diff options
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/gsp_emulation.c | 21 |
1 files changed, 17 insertions, 4 deletions
diff --git a/kernel/gsp_emulation.c b/kernel/gsp_emulation.c index f96e521..3b6f6e5 100644 --- a/kernel/gsp_emulation.c +++ b/kernel/gsp_emulation.c @@ -575,6 +575,10 @@ int gsp_emu_init(struct nv_vgpu_device *vgpu) nv_vgpu_err(vgpu, "Failed to start GSP emulation thread: %d", ret); goto err_fini_client; } + /* Hold a reference on the thread's task_struct so it stays valid + * even if the thread crashes (e.g. fortify_panic). Without this, + * cleanup could dereference a freed task_struct. */ + get_task_struct(ctx->thread); ctx->running = true; ctx->initialized = true; @@ -604,11 +608,20 @@ void gsp_emu_cleanup(struct nv_vgpu_device *vgpu) /* Stop emulation thread with timeout */ if (ctx->thread) { ctx->stopping = true; - kthread_stop(ctx->thread); - /* Wait for thread to actually stop with timeout (5 seconds) */ - if (!wait_for_completion_timeout(&ctx->thread_stopped, msecs_to_jiffies(5000))) { - nv_vgpu_warn(vgpu, "GSP emulation thread did not stop in time, forcing cleanup"); + /* Only call kthread_stop() if the thread is still alive. + * If the thread crashed (e.g. fortify_panic), the kernel already + * killed it and kthread_stop() would hit a refcount saturation + * warning on the dead task_struct. */ + if (pid_alive(ctx->thread)) { + kthread_stop(ctx->thread); + /* Wait for thread to actually stop with timeout (5 seconds) */ + if (!wait_for_completion_timeout(&ctx->thread_stopped, msecs_to_jiffies(5000))) { + nv_vgpu_warn(vgpu, "GSP emulation thread did not stop in time, forcing cleanup"); + } + } else { + nv_vgpu_warn(vgpu, "GSP emulation thread already dead (crashed), skipping kthread_stop"); } + put_task_struct(ctx->thread); ctx->thread = NULL; } ctx->running = false; |