Chris Wilson 81fbd2327c dma-buf/sw_sync: Synchronize signal vs syncpt free ... [ Upstream commit d3c6dd1fb3 ] During release of the syncpt, we remove it from the list of syncpt and the tree, but only if it is not already been removed. However, during signaling, we first remove the syncpt from the list. So, if we concurrently free and signal the syncpt, the free may decide that it is not part of the tree and immediately free itself -- meanwhile the signaler goes on to use the now freed datastructure. In particular, we get struck by commit 0e2f733add ("dma-buf: make dma_fence structure a bit smaller v2") as the cb_list is immediately clobbered by the kfree_rcu. v2: Avoid calling into timeline_fence_release() from under the spinlock Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111381 Fixes: d3862e44da ("dma-buf/sw-sync: Fix locking around sync_timeline lists") References: 0e2f733add ("dma-buf: make dma_fence structure a bit smaller v2") Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Sumit Semwal <sumit.semwal@linaro.org> Cc: Sean Paul <seanpaul@chromium.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Christian König <christian.koenig@amd.com> Cc: <stable@vger.kernel.org> # v4.14+ Acked-by: Christian König <christian.koenig@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190812154247.20508-1-chris@chris-wilson.co.uk Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-10-07 18:57:04 +02:00
..
dma-buf.c	dma-buf: balance refcount inbalance	2019-07-28 08:29:28 +02:00
dma-fence-array.c	dma-fence: Make ->wait callback optional	2018-07-03 13:12:57 +02:00
dma-fence.c	dma-fence: Polish kernel-doc for dma-fence.c	2018-07-04 12:18:37 +02:00
Kconfig	dma-buf: Rename struct fence to dma_fence	2016-10-25 14:40:39 +02:00
Makefile	dma-buf: Rename struct fence to dma_fence	2016-10-25 14:40:39 +02:00
reservation.c	dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc	2019-07-28 08:29:28 +02:00
seqno-fence.c	dma-buf: Rename struct fence to dma_fence	2016-10-25 14:40:39 +02:00
sw_sync.c	dma-buf/sw_sync: Synchronize signal vs syncpt free	2019-10-07 18:57:04 +02:00
sync_debug.c	Linux 4.13-rc2	2017-07-27 08:15:43 +10:00
sync_debug.h	dma-buf: Remove unneeded stubs around sync_debug interfaces	2018-05-07 15:58:07 +02:00
sync_file.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
sync_trace.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00