Commit 432e2590 authored by Dawei Li's avatar Dawei Li Committed by Sumit Semwal
Browse files

dma-buf: fix racing conflict of dma_heap_add() 



Racing conflict could be:
task A                 task B
list_for_each_entry
strcmp(h->name))
                       list_for_each_entry
                       strcmp(h->name)
kzalloc                kzalloc
......                 .....
device_create          device_create
list_add
                       list_add

The root cause is that task B has no idea about the fact someone
else(A) has inserted heap with same name when it calls list_add,
so a potential collision occurs.

Fixes: c02a81fb ("dma-buf: Add dma-buf heaps framework")
Signed-off-by: default avatarDawei Li <set_pte_at@outlook.com>
Acked-by: default avatarAndrew Davis <afd@ti.com>
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarSumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/TYCP286MB2323873BBDF88020781FB986CA3B9@TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM
parent c19083c7

drivers/dma-buf/dma-heap.c

+15 −13
Original line number Diff line number Diff line
@@ -233,18 +233,6 @@ struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info) 
		return ERR_PTR(-EINVAL);

	}



	/* check the name is unique */

	mutex_lock(&heap_list_lock);

	list_for_each_entry(h, &heap_list, list) {

		if (!strcmp(h->name, exp_info->name)) {

			mutex_unlock(&heap_list_lock);

			pr_err("dma_heap: Already registered heap named %s\n",

			       exp_info->name);

			return ERR_PTR(-EINVAL);

		}

	}

	mutex_unlock(&heap_list_lock);



	heap = kzalloc(sizeof(*heap), GFP_KERNEL);

	if (!heap)

		return ERR_PTR(-ENOMEM);
@@ -283,13 +271,27 @@ struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info) 
		err_ret = ERR_CAST(dev_ret);

		goto err2;

	}

	/* Add heap to the list */



	mutex_lock(&heap_list_lock);

	/* check the name is unique */

	list_for_each_entry(h, &heap_list, list) {

		if (!strcmp(h->name, exp_info->name)) {

			mutex_unlock(&heap_list_lock);

			pr_err("dma_heap: Already registered heap named %s\n",

			       exp_info->name);

			err_ret = ERR_PTR(-EINVAL);

			goto err3;

		}

	}



	/* Add heap to the list */

	list_add(&heap->list, &heap_list);

	mutex_unlock(&heap_list_lock);



	return heap;



err3:

	device_destroy(dma_heap_class, heap->heap_devt);

err2:

	cdev_del(&heap->heap_cdev);

err1: