From: "Christian König" <christian.koenig@amd.com>
To: Dmitry Antipov <dmantipov@yandex.ru>,
Sumit Semwal <sumit.semwal@linaro.org>
Cc: linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org,
lvc-project@linuxtesting.org,
syzbot+5d4cb6b4409edfd18646@syzkaller.appspotmail.com
Subject: Re: [PATCH] [RFC] dma-buf: fix race condition between poll and close
Date: Wed, 24 Apr 2024 09:09:57 +0200 [thread overview]
Message-ID: <85b476cd-3afd-4781-9168-ecc88b6cc837@amd.com> (raw)
In-Reply-To: <20240423191310.19437-1-dmantipov@yandex.ru>
Am 23.04.24 um 21:13 schrieb Dmitry Antipov:
> Syzbot has found the race condition where 'fput()' is in progress
> when 'dma_buf_poll()' makes an attempt to hold the 'struct file'
> with zero 'f_count'. So use explicit 'atomic_long_inc_not_zero()'
> to detect such a case and cancel an undergoing poll activity with
> EPOLLERR.
Well this is really interesting, you are the second person which comes
up with this nonsense.
To repeat what I already said on the other thread: Calling
dma_buf_poll() while fput() is in progress is illegal in the first place.
So there is nothing to fix in dma_buf_poll(), but rather to figure out
who is incorrectly calling fput().
Regards,
Christian.
>
> Reported-by: syzbot+5d4cb6b4409edfd18646@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=5d4cb6b4409edfd18646
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> ---
> drivers/dma-buf/dma-buf.c | 23 ++++++++++++++++++-----
> 1 file changed, 18 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
> index 8fe5aa67b167..39eb75d23219 100644
> --- a/drivers/dma-buf/dma-buf.c
> +++ b/drivers/dma-buf/dma-buf.c
> @@ -266,8 +266,17 @@ static __poll_t dma_buf_poll(struct file *file, poll_table *poll)
> spin_unlock_irq(&dmabuf->poll.lock);
>
> if (events & EPOLLOUT) {
> - /* Paired with fput in dma_buf_poll_cb */
> - get_file(dmabuf->file);
> + /*
> + * Catch the case when fput() is in progress
> + * (e.g. due to close() from another thread).
> + * Otherwise the paired fput() will be issued
> + * from dma_buf_poll_cb().
> + */
> + if (unlikely(!atomic_long_inc_not_zero(&file->f_count))) {
> + events = EPOLLERR;
> + dcb->active = 0;
> + goto out;
> + }
>
> if (!dma_buf_poll_add_cb(resv, true, dcb))
> /* No callback queued, wake up any other waiters */
> @@ -289,8 +298,12 @@ static __poll_t dma_buf_poll(struct file *file, poll_table *poll)
> spin_unlock_irq(&dmabuf->poll.lock);
>
> if (events & EPOLLIN) {
> - /* Paired with fput in dma_buf_poll_cb */
> - get_file(dmabuf->file);
> + /* See above */
> + if (unlikely(!atomic_long_inc_not_zero(&file->f_count))) {
> + events = EPOLLERR;
> + dcb->active = 0;
> + goto out;
> + }
>
> if (!dma_buf_poll_add_cb(resv, false, dcb))
> /* No callback queued, wake up any other waiters */
> @@ -299,7 +312,7 @@ static __poll_t dma_buf_poll(struct file *file, poll_table *poll)
> events &= ~EPOLLIN;
> }
> }
> -
> +out:
> dma_resv_unlock(resv);
> return events;
> }
next prev parent reply other threads:[~2024-04-24 7:10 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-23 19:13 [PATCH] [RFC] dma-buf: fix race condition between poll and close Dmitry Antipov
2024-04-24 7:09 ` Christian König [this message]
2024-04-24 10:19 ` Dmitry Antipov
2024-04-24 11:28 ` Christian König
2024-05-03 7:07 ` Dmitry Antipov
2024-05-03 8:18 ` Christian König
2024-05-03 11:08 ` Dmitry Antipov
2024-05-06 6:52 ` [lvc-project] " Fedor Pchelkin
2024-05-07 9:58 ` Christian König
2024-05-07 10:40 ` Daniel Vetter
2024-05-07 15:02 ` Christian König
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=85b476cd-3afd-4781-9168-ecc88b6cc837@amd.com \
--to=christian.koenig@amd.com \
--cc=dmantipov@yandex.ru \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-media@vger.kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=sumit.semwal@linaro.org \
--cc=syzbot+5d4cb6b4409edfd18646@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).