dma-buf/sw_sync: Synchronize signal vs syncpt free
During release of the syncpt, we remove it from the list of syncpt and the tree, but only if it is not already been removed. However, during signaling, we first remove the syncpt from the list. So, if we concurrently free and signal the syncpt, the free may decide that it is not part of the tree and immediately free itself -- meanwhile the signaler goes on to use the now freed datastructure. In particular, we get struck by commit 0e2f733a ("dma-buf: make dma_fence structure a bit smaller v2") as the cb_list is immediately clobbered by the kfree_rcu. v2: Avoid calling into timeline_fence_release() from under the spinlock Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111381 Fixes: d3862e44 ("dma-buf/sw-sync: Fix locking around sync_timeline lists") References: 0e2f733a ("dma-buf: make dma_fence structure a bit smaller v2") Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Sumit Semwal <sumit.semwal@linaro.org> Cc: Sean Paul <seanpaul@chromium.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Christian König <christian.koenig@amd.com> Cc: <stable@vger.kernel.org> # v4.14+ Acked-by: Christian König <christian.koenig@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190812154247.20508-1-chris@chris-wilson.co.uk
parent
1c2b9390
-
mentioned in commit 8ccf3623
-
mentioned in commit 81fbd232
-
mentioned in commit ce7adbbc
-
mentioned in commit 5d9658aa
-
mentioned in commit e531fdb5
-
mentioned in commit d527abdb
-
mentioned in commit aee58f4d
-
mentioned in commit 0df5eaab
-
mentioned in commit efd02b5c
-
mentioned in commit e1717958
-
mentioned in commit 3282e79a
-
mentioned in commit c6e1fcd5
Please register or sign in to comment