On 6/10/25 18:42, Tvrtko Ursulin wrote:
> Protect the access to driver and timeline name which otherwise could be
> freed as dma-fence exported is signalling fences.
>
> This prepares the code for incoming dma-fence API changes which will start
> asserting these accesses are done from a RCU locked section.
>
> Signed-off-by: Tvrtko Ursulin <tvrtko.ursu...@igalia.com>
Reviewed-by: Christian König <christian.koe...@amd.com>
> ---
> drivers/dma-buf/sync_file.c | 24 ++++++++++++++++++++----
> 1 file changed, 20 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
> index 212df4b849fe..747e377fb954 100644
> --- a/drivers/dma-buf/sync_file.c
> +++ b/drivers/dma-buf/sync_file.c
> @@ -135,12 +135,18 @@ char *sync_file_get_name(struct sync_file *sync_file,
> char *buf, int len)
> strscpy(buf, sync_file->user_name, len);
> } else {
> struct dma_fence *fence = sync_file->fence;
> + const char __rcu *timeline;
> + const char __rcu *driver;
>
> + rcu_read_lock();
> + driver = dma_fence_driver_name(fence);
> + timeline = dma_fence_timeline_name(fence);
> snprintf(buf, len, "%s-%s%llu-%lld",
> - dma_fence_driver_name(fence),
> - dma_fence_timeline_name(fence),
> + rcu_dereference(driver),
> + rcu_dereference(timeline),
> fence->context,
> fence->seqno);
> + rcu_read_unlock();
> }
>
> return buf;
> @@ -262,9 +268,17 @@ static long sync_file_ioctl_merge(struct sync_file
> *sync_file,
> static int sync_fill_fence_info(struct dma_fence *fence,
> struct sync_fence_info *info)
> {
> - strscpy(info->obj_name, dma_fence_timeline_name(fence),
> + const char __rcu *timeline;
> + const char __rcu *driver;
> +
> + rcu_read_lock();
> +
> + driver = dma_fence_driver_name(fence);
> + timeline = dma_fence_timeline_name(fence);
> +
> + strscpy(info->obj_name, rcu_dereference(timeline),
> sizeof(info->obj_name));
> - strscpy(info->driver_name, dma_fence_driver_name(fence),
> + strscpy(info->driver_name, rcu_dereference(driver),
> sizeof(info->driver_name));
>
> info->status = dma_fence_get_status(fence);
> @@ -273,6 +287,8 @@ static int sync_fill_fence_info(struct dma_fence *fence,
> ktime_to_ns(dma_fence_timestamp(fence)) :
> ktime_set(0, 0);
>
> + rcu_read_unlock();
> +
> return info->status;
> }
>
