On Thu, 2026-11-05 at 17:35 +0800, Edward Adam Davis wrote:
> On Thu, 05 Nov 2026 08:49:49 +0100, Philipp Stanner wrote:
> > >
> > > drivers/dma-buf/sw_sync.c | 6 +++++-
> > > 1 file changed, 5 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
> > > index 8df20b0218a9..261bc98b1ed6 100644
> > > --- a/drivers/dma-buf/sw_sync.c
> > > +++ b/drivers/dma-buf/sw_sync.c
> > > @@ -221,7 +221,11 @@ static void sync_timeline_signal(struct
> > > sync_timeline *obj, unsigned int inc)
> > > if (!timeline_fence_signaled(&pt->base))
> > > break;
> > >
> > > - dma_fence_get(&pt->base);
> > > + if (!dma_fence_get_rcu(&pt->base)) {
> >
> > You must hold the rcu_read_lock() while doing that, don't you?
> dma_fence_get_rcu() is simply a wrapper around kref_get_unless_zero(),
> it has nothing to do with RCU. For instance, the use of dma_fence_get_rcu()
> within sync_pt_create(), as seen in the SW_SYNC_IOC_CREATE_FENCE code path
> does not require an RCU lock.
How come the function you're using here literally says in its docu that
you need RCU?
/**
* dma_fence_get_rcu - get a fence from a dma_resv_list with
* rcu read lock
* @fence: fence to increase refcount of
*
* Function returns NULL if no refcount could be obtained, or the fence.
*/
static inline struct dma_fence *dma_fence_get_rcu(struct dma_fence *fence)
{
if (kref_get_unless_zero(&fence->refcount))
return fence;
else
return NULL;
}
The rcu_read_lock() protects your kref_get_unless_zero() from running
into UAF if refcount == 0.
That's why dma_fence_free() uses kfree_rcu(). Your read-side-lock
prevents kfree() from running so that you can safely read the refcount
== 0 from memory.
If we think about it, having kref_get_unless_zero() without RCU doesn't
even make sense, because refcount == 0 must mean that the object is now
supposed to be freed. That's the point of refcounting.
Or am I missing something?
>
P.
