Commit ad10976d authored by Tvrtko Ursulin's avatar Tvrtko Ursulin Committed by Tvrtko Ursulin
Browse files

sync_file: Protect access to driver and timeline name 



Protect the access to driver and timeline name which otherwise could be
freed as dma-fence exported is signalling fences.

This prepares the code for incoming dma-fence API changes which will start
asserting these accesses are done from a RCU locked section.

Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarTvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20250610164226.10817-2-tvrtko.ursulin@igalia.com
parent a979a541

drivers/dma-buf/sync_file.c

+20 −4
Original line number Diff line number Diff line
@@ -135,12 +135,18 @@ char *sync_file_get_name(struct sync_file *sync_file, char *buf, int len) 
		strscpy(buf, sync_file->user_name, len);

	} else {

		struct dma_fence *fence = sync_file->fence;

		const char __rcu *timeline;

		const char __rcu *driver;



		rcu_read_lock();

		driver = dma_fence_driver_name(fence);

		timeline = dma_fence_timeline_name(fence);

		snprintf(buf, len, "%s-%s%llu-%lld",

			 dma_fence_driver_name(fence),

			 dma_fence_timeline_name(fence),

			 rcu_dereference(driver),

			 rcu_dereference(timeline),

			 fence->context,

			 fence->seqno);

		rcu_read_unlock();

	}



	return buf;
@@ -262,9 +268,17 @@ static long sync_file_ioctl_merge(struct sync_file *sync_file, 
static int sync_fill_fence_info(struct dma_fence *fence,

				 struct sync_fence_info *info)

{

	strscpy(info->obj_name, dma_fence_timeline_name(fence),

	const char __rcu *timeline;

	const char __rcu *driver;



	rcu_read_lock();



	driver = dma_fence_driver_name(fence);

	timeline = dma_fence_timeline_name(fence);



	strscpy(info->obj_name, rcu_dereference(timeline),

		sizeof(info->obj_name));

	strscpy(info->driver_name, dma_fence_driver_name(fence),

	strscpy(info->driver_name, rcu_dereference(driver),

		sizeof(info->driver_name));



	info->status = dma_fence_get_status(fence);
@@ -273,6 +287,8 @@ static int sync_fill_fence_info(struct dma_fence *fence, 
			ktime_to_ns(dma_fence_timestamp(fence)) :

			ktime_set(0, 0);



	rcu_read_unlock();



	return info->status;

}