gpu: nvgpu: Remove IOCTL FREE_OBJ_CTX

We have never used the IOCTL FREE_OBJ_CTX. Using it leads to context being
only partially available, and can lead to use-after-free.

Bug 1885775

Change-Id: I9d2b632ab79760f8186d02e0f35861b3a6aae649
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1506479
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>

5 files changed, 5 insertions, 53 deletions

diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
index 947b1dc668bf..3065e8403559 100644
--- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
+++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
@@ -3,7 +3,7 @@
  *
  * GK20A Graphics channel
  *
- * Copyright (c) 2011-2015, NVIDIA CORPORATION.  All rights reserved.
+ * Copyright (c) 2011-2017, NVIDIA CORPORATION.  All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -2066,18 +2066,6 @@ long gk20a_channel_ioctl(struct file *filp,
 				(struct nvhost_alloc_obj_ctx_args *)buf);
 		gk20a_idle(dev);
 		break;
-	case NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX:
-		err = gk20a_busy(dev);
-		if (err) {
-			dev_err(&dev->dev,
-				"%s: failed to host gk20a for ioctl cmd: 0x%x",
-				__func__, cmd);
-			return err;
-		}
-		err = gk20a_free_obj_ctx(ch,
-				(struct nvhost_free_obj_ctx_args *)buf);
-		gk20a_idle(dev);
-		break;
 	case NVHOST_IOCTL_CHANNEL_ALLOC_GPFIFO:
 		err = gk20a_busy(dev);
 		if (err) {
diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.h b/drivers/gpu/nvgpu/gk20a/channel_gk20a.h
index 547bb064fd63..831db0f4986a 100644
--- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.h
+++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.h
@@ -3,7 +3,7 @@
  *
  * GK20A graphics channel
  *
- * Copyright (c) 2011-2014, NVIDIA CORPORATION.  All rights reserved.
+ * Copyright (c) 2011-2017, NVIDIA CORPORATION.  All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -98,7 +98,6 @@ struct channel_gk20a {
 	u64 userd_iova;
 	u64 userd_gpu_va;
 
-	s32 num_objects;
 	u32 obj_class;	/* we support only one obj per channel */
 
 	struct priv_cmd_queue priv_cmd_q;
diff --git a/drivers/gpu/nvgpu/gk20a/gr_gk20a.c b/drivers/gpu/nvgpu/gk20a/gr_gk20a.c
index 9e032e03a153..d5a3bbd34a78 100644
--- a/drivers/gpu/nvgpu/gk20a/gr_gk20a.c
+++ b/drivers/gpu/nvgpu/gk20a/gr_gk20a.c
@@ -1,7 +1,7 @@
 /*
  * GK20A Graphics
  *
- * Copyright (c) 2011-2015, NVIDIA CORPORATION.  All rights reserved.
+ * Copyright (c) 2011-2017, NVIDIA CORPORATION.  All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -2697,7 +2697,6 @@ void gk20a_free_channel_ctx(struct channel_gk20a *c)
 
 	memset(&c->ch_ctx, 0, sizeof(struct channel_ctx_gk20a));
 
-	c->num_objects = 0;
 	c->first_init = false;
 }
 
@@ -2848,8 +2847,6 @@ int gk20a_alloc_obj_ctx(struct channel_gk20a  *c,
 		c->first_init = true;
 	}
 
-	c->num_objects++;
-
 	gk20a_dbg_fn("done");
 	return 0;
 out:
@@ -2861,29 +2858,6 @@ out:
 	return err;
 }
 
-int gk20a_free_obj_ctx(struct channel_gk20a  *c,
-		       struct nvhost_free_obj_ctx_args *args)
-{
-	unsigned long timeout = gk20a_get_gr_idle_timeout(c->g);
-
-	gk20a_dbg_fn("");
-
-	if (c->num_objects == 0)
-		return 0;
-
-	c->num_objects--;
-
-	if (c->num_objects == 0) {
-		c->first_init = false;
-		gk20a_disable_channel(c,
-			!c->has_timedout,
-			timeout);
-		gr_gk20a_unmap_channel_patch_ctx(c);
-	}
-
-	return 0;
-}
-
 static void gk20a_remove_gr_support(struct gr_gk20a *gr)
 {
 	struct gk20a *g = gr->g;
diff --git a/drivers/gpu/nvgpu/gk20a/gr_gk20a.h b/drivers/gpu/nvgpu/gk20a/gr_gk20a.h
index 2a31aa0b830f..526eefb46b6f 100644
--- a/drivers/gpu/nvgpu/gk20a/gr_gk20a.h
+++ b/drivers/gpu/nvgpu/gk20a/gr_gk20a.h
@@ -1,7 +1,7 @@
 /*
  * GK20A Graphics Engine
  *
- * Copyright (c) 2011-2014, NVIDIA CORPORATION.  All rights reserved.
+ * Copyright (c) 2011-2017, NVIDIA CORPORATION.  All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -324,12 +324,9 @@ int gk20a_init_gr_channel(struct channel_gk20a *ch_gk20a);
 int gr_gk20a_init_ctx_vars(struct gk20a *g, struct gr_gk20a *gr);
 
 struct nvhost_alloc_obj_ctx_args;
-struct nvhost_free_obj_ctx_args;
 
 int gk20a_alloc_obj_ctx(struct channel_gk20a *c,
 			struct nvhost_alloc_obj_ctx_args *args);
-int gk20a_free_obj_ctx(struct channel_gk20a *c,
-			struct nvhost_free_obj_ctx_args *args);
 void gk20a_free_channel_ctx(struct channel_gk20a *c);
 
 int gk20a_gr_isr(struct gk20a *g);
diff --git a/include/linux/nvhost_ioctl.h b/include/linux/nvhost_ioctl.h
index b060864ff1d1..a1011e5a1daf 100644
--- a/include/linux/nvhost_ioctl.h
+++ b/include/linux/nvhost_ioctl.h
@@ -3,7 +3,7 @@
  *
  * Tegra graphics host driver
  *
- * Copyright (c) 2009-2014, NVIDIA Corporation.  All rights reserved.
+ * Copyright (c) 2009-2017, NVIDIA Corporation.  All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -118,10 +118,6 @@ struct nvhost_alloc_obj_ctx_args {
 	__u64 obj_id;    /* output, used to free later       */
 };
 
-struct nvhost_free_obj_ctx_args {
-	__u64 obj_id; /* obj ctx to free */
-};
-
 struct nvhost_alloc_gpfifo_args {
 	__u32 num_entries;
 #define NVHOST_ALLOC_GPFIFO_FLAGS_VPR_ENABLED	(1 << 0) /* set owner channel of this gpfifo as a vpr channel */
@@ -390,8 +386,6 @@ struct nvhost_set_ctxswitch_args {
 	_IOWR(NVHOST_IOCTL_MAGIC, 107, struct nvhost_submit_gpfifo_args)
 #define NVHOST_IOCTL_CHANNEL_ALLOC_OBJ_CTX	\
 	_IOWR(NVHOST_IOCTL_MAGIC, 108, struct nvhost_alloc_obj_ctx_args)
-#define NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX	\
-	_IOR(NVHOST_IOCTL_MAGIC,  109, struct nvhost_free_obj_ctx_args)
 #define NVHOST_IOCTL_CHANNEL_ZCULL_BIND		\
 	_IOWR(NVHOST_IOCTL_MAGIC, 110, struct nvhost_zcull_bind_args)
 #define NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER  \