Protect the access to driver and timeline name which otherwise could be
freed as dma-fence exported is signalling fences.

This prepares the code for incoming dma-fence API changes which will start
asserting these accesses are done from a RCU locked section.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursu...@igalia.com>
---
 drivers/dma-buf/sync_file.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index 212df4b849fe..747e377fb954 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -135,12 +135,18 @@ char *sync_file_get_name(struct sync_file *sync_file, 
char *buf, int len)
                strscpy(buf, sync_file->user_name, len);
        } else {
                struct dma_fence *fence = sync_file->fence;
+               const char __rcu *timeline;
+               const char __rcu *driver;
 
+               rcu_read_lock();
+               driver = dma_fence_driver_name(fence);
+               timeline = dma_fence_timeline_name(fence);
                snprintf(buf, len, "%s-%s%llu-%lld",
-                        dma_fence_driver_name(fence),
-                        dma_fence_timeline_name(fence),
+                        rcu_dereference(driver),
+                        rcu_dereference(timeline),
                         fence->context,
                         fence->seqno);
+               rcu_read_unlock();
        }
 
        return buf;
@@ -262,9 +268,17 @@ static long sync_file_ioctl_merge(struct sync_file 
*sync_file,
 static int sync_fill_fence_info(struct dma_fence *fence,
                                 struct sync_fence_info *info)
 {
-       strscpy(info->obj_name, dma_fence_timeline_name(fence),
+       const char __rcu *timeline;
+       const char __rcu *driver;
+
+       rcu_read_lock();
+
+       driver = dma_fence_driver_name(fence);
+       timeline = dma_fence_timeline_name(fence);
+
+       strscpy(info->obj_name, rcu_dereference(timeline),
                sizeof(info->obj_name));
-       strscpy(info->driver_name, dma_fence_driver_name(fence),
+       strscpy(info->driver_name, rcu_dereference(driver),
                sizeof(info->driver_name));
 
        info->status = dma_fence_get_status(fence);
@@ -273,6 +287,8 @@ static int sync_fill_fence_info(struct dma_fence *fence,
                        ktime_to_ns(dma_fence_timestamp(fence)) :
                        ktime_set(0, 0);
 
+       rcu_read_unlock();
+
        return info->status;
 }
 
-- 
2.48.0

Reply via email to