gpu: nvgpu: fix crash in gk20a_channel_release

gk20a_channel_release() should bail if filp->private_data is
NULL. This can happen as a result of gk20a_channel_release()
being called when __gk20a_channel_open() fails in
NVHOST_IOCTL_CHANNEL_OPEN.

Bug 200014898

Change-Id: I32cc957aca46fcd4265a8052ac5be355b644b9f7
Signed-off-by: Aingara Paramakuru <aparamakuru@nvidia.com>
Reviewed-on: http://git-master/r/496138
(cherry picked from commit cb0db6618c42ab4c33574f09f212ab1ee9a0438a)
Reviewed-on: http://git-master/r/1258588
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
Tested-by: Winnie Hsu <whsu@nvidia.com>

diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
index 19156d6921d13ea433c566ee656eeeeb2a36163d..947b1dc668bf249e4810a8a9da93e4490022ad80 100644 (file)
--- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
+++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
@@ -719,9 +719,12 @@ unbind:
 int gk20a_channel_release(struct inode *inode, struct file *filp)
 {
        struct channel_gk20a *ch = (struct channel_gk20a *)filp->private_data;
-       struct gk20a *g = ch->g;
+       struct gk20a *g = ch ? ch->g : NULL;
        int err;
 
+       if (!ch)
+               return 0;
+
        trace_gk20a_channel_release(dev_name(&g->dev->dev));
 
        err = gk20a_busy(ch->g->dev);