dma-buf/sw_sync: Avoid recursive lock during fence signal
authorRob Clark <robdclark@chromium.org>
Fri, 18 Aug 2023 14:59:38 +0000 (07:59 -0700)
committerChristian König <christian.koenig@amd.com>
Wed, 23 Aug 2023 08:22:49 +0000 (10:22 +0200)
commite531fdb5cd5ee2564b7fe10c8a9219e2b2fac61e
tree2f106df9f92e7ad37e8451d72686429cef76236f
parent5ad1ab30ac0809d2963ddcf39ac34317a24a2f17
dma-buf/sw_sync: Avoid recursive lock during fence signal

If a signal callback releases the sw_sync fence, that will trigger a
deadlock as the timeline_fence_release recurses onto the fence->lock
(used both for signaling and the the timeline tree).

To avoid that, temporarily hold an extra reference to the signalled
fences until after we drop the lock.

(This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/
which avoids some potential UAF issues with the original patch.)

v2: Remove now obsolete comment, use list_move_tail() and
    list_del_init()

Reported-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Fixes: d3c6dd1fb30d ("dma-buf/sw_sync: Synchronize signal vs syncpt free")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230818145939.39697-1-robdclark@gmail.com
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
drivers/dma-buf/sw_sync.c