Commit 85b2f91a authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Zheng Zucheng
Browse files

dma-buf/sw-sync: don't enable IRQ from sync_print_obj() 

mainline inclusion
from mainline-v6.10-rc2
commit b794918961516f667b0c745aebdfebbb8a98df39
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7DBQ
CVE: CVE-2024-38780

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b794918961516f667b0c745aebdfebbb8a98df39



----------------------------------

Since commit a6aa8fca ("dma-buf/sw-sync: Reduce irqsave/irqrestore from
known context") by error replaced spin_unlock_irqrestore() with
spin_unlock_irq() for both sync_debugfs_show() and sync_print_obj() despite
sync_print_obj() is called from sync_debugfs_show(), lockdep complains
inconsistent lock state warning.

Use plain spin_{lock,unlock}() for sync_print_obj(), for
sync_debugfs_show() is already using spin_{lock,unlock}_irq().

Reported-by: default avatarsyzbot <syzbot+a225ee3df7e7f9372dbe@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=a225ee3df7e7f9372dbe


Fixes: a6aa8fca ("dma-buf/sw-sync: Reduce irqsave/irqrestore from known context")
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/c2e46020-aaa6-4e06-bf73-f05823f913f0@I-love.SAKURA.ne.jp


Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarZheng Zucheng <zhengzucheng@huawei.com>
parent 59d56ab0

drivers/dma-buf/sync_debug.c

+2 −2
Original line number Diff line number Diff line
@@ -110,12 +110,12 @@ static void sync_print_obj(struct seq_file *s, struct sync_timeline *obj) 


	seq_printf(s, "%s: %d\n", obj->name, obj->value);



	spin_lock_irq(&obj->lock);

	spin_lock(&obj->lock); /* Caller already disabled IRQ. */

	list_for_each(pos, &obj->pt_list) {

		struct sync_pt *pt = container_of(pos, struct sync_pt, link);

		sync_print_fence(s, &pt->base, false);

	}

	spin_unlock_irq(&obj->lock);

	spin_unlock(&obj->lock);

}



static void sync_print_sync_file(struct seq_file *s,