[PATCH v6 1/4] sync_file: Protect access to driver and timeline name

[Christian König]

On 6/10/25 18:42, Tvrtko Ursulin wrote:
> Protect the access to driver and timeline name which otherwise could be
> freed as dma-fence exported is signalling fences.
> 
> This prepares the code for incoming dma-fence API changes which will start
> asserting these accesses are done from a RCU locked section.
> 
> Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin at igalia.com>

Reviewed-by: Christian König <christian.koenig at amd.com>

> ---
>  drivers/dma-buf/sync_file.c | 24 ++++++++++++++++++++----
>  1 file changed, 20 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
> index 212df4b849fe..747e377fb954 100644
> --- a/drivers/dma-buf/sync_file.c
> +++ b/drivers/dma-buf/sync_file.c
> @@ -135,12 +135,18 @@ char *sync_file_get_name(struct sync_file *sync_file, char *buf, int len)
>  		strscpy(buf, sync_file->user_name, len);
>  	} else {
>  		struct dma_fence *fence = sync_file->fence;
> +		const char __rcu *timeline;
> +		const char __rcu *driver;
>  
> +		rcu_read_lock();
> +		driver = dma_fence_driver_name(fence);
> +		timeline = dma_fence_timeline_name(fence);
>  		snprintf(buf, len, "%s-%s%llu-%lld",
> -			 dma_fence_driver_name(fence),
> -			 dma_fence_timeline_name(fence),
> +			 rcu_dereference(driver),
> +			 rcu_dereference(timeline),
>  			 fence->context,
>  			 fence->seqno);
> +		rcu_read_unlock();
>  	}
>  
>  	return buf;
> @@ -262,9 +268,17 @@ static long sync_file_ioctl_merge(struct sync_file *sync_file,
>  static int sync_fill_fence_info(struct dma_fence *fence,
>  				 struct sync_fence_info *info)
>  {
> -	strscpy(info->obj_name, dma_fence_timeline_name(fence),
> +	const char __rcu *timeline;
> +	const char __rcu *driver;
> +
> +	rcu_read_lock();
> +
> +	driver = dma_fence_driver_name(fence);
> +	timeline = dma_fence_timeline_name(fence);
> +
> +	strscpy(info->obj_name, rcu_dereference(timeline),
>  		sizeof(info->obj_name));
> -	strscpy(info->driver_name, dma_fence_driver_name(fence),
> +	strscpy(info->driver_name, rcu_dereference(driver),
>  		sizeof(info->driver_name));
>  
>  	info->status = dma_fence_get_status(fence);
> @@ -273,6 +287,8 @@ static int sync_fill_fence_info(struct dma_fence *fence,
>  			ktime_to_ns(dma_fence_timestamp(fence)) :
>  			ktime_set(0, 0);
>  
> +	rcu_read_unlock();
> +
>  	return info->status;
>  }
>