Charan Teja Kalla 722c6e954c dmabuf: use spinlock to access dmabuf->name ... [ Upstream commit 6348dd291e ] There exists a sleep-while-atomic bug while accessing the dmabuf->name under mutex in the dmabuffs_dname(). This is caused from the SELinux permissions checks on a process where it tries to validate the inherited files from fork() by traversing them through iterate_fd() (which traverse files under spin_lock) and call match_file(security/selinux/hooks.c) where the permission checks happen. This audit information is logged using dump_common_audit_data() where it calls d_path() to get the file path name. If the file check happen on the dmabuf's fd, then it ends up in ->dmabuffs_dname() and use mutex to access dmabuf->name. The flow will be like below: flush_unauthorized_files() iterate_fd() spin_lock() --> Start of the atomic section. match_file() file_has_perm() avc_has_perm() avc_audit() slow_avc_audit() common_lsm_audit() dump_common_audit_data() audit_log_d_path() d_path() dmabuffs_dname() mutex_lock()--> Sleep while atomic. Call trace captured (on 4.19 kernels) is below: ___might_sleep+0x204/0x208 __might_sleep+0x50/0x88 __mutex_lock_common+0x5c/0x1068 __mutex_lock_common+0x5c/0x1068 mutex_lock_nested+0x40/0x50 dmabuffs_dname+0xa0/0x170 d_path+0x84/0x290 audit_log_d_path+0x74/0x130 common_lsm_audit+0x334/0x6e8 slow_avc_audit+0xb8/0xf8 avc_has_perm+0x154/0x218 file_has_perm+0x70/0x180 match_file+0x60/0x78 iterate_fd+0x128/0x168 selinux_bprm_committing_creds+0x178/0x248 security_bprm_committing_creds+0x30/0x48 install_exec_creds+0x1c/0x68 load_elf_binary+0x3a4/0x14e0 search_binary_handler+0xb0/0x1e0 So, use spinlock to access dmabuf->name to avoid sleep-while-atomic. Cc: <stable@vger.kernel.org> [5.3+] Signed-off-by: Charan Teja Kalla <charante@codeaurora.org> Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com> Acked-by: Christian König <christian.koenig@amd.com> [sumits: added comment to spinlock_t definition to avoid warning] Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/a83e7f0d-4e54-9848-4b58-e1acdbe06735@codeaurora.org Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-07-29 10:18:29 +02:00
..
dma-buf.c	dmabuf: use spinlock to access dmabuf->name	2020-07-29 10:18:29 +02:00
dma-fence-array.c	dma-fence: Propagate errors to dma-fence-array container	2019-08-12 08:25:52 +01:00
dma-fence-chain.c	dma-buf: fix stack corruption in dma_fence_chain_release	2019-08-05 17:32:33 +02:00
dma-fence.c	dma-fence: Store the timestamp in the same union as the cb_list	2019-08-17 18:46:33 +01:00
dma-resv.c	dma-buf/resv: fix exclusive fence get	2019-10-10 17:05:20 +02:00
Kconfig	dma-buf: Introduce selftesting framework	2019-08-19 18:01:34 +01:00
Makefile	dma-buf: Add selftests for dma-fence	2019-08-19 18:09:46 +01:00
selftest.c	dma-buf: Introduce selftesting framework	2019-08-19 18:01:34 +01:00
selftest.h	dma-buf: Introduce selftesting framework	2019-08-19 18:01:34 +01:00
selftests.h	dma-buf: Add selftests for dma-fence	2019-08-19 18:09:46 +01:00
seqno-fence.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174	2019-05-30 11:26:41 -07:00
st-dma-fence.c	dmabuf: Mark up onstack timer for selftests	2019-08-20 13:49:15 +01:00
sw_sync.c	dma-buf/sw_sync: Synchronize signal vs syncpt free	2019-08-13 07:57:51 +01:00
sync_debug.c	Linux 5.2-rc5	2019-06-19 12:07:29 +02:00
sync_debug.h	dma-buf: Remove unused sync_dump()	2019-04-23 09:30:07 +01:00
sync_file.c	dma-buf: Fix memory leak in sync_file_merge()	2019-12-21 11:04:48 +01:00
sync_trace.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
udmabuf.c	udmabuf: actually unmap the scatterlist	2019-06-05 10:41:17 +02:00