From: Dmitry Antipov <dmantipov@yandex.ru>
To: "Sumit Semwal" <sumit.semwal@linaro.org>,
"Christian König" <christian.koenig@amd.com>
Cc: linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org,
lvc-project@linuxtesting.org,
Dmitry Antipov <dmantipov@yandex.ru>,
syzbot+5d4cb6b4409edfd18646@syzkaller.appspotmail.com
Subject: [PATCH] [RFC] dma-buf: fix race condition between poll and close
Date: Tue, 23 Apr 2024 22:13:10 +0300 [thread overview]
Message-ID: <20240423191310.19437-1-dmantipov@yandex.ru> (raw)
Syzbot has found the race condition where 'fput()' is in progress
when 'dma_buf_poll()' makes an attempt to hold the 'struct file'
with zero 'f_count'. So use explicit 'atomic_long_inc_not_zero()'
to detect such a case and cancel an undergoing poll activity with
EPOLLERR.
Reported-by: syzbot+5d4cb6b4409edfd18646@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5d4cb6b4409edfd18646
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
drivers/dma-buf/dma-buf.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 8fe5aa67b167..39eb75d23219 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -266,8 +266,17 @@ static __poll_t dma_buf_poll(struct file *file, poll_table *poll)
spin_unlock_irq(&dmabuf->poll.lock);
if (events & EPOLLOUT) {
- /* Paired with fput in dma_buf_poll_cb */
- get_file(dmabuf->file);
+ /*
+ * Catch the case when fput() is in progress
+ * (e.g. due to close() from another thread).
+ * Otherwise the paired fput() will be issued
+ * from dma_buf_poll_cb().
+ */
+ if (unlikely(!atomic_long_inc_not_zero(&file->f_count))) {
+ events = EPOLLERR;
+ dcb->active = 0;
+ goto out;
+ }
if (!dma_buf_poll_add_cb(resv, true, dcb))
/* No callback queued, wake up any other waiters */
@@ -289,8 +298,12 @@ static __poll_t dma_buf_poll(struct file *file, poll_table *poll)
spin_unlock_irq(&dmabuf->poll.lock);
if (events & EPOLLIN) {
- /* Paired with fput in dma_buf_poll_cb */
- get_file(dmabuf->file);
+ /* See above */
+ if (unlikely(!atomic_long_inc_not_zero(&file->f_count))) {
+ events = EPOLLERR;
+ dcb->active = 0;
+ goto out;
+ }
if (!dma_buf_poll_add_cb(resv, false, dcb))
/* No callback queued, wake up any other waiters */
@@ -299,7 +312,7 @@ static __poll_t dma_buf_poll(struct file *file, poll_table *poll)
events &= ~EPOLLIN;
}
}
-
+out:
dma_resv_unlock(resv);
return events;
}
--
2.44.0
next reply other threads:[~2024-04-23 19:21 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-23 19:13 Dmitry Antipov [this message]
2024-04-24 7:09 ` [PATCH] [RFC] dma-buf: fix race condition between poll and close Christian König
2024-04-24 10:19 ` Dmitry Antipov
2024-04-24 11:28 ` Christian König
2024-05-03 7:07 ` Dmitry Antipov
2024-05-03 8:18 ` Christian König
2024-05-03 11:08 ` Dmitry Antipov
2024-05-06 6:52 ` [lvc-project] " Fedor Pchelkin
2024-05-07 9:58 ` Christian König
2024-05-07 10:40 ` Daniel Vetter
2024-05-07 15:02 ` Christian König
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240423191310.19437-1-dmantipov@yandex.ru \
--to=dmantipov@yandex.ru \
--cc=christian.koenig@amd.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-media@vger.kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=sumit.semwal@linaro.org \
--cc=syzbot+5d4cb6b4409edfd18646@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).