linux-stable.git/drivers/dma-buf, branch v5.4.52

dma-buf: Move dma_buf_release() from fops to dentry_ops

2020-07-09T07:37:56+00:00

commit 4ab59c3c638c6c8952bf07739805d20eb6358a4d upstream.

Charan Teja reported a 'use-after-free' in dmabuffs_dname [1], which
happens if the dma_buf_release() is called while the userspace is
accessing the dma_buf pseudo fs's dmabuffs_dname() in another process,
and dma_buf_release() releases the dmabuf object when the last reference
to the struct file goes away.

I discussed with Arnd Bergmann, and he suggested that rather than tying
the dma_buf_release() to the file_operations' release(), we can tie it to
the dentry_operations' d_release(), which will be called when the last ref
to the dentry is removed.

The path exercised by __fput() calls f_op->release() first, and then calls
dput, which eventually calls d_op->d_release().

In the 'normal' case, when no userspace access is happening via dma_buf
pseudo fs, there should be exactly one fd, file, dentry and inode, so
closing the fd will kill of everything right away.

In the presented case, the dentry's d_release() will be called only when
the dentry's last ref is released.

Therefore, lets move dma_buf_release() from fops->release() to
d_ops->d_release()

Many thanks to Arnd for his FS insights :)

[1]: https://lore.kernel.org/patchwork/patch/1238278/

Fixes: bb2bb9030425 ("dma-buf: add DMA_BUF_SET_NAME ioctls")
Reported-by: syzbot+3643a18836bce555bff6@syzkaller.appspotmail.com
Cc:  [5.3+]
Cc: Arnd Bergmann 
Reported-by: Charan Teja Reddy 
Reviewed-by: Arnd Bergmann 
Signed-off-by: Sumit Semwal 
Tested-by: Charan Teja Reddy 
Link: https://patchwork.freedesktop.org/patch/msgid/20200611114418.19852-1-sumit.semwal@linaro.org
Signed-off-by: Greg Kroah-Hartman

dma-buf: Fix SET_NAME ioctl uapi

2020-05-06T06:15:01+00:00

commit a5bff92eaac45bdf6221badf9505c26792fdf99e upstream.

The uapi is the same on 32 and 64 bit, but the number isn't. Everyone
who botched this please re-read:

https://www.kernel.org/doc/html/v5.4-preprc-cpu/ioctl/botching-up-ioctls.html

Also, the type argument for the ioctl macros is for the type the void
__user *arg pointer points at, which in this case would be the
variable-sized char[] of a 0 terminated string. So this was botched in
more than just the usual ways.

Cc: Sumit Semwal 
Cc: Chenbo Feng 
Cc: Greg Hackmann 
Cc: Daniel Vetter 
Cc: linux-media@vger.kernel.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: minchan@kernel.org
Cc: surenb@google.com
Cc: jenhaochen@google.com
Cc: Martin Liu 
Signed-off-by: Daniel Vetter 
Tested-by: Martin Liu 
Reviewed-by: Martin Liu 
Signed-off-by: Sumit Semwal 
  [sumits: updated some checkpatch fixes, corrected author email]
Link: https://patchwork.freedesktop.org/patch/msgid/20200407133002.3486387-1-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman

dma-buf: free dmabuf->name in dma_buf_release()

2020-03-12T12:00:30+00:00

commit d1f37226431f5d9657aa144a40f2383adbcf27e1 upstream.

dma-buf name can be set via DMA_BUF_SET_NAME ioctl, but once set
it never gets freed.

Free it in dma_buf_release().

Fixes: bb2bb9030425 ("dma-buf: add DMA_BUF_SET_NAME ioctls")
Reported-by: syzbot+b2098bc44728a4efb3e9@syzkaller.appspotmail.com
Cc: Greg Hackmann 
Cc: Chenbo Feng 
Cc: Sumit Semwal 
Signed-off-by: Cong Wang 
Acked-by: Chenbo Feng 
Signed-off-by: Sumit Semwal 
Link: https://patchwork.freedesktop.org/patch/msgid/20191227063204.5813-1-xiyou.wangcong@gmail.com
Signed-off-by: Greg Kroah-Hartman

dma-buf: Fix memory leak in sync_file_merge()

2019-12-21T10:04:48+00:00

commit 6645d42d79d33e8a9fe262660a75d5f4556bbea9 upstream.

In the implementation of sync_file_merge() the allocated sync_file is
leaked if number of fences overflows. Release sync_file by goto err.

Fixes: a02b9dc90d84 ("dma-buf/sync_file: refactor fence storage in struct sync_file")
Signed-off-by: Navid Emamdoost 
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20191122220957.30427-1-navid.emamdoost@gmail.com
Signed-off-by: Greg Kroah-Hartman

dma-buf/resv: fix exclusive fence get

2019-10-10T15:05:20+00:00

This causes kernel crash when testing lima driver.

Cc: Christian König 
Fixes: b8c036dfc66f ("dma-buf: simplify reservation_object_get_fences_rcu a bit")
Signed-off-by: Qiang Yu 
Reviewed-by: Chris Wilson 
Signed-off-by: Chris Wilson 
Link: https://patchwork.freedesktop.org/patch/msgid/20190922074900.853-1-yuq825@gmail.com
Signed-off-by: Christian König

dmabuf: Mark up onstack timer for selftests

2019-08-20T12:49:15+00:00

The dma-fence selftest uses an on-stack timer that requires explicit
annotation for debugobjects.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111442
Signed-off-by: Chris Wilson 
Cc: Daniel Vetter 
Acked-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20190820122118.13698-1-chris@chris-wilson.co.uk

dma-buf: Use %zu for printing sizeof

2019-08-20T09:13:42+00:00

Use the %zu format specifier for a size_t returned by sizeof.

Reported-by: kbuild-all@01.org
Signed-off-by: Chris Wilson 
Reviewed-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20190819195740.27608-1-chris@chris-wilson.co.uk

dma-buf: Add selftests for dma-fence

2019-08-19T17:09:46+00:00

Exercise the dma-fence API exported to drivers.

Signed-off-by: Chris Wilson 
Cc: Daniel Vetter 
Acked-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20190819095928.32091-2-chris@chris-wilson.co.uk

dma-buf: Introduce selftesting framework

2019-08-19T17:01:34+00:00

In light of recent review slip ups, the absence of a suite of tests for
dma-buf became apparent. Given the current plethora of testing
frameworks, opt for one already in use by Intel's CI and so allow easy
hook up into igt.

We introduce a new module that when loaded will execute the list of
selftests and their subtest. The names of the selftests are put into the
modinfo as parameters so that igt can identify each, and run them
independently, principally for ease of error reporting.

Signed-off-by: Chris Wilson 
Cc: Daniel Vetter 
Cc: Tomi Sarvela 
Acked-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20190819095928.32091-1-chris@chris-wilson.co.uk

dma-fence: Store the timestamp in the same union as the cb_list

2019-08-17T17:46:33+00:00

The timestamp and the cb_list are mutually exclusive, the cb_list can
only be added to prior to being signaled (and once signaled we drain),
while the timestamp is only valid upon being signaled. Both the
timestamp and the cb_list are only valid while the fence is alive, and
as soon as no references are held can be replaced by the rcu_head.

By reusing the union for the timestamp, we squeeze the base dma_fence
struct to 64 bytes on x86-64.

v2: Sort the union chronologically

Suggested-by: Christian König 
Signed-off-by: Chris Wilson 
Cc: Christian König 
Acked-by: Christian König .
Link: https://patchwork.freedesktop.org/patch/msgid/20190817153022.5749-1-chris@chris-wilson.co.uk