lkml.org 
[lkml]   [2019]   [Mar]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.20 43/88] staging: android: ion: Support cpu access during dma_buf_detach
    Date
    4.20-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit 31eb79db420a3f94c4c45a8c0a05cd30e333f981 ]

    Often userspace doesn't know when the kernel will be calling dma_buf_detach
    on the buffer.
    If userpace starts its CPU access at the same time as the sg list is being
    freed it could end up accessing the sg list after it has been freed.

    Thread A Thread B
    - DMA_BUF_IOCTL_SYNC IOCT
    - ion_dma_buf_begin_cpu_access
    - list_for_each_entry
    - ion_dma_buf_detatch
    - free_duped_table
    - dma_sync_sg_for_cpu

    Fix this by getting the ion_buffer lock before freeing the sg table memory.

    Fixes: 2a55e7b5e544 ("staging: android: ion: Call dma_map_sg for syncing and mapping")
    Signed-off-by: Liam Mark <lmark@codeaurora.org>
    Acked-by: Laura Abbott <labbott@redhat.com>
    Acked-by: Andrew F. Davis <afd@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/staging/android/ion/ion.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
    index 99073325b0c00..45c7f829e3872 100644
    --- a/drivers/staging/android/ion/ion.c
    +++ b/drivers/staging/android/ion/ion.c
    @@ -237,10 +237,10 @@ static void ion_dma_buf_detatch(struct dma_buf *dmabuf,
    struct ion_dma_buf_attachment *a = attachment->priv;
    struct ion_buffer *buffer = dmabuf->priv;

    - free_duped_table(a->table);
    mutex_lock(&buffer->lock);
    list_del(&a->list);
    mutex_unlock(&buffer->lock);
    + free_duped_table(a->table);

    kfree(a);
    }
    --
    2.19.1


    \
     
     \ /
      Last update: 2019-03-04 09:34    [W:2.857 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site