddc20bdf7e59a663f3f1b683ae (patch) | |
| tree | ba8acb7489cf6c59720eba2cd627ed2befee470e /kernel/gsp_rm_emulation.c | |
| parent | 4266fffc45352bee58323b7903354df00b3df03d (diff) | |
| download | open-iov-256c5308423befddc20bdf7e59a663f3f1b683ae.tar.gz open-iov-256c5308423befddc20bdf7e59a663f3f1b683ae.zip | |
kernel: Fix gsp_emu_cleanup crash on dead thread (refcount saturation)
Root cause: when the gsp_emu thread crashes (e.g. fortify_panic in
gsp_rm_send), the kernel kills it. Later, gsp_emu_cleanup() calls
kthread_stop() on the dead thread, hitting refcount_warn_saturate
on the freed/saturated task_struct.
Fixes:
1. pid_alive() check before kthread_stop() - skip if thread already dead
2. get_task_struct() after kthread_run() - hold reference so the
task_struct stays valid even after a crash
3. put_task_struct() in cleanup - release the reference
This prevents the module from getting stuck in 'going' state during
mdev removal after a gsp_emu thread crash.
Diffstat (limited to 'kernel/gsp_rm_emulation.c')
0 files changed, 0 insertions, 0 deletions
