linux-stable/drivers/dma-buf
Rob Clark 0df5eaab03 dma-buf/sw_sync: Avoid recursive lock during fence signal
[ Upstream commit e531fdb5cd ]

If a signal callback releases the sw_sync fence, that will trigger a
deadlock as the timeline_fence_release recurses onto the fence->lock
(used both for signaling and the the timeline tree).

To avoid that, temporarily hold an extra reference to the signalled
fences until after we drop the lock.

(This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/
which avoids some potential UAF issues with the original patch.)

v2: Remove now obsolete comment, use list_move_tail() and
    list_del_init()

Reported-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Fixes: d3c6dd1fb3 ("dma-buf/sw_sync: Synchronize signal vs syncpt free")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230818145939.39697-1-robdclark@gmail.com
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-30 16:23:19 +02:00
..
heaps dma-mapping updates for 5.10 2020-10-15 14:43:29 -07:00
Kconfig dma-buf: DMABUF_MOVE_NOTIFY should depend on DMA_SHARED_BUFFER 2021-09-26 14:08:59 +02:00
Makefile
dma-buf.c dma-buf: WARN on dmabuf release with pending attachments 2021-11-18 14:03:52 +01:00
dma-fence-array.c dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() 2022-01-27 10:53:43 +01:00
dma-fence-chain.c
dma-fence.c
dma-heap.c dma-buf: fix racing conflict of dma_heap_add() 2022-12-02 17:40:01 +01:00
dma-resv.c dma-buf/dma-resv: Respect num_fences when initializing the shared fence list. 2020-12-30 11:54:26 +01:00
selftest.c
selftest.h
selftests.h
seqno-fence.c
st-dma-fence-chain.c
st-dma-fence.c
sw_sync.c dma-buf/sw_sync: Avoid recursive lock during fence signal 2023-08-30 16:23:19 +02:00
sync_debug.c
sync_debug.h
sync_file.c dma-buf/sync_file: Don't leak fences on merge failure 2021-07-25 14:36:20 +02:00
sync_trace.h
udmabuf.c udmabuf: Set ubuf->sg = NULL if the creation of sg table fails 2022-10-26 13:25:48 +02:00