linux.git/drivers/dma-buf/sw_sync.c, branch v4.14.161

dma-buf/sw_sync: Synchronize signal vs syncpt free

2019-10-07T16:55:07+00:00

[ Upstream commit d3c6dd1fb30d3853c2012549affe75c930f4a2f9 ]

During release of the syncpt, we remove it from the list of syncpt and
the tree, but only if it is not already been removed. However, during
signaling, we first remove the syncpt from the list. So, if we
concurrently free and signal the syncpt, the free may decide that it is
not part of the tree and immediately free itself -- meanwhile the
signaler goes on to use the now freed datastructure.

In particular, we get struck by commit 0e2f733addbf ("dma-buf: make
dma_fence structure a bit smaller v2") as the cb_list is immediately
clobbered by the kfree_rcu.

v2: Avoid calling into timeline_fence_release() from under the spinlock

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111381
Fixes: d3862e44daa7 ("dma-buf/sw-sync: Fix locking around sync_timeline lists")
References: 0e2f733addbf ("dma-buf: make dma_fence structure a bit smaller v2")
Signed-off-by: Chris Wilson 
Cc: Sumit Semwal 
Cc: Sean Paul 
Cc: Gustavo Padovan 
Cc: Christian König 
Cc:  # v4.14+
Acked-by: Christian König 
Link: https://patchwork.freedesktop.org/patch/msgid/20190812154247.20508-1-chris@chris-wilson.co.uk
Signed-off-by: Sasha Levin

dma-buf/sw_sync: force signal all unsignaled fences on dying timeline

2017-12-10T12:40:44+00:00

commit ea4d5a270b57fa8d4871f372ca9b97b7697fdfda upstream.

To avoid hanging userspace components that might have been waiting on the
active fences of the destroyed timeline we need to signal with error all
remaining fences on such timeline.

This restore the default behaviour of the Android sw_sync framework, which
Android still relies on. It was broken on the dma fence conversion a few
years ago and never fixed.

v2: Do not bother with cleanup do the list (Chris Wilson)

Reviewed-by: Chris Wilson 
Signed-off-by: Dominik Behr 
Signed-off-by: Gustavo Padovan 
Link: https://patchwork.freedesktop.org/patch/msgid/20170907190246.16425-2-gustavo@padovan.org
Cc: Jisheng Zhang 
Signed-off-by: Greg Kroah-Hartman

dma-buf/sw_sync: clean up list before signaling the fence

2017-07-31T17:11:15+00:00

If userspace already dropped its own reference by closing the sw_sync
fence fd we might end up in a deadlock where
dma_fence_is_signaled_locked() will trigger the release of the fence and
thus try to hold the lock to remove the fence from the list.

dma_fence_is_signaled_locked() tries to release/free the fence and hold
the lock in the process.

We fix that by changing the order operation and clean up the list and
rb-tree first.

v2: Drop fence get/put dance and manipulate the list first (Chris Wilson)

Cc: Chris Wilson 
Signed-off-by: Gustavo Padovan 
Reviewed-by: Chris Wilson 
Link: https://patchwork.freedesktop.org/patch/msgid/20170729152217.8362-2-gustavo@padovan.org

dma-buf/sw_sync: move timeline_fence_ops around

2017-07-31T17:10:33+00:00

We are going to use timeline_fence_signaled() in a internal function in
the next commit.

Cc: Chris Wilson 
Signed-off-by: Gustavo Padovan 
Reviewed-by: Chris Wilson 
Link: https://patchwork.freedesktop.org/patch/msgid/20170729152217.8362-1-gustavo@padovan.org

dma-buf/sw-sync: Use an rbtree to sort fences in the timeline

2017-06-29T21:54:07+00:00

Reduce the list iteration when incrementing the timeline by storing the
fences in increasing order.

v2: Prevent spinlock recursion on free during create
v3: Fixup rebase conflict inside comments that escaped the compiler.

Signed-off-by: Chris Wilson 
Cc: Sumit Semwal 
Cc: Sean Paul 
Cc: Gustavo Padovan 
Reviewed-by: Sean Paul 
Signed-off-by: Gustavo Padovan 
Link: http://patchwork.freedesktop.org/patch/msgid/20170629211253.22766-1-chris@chris-wilson.co.uk

dma-buf/sw-sync: Fix locking around sync_timeline lists

2017-06-29T21:53:47+00:00

The sync_pt were not adding themselves atomically to the timeline lists,
corruption imminent.  Only a single list is required to track the
unsignaled sync_pt, so reduce it and rename the lock more appropriately
along with using idiomatic names to distinguish a list from links along
it.

v2: Prevent spinlock recursion on free during create (next patch) and
fixup crossref in kerneldoc

Signed-off-by: Chris Wilson 
Cc: Sumit Semwal 
Cc: Sean Paul 
Cc: Gustavo Padovan 
Reviewed-by: Sean Paul 
Signed-off-by: Gustavo Padovan 
Link: http://patchwork.freedesktop.org/patch/msgid/20170629210532.5617-1-chris@chris-wilson.co.uk

dma-buf/sw-sync: sync_pt is private and of fixed size

2017-06-29T21:52:34+00:00

Since sync_pt is only allocated from a single location and is no longer
the base class for fences (that is struct dma_fence) it no longer needs
a generic unsized allocator.

Signed-off-by: Chris Wilson 
Cc: Sumit Semwal 
Cc: Sean Paul 
Cc: Gustavo Padovan 
Reviewed-by: Sean Paul 
Signed-off-by: Gustavo Padovan 
Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-5-chris@chris-wilson.co.uk

dma-buf/sw-sync: Reduce irqsave/irqrestore from known context

2017-06-29T21:52:19+00:00

If we know the context under which we are called, then we can use the
simpler form of spin_lock_irq (saving the save/restore).

Signed-off-by: Chris Wilson 
Cc: Sumit Semwal 
Cc: Sean Paul 
Cc: Gustavo Padovan 
Reviewed-by: Sean Paul 
Signed-off-by: Gustavo Padovan 
Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-4-chris@chris-wilson.co.uk

dma-buf/sw-sync: Prevent user overflow on timeline advance

2017-06-29T21:52:05+00:00

The timeline is u32, which limits any single advance to INT_MAX so that
we can detect all fences that need signaling.

Signed-off-by: Chris Wilson 
Cc: Sumit Semwal 
Cc: Sean Paul 
Cc: Gustavo Padovan 
Reviewed-by: Sean Paul 
Signed-off-by: Gustavo Padovan 
Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-3-chris@chris-wilson.co.uk

dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound

2017-06-29T21:51:49+00:00

Use the canonical __dma_fence_is_later() to compare the fence seqno
against the timeline seqno to check if the fence is signaled.

Signed-off-by: Chris Wilson 
Cc: Sumit Semwal 
Cc: Sean Paul 
Cc: Gustavo Padovan 
Reviewed-by: Sean Paul 
Signed-off-by: Gustavo Padovan 
Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-2-chris@chris-wilson.co.uk