mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-25 10:19:47 +00:00
dma-buf/sw_sync: Synchronize signal vs syncpt free
During release of the syncpt, we remove it from the list of syncpt and the tree, but only if it is not already been removed. However, during signaling, we first remove the syncpt from the list. So, if we concurrently free and signal the syncpt, the free may decide that it is not part of the tree and immediately free itself -- meanwhile the signaler goes on to use the now freed datastructure. In particular, we get struck by commit0e2f733add
("dma-buf: make dma_fence structure a bit smaller v2") as the cb_list is immediately clobbered by the kfree_rcu. v2: Avoid calling into timeline_fence_release() from under the spinlock Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111381 Fixes:d3862e44da
("dma-buf/sw-sync: Fix locking around sync_timeline lists") References:0e2f733add
("dma-buf: make dma_fence structure a bit smaller v2") Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Sumit Semwal <sumit.semwal@linaro.org> Cc: Sean Paul <seanpaul@chromium.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Christian König <christian.koenig@amd.com> Cc: <stable@vger.kernel.org> # v4.14+ Acked-by: Christian König <christian.koenig@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190812154247.20508-1-chris@chris-wilson.co.uk
This commit is contained in:
parent
1c2b93902f
commit
d3c6dd1fb3
1 changed files with 7 additions and 9 deletions
|
@ -132,8 +132,6 @@ static void timeline_fence_release(struct dma_fence *fence)
|
||||||
{
|
{
|
||||||
struct sync_pt *pt = dma_fence_to_sync_pt(fence);
|
struct sync_pt *pt = dma_fence_to_sync_pt(fence);
|
||||||
struct sync_timeline *parent = dma_fence_parent(fence);
|
struct sync_timeline *parent = dma_fence_parent(fence);
|
||||||
|
|
||||||
if (!list_empty(&pt->link)) {
|
|
||||||
unsigned long flags;
|
unsigned long flags;
|
||||||
|
|
||||||
spin_lock_irqsave(fence->lock, flags);
|
spin_lock_irqsave(fence->lock, flags);
|
||||||
|
@ -142,7 +140,6 @@ static void timeline_fence_release(struct dma_fence *fence)
|
||||||
rb_erase(&pt->node, &parent->pt_tree);
|
rb_erase(&pt->node, &parent->pt_tree);
|
||||||
}
|
}
|
||||||
spin_unlock_irqrestore(fence->lock, flags);
|
spin_unlock_irqrestore(fence->lock, flags);
|
||||||
}
|
|
||||||
|
|
||||||
sync_timeline_put(parent);
|
sync_timeline_put(parent);
|
||||||
dma_fence_free(fence);
|
dma_fence_free(fence);
|
||||||
|
@ -265,7 +262,8 @@ static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
|
||||||
p = &parent->rb_left;
|
p = &parent->rb_left;
|
||||||
} else {
|
} else {
|
||||||
if (dma_fence_get_rcu(&other->base)) {
|
if (dma_fence_get_rcu(&other->base)) {
|
||||||
dma_fence_put(&pt->base);
|
sync_timeline_put(obj);
|
||||||
|
kfree(pt);
|
||||||
pt = other;
|
pt = other;
|
||||||
goto unlock;
|
goto unlock;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue