diff options
| author | Hyejeong Choi <hjeong.choi@samsung.com> | 2025-05-12 21:06:38 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-05-22 14:12:20 +0200 |
| commit | c9d2b9a80d06a58f37e0dc8c827075639b443927 (patch) | |
| tree | eeba2ffe80937a9a0c34757add6b1adfa4c5cebe | |
| parent | fc8fa09d40de2d75f27ba7323ab92e9d94d2b118 (diff) | |
| download | linux-c9d2b9a80d06a58f37e0dc8c827075639b443927.tar.gz linux-c9d2b9a80d06a58f37e0dc8c827075639b443927.tar.bz2 linux-c9d2b9a80d06a58f37e0dc8c827075639b443927.zip | |
dma-buf: insert memory barrier before updating num_fences
commit 72c7d62583ebce7baeb61acce6057c361f73be4a upstream.
smp_store_mb() inserts memory barrier after storing operation.
It is different with what the comment is originally aiming so Null
pointer dereference can be happened if memory update is reordered.
Signed-off-by: Hyejeong Choi <hjeong.choi@samsung.com>
Fixes: a590d0fdbaa5 ("dma-buf: Update reservation shared_count after adding the new fence")
CC: stable@vger.kernel.org
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20250513020638.GA2329653@au1-maretx-p37.eng.sarc.samsung.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/dma-buf/dma-resv.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c index eb8b733065b2..9093f751f133 100644 --- a/drivers/dma-buf/dma-resv.c +++ b/drivers/dma-buf/dma-resv.c @@ -313,8 +313,9 @@ void dma_resv_add_fence(struct dma_resv *obj, struct dma_fence *fence, count++; dma_resv_list_set(fobj, i, fence, usage); - /* pointer update must be visible before we extend the num_fences */ - smp_store_mb(fobj->num_fences, count); + /* fence update must be visible before we extend the num_fences */ + smp_wmb(); + fobj->num_fences = count; } EXPORT_SYMBOL(dma_resv_add_fence); |