Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

sync_file: Protect access to driver and timeline name 

Protect the access to driver and timeline name which otherwise could be
freed as dma-fence exported is signalling fences.

This prepares the code for incoming dma-fence API changes which will start
asserting these accesses are done from a RCU locked section.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20250610164226.10817-2-tvrtko.ursulin@igalia.com
This commit is contained in:
Tvrtko Ursulin 2025-06-10 17:42:23 +01:00 committed by Tvrtko Ursulin
parent a979a54165
commit ad10976d6c
1 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/dma-buf/sync_file.c
View File

@ -135,12 +135,18 @@ char *sync_file_get_name(struct sync_file *sync_file, char *buf, int len)
strscpy(buf, sync_file->user_name, len); strscpy(buf, sync_file->user_name, len);
} else { } else {
struct dma_fence *fence = sync_file->fence; struct dma_fence *fence = sync_file->fence;
const char __rcu *timeline;
const char __rcu *driver;
rcu_read_lock();
driver = dma_fence_driver_name(fence);
timeline = dma_fence_timeline_name(fence);
snprintf(buf, len, "%s-%s%llu-%lld", snprintf(buf, len, "%s-%s%llu-%lld",
dma_fence_driver_name(fence), rcu_dereference(driver),
dma_fence_timeline_name(fence), rcu_dereference(timeline),
fence->context, fence->context,
fence->seqno); fence->seqno);
rcu_read_unlock();
} }
return buf; return buf;
@ -262,9 +268,17 @@ static long sync_file_ioctl_merge(struct sync_file *sync_file,
static int sync_fill_fence_info(struct dma_fence *fence, static int sync_fill_fence_info(struct dma_fence *fence,
struct sync_fence_info *info) struct sync_fence_info *info)
{ {
strscpy(info->obj_name, dma_fence_timeline_name(fence), const char __rcu *timeline;
const char __rcu *driver;
rcu_read_lock();
driver = dma_fence_driver_name(fence);
timeline = dma_fence_timeline_name(fence);
strscpy(info->obj_name, rcu_dereference(timeline),
sizeof(info->obj_name)); sizeof(info->obj_name));
strscpy(info->driver_name, dma_fence_driver_name(fence), strscpy(info->driver_name, rcu_dereference(driver),
sizeof(info->driver_name)); sizeof(info->driver_name));
info->status = dma_fence_get_status(fence); info->status = dma_fence_get_status(fence);
@ -273,6 +287,8 @@ static int sync_fill_fence_info(struct dma_fence *fence,
ktime_to_ns(dma_fence_timestamp(fence)) : ktime_to_ns(dma_fence_timestamp(fence)) :
ktime_set(0, 0); ktime_set(0, 0);
rcu_read_unlock();
return info->status; return info->status;
} }