dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline()

Call dma_fence_put(fence) before returning an error if
dma_fence_to_sync_pt() fails. Use an unwind ladder at the
end of

dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline()

Call dma_fence_put(fence) before returning an error if
dma_fence_to_sync_pt() fails. Use an unwind ladder at the
end of the function to do the cleanup.

Fixes: 70e67aaec2f4 ("dma-buf/sw_sync: Add fence deadline support")
Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Christian König <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Signed-off-by: Christian König <[email protected]>

show more ...

dma-buf/sw_sync: remove pointless enable_signaling implementation

Just returning true here is a no-op, remove the optional callback.

Signed-off-by: Christian König <[email protected]>
Review

dma-buf/sw_sync: remove pointless enable_signaling implementation

Just returning true here is a no-op, remove the optional callback.

Signed-off-by: Christian König <[email protected]>
Reviewed-by: Simona Vetter <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw_sync: Add fence deadline support

This consists of simply storing the most recent deadline, and adding an
ioctl to retrieve the deadline. This can be used in conjunction with
the SET_DEAD

dma-buf/sw_sync: Add fence deadline support

This consists of simply storing the most recent deadline, and adding an
ioctl to retrieve the deadline. This can be used in conjunction with
the SET_DEADLINE ioctl on a fence fd for testing. Ie. create various
sw_sync fences, merge them into a fence-array, set deadline on the
fence-array and confirm that it is propagated properly to each fence.

v2: Switch UABI to express deadline as u64
v3: More verbose UAPI docs, show how to convert from timespec
v4: Better comments, track the soonest deadline, as a normal fence
implementation would, return an error if no deadline set.

Signed-off-by: Rob Clark <[email protected]>
Reviewed-by: Christian König <[email protected]>
Acked-by: Pekka Paalanen <[email protected]>
Signed-off-by: Dmitry Baryshkov <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw_sync: Avoid recursive lock during fence signal

If a signal callback releases the sw_sync fence, that will trigger a
deadlock as the timeline_fence_release recurses onto the fence->lock
(u

dma-buf/sw_sync: Avoid recursive lock during fence signal

If a signal callback releases the sw_sync fence, that will trigger a
deadlock as the timeline_fence_release recurses onto the fence->lock
(used both for signaling and the the timeline tree).

To avoid that, temporarily hold an extra reference to the signalled
fences until after we drop the lock.

(This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/
which avoids some potential UAF issues with the original patch.)

v2: Remove now obsolete comment, use list_move_tail() and
list_del_init()

Reported-by: Bas Nieuwenhuizen <[email protected]>
Fixes: d3c6dd1fb30d ("dma-buf/sw_sync: Synchronize signal vs syncpt free")
Signed-off-by: Rob Clark <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Reviewed-by: Christian König <[email protected]>
Signed-off-by: Christian König <[email protected]>

show more ...

dma-buf/sw_sync: Replace all non-returning strlcpy with strscpy

strlcpy() reads the entire source buffer first.
This read may exceed the destination size limit.
This is both inefficient and can lead

dma-buf/sw_sync: Replace all non-returning strlcpy with strscpy

strlcpy() reads the entire source buffer first.
This read may exceed the destination size limit.
This is both inefficient and can lead to linear read
overflows if a source string is not NUL-terminated [1].
In an effort to remove strlcpy() completely [2], replace
strlcpy() here with strscpy().
No return values were used, so direct replacement is safe.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
[2] https://github.com/KSPP/linux/issues/89

Signed-off-by: Azeem Shaikh <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Signed-off-by: Sumit Semwal <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

compat_ioctl: move more drivers to compat_ptr_ioctl

The .ioctl and .compat_ioctl file operations have the same prototype so
they can both point to the same function, which works great almost all
the

compat_ioctl: move more drivers to compat_ptr_ioctl

The .ioctl and .compat_ioctl file operations have the same prototype so
they can both point to the same function, which works great almost all
the time when all the commands are compatible.

One exception is the s390 architecture, where a compat pointer is only
31 bit wide, and converting it into a 64-bit pointer requires calling
compat_ptr(). Most drivers here will never run in s390, but since we now
have a generic helper for it, it's easy enough to use it consistently.

I double-checked all these drivers to ensure that all ioctl arguments
are used as pointers or are ignored, but are not interpreted as integer
values.

Acked-by: Jason Gunthorpe <[email protected]>
Acked-by: Daniel Vetter <[email protected]>
Acked-by: Mauro Carvalho Chehab <[email protected]>
Acked-by: Greg Kroah-Hartman <[email protected]>
Acked-by: David Sterba <[email protected]>
Acked-by: Darren Hart (VMware) <[email protected]>
Acked-by: Jonathan Cameron <[email protected]>
Acked-by: Bjorn Andersson <[email protected]>
Acked-by: Dan Williams <[email protected]>
Signed-off-by: Arnd Bergmann <[email protected]>

show more ...

dma-buf/sw_sync: Synchronize signal vs syncpt free

During release of the syncpt, we remove it from the list of syncpt and
the tree, but only if it is not already been removed. However, during
signal

dma-buf/sw_sync: Synchronize signal vs syncpt free

During release of the syncpt, we remove it from the list of syncpt and
the tree, but only if it is not already been removed. However, during
signaling, we first remove the syncpt from the list. So, if we
concurrently free and signal the syncpt, the free may decide that it is
not part of the tree and immediately free itself -- meanwhile the
signaler goes on to use the now freed datastructure.

In particular, we get struck by commit 0e2f733addbf ("dma-buf: make
dma_fence structure a bit smaller v2") as the cb_list is immediately
clobbered by the kfree_rcu.

v2: Avoid calling into timeline_fence_release() from under the spinlock

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111381
Fixes: d3862e44daa7 ("dma-buf/sw-sync: Fix locking around sync_timeline lists")
References: 0e2f733addbf ("dma-buf: make dma_fence structure a bit smaller v2")
Signed-off-by: Chris Wilson <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Sean Paul <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Cc: Christian König <[email protected]>
Cc: <[email protected]> # v4.14+
Acked-by: Christian König <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282

Based on 1 normalized pattern(s):

this software is licensed under the terms of the gnu general public
license version 2 as pub

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282

Based on 1 normalized pattern(s):

this software is licensed under the terms of the gnu general public
license version 2 as published by the free software foundation and
may be copied distributed and modified under those terms this
program is distributed in the hope that it will be useful but
without any warranty without even the implied warranty of
merchantability or fitness for a particular purpose see the gnu
general public license for more details

extracted by the scancode license scanner the SPDX license identifier

GPL-2.0-only

has been chosen to replace the boilerplate/reference in 285 file(s).

Signed-off-by: Thomas Gleixner <[email protected]>
Reviewed-by: Alexios Zavras <[email protected]>
Reviewed-by: Allison Randal <[email protected]>
Cc: [email protected]
Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

show more ...

dma-buf: explicitely note that dma-fence-chains use 64bit seqno

Instead of checking the upper values of the sequence number use an explicit
field in the dma_fence_ops structure to note if a sequence

dma-buf: explicitely note that dma-fence-chains use 64bit seqno

Instead of checking the upper values of the sequence number use an explicit
field in the dma_fence_ops structure to note if a sequence should be 32bit
or 64bit.

Signed-off-by: Christian König <[email protected]>
Reviewed-by: Lionel Landwerlin <[email protected]>
Link: https://patchwork.freedesktop.org/patch/299655/

show more ...

dma-buf: make fence sequence numbers 64 bit v2

For a lot of use cases we need 64bit sequence numbers. Currently drivers
overload the dma_fence structure to store the additional bits.

Stop doing tha

dma-buf: make fence sequence numbers 64 bit v2

For a lot of use cases we need 64bit sequence numbers. Currently drivers
overload the dma_fence structure to store the additional bits.

Stop doing that and make the sequence number in the dma_fence always
64bit.

For compatibility with hardware which can do only 32bit sequences the
comparisons in __dma_fence_is_later only takes the lower 32bits as significant
when the upper 32bits are all zero.

v2: change the logic in __dma_fence_is_later

Signed-off-by: Christian König <[email protected]>
Reviewed-by: Chunming Zhou <[email protected]>
Link: https://patchwork.freedesktop.org/patch/266927/

show more ...

dma-fence: Make ->wait callback optional

Almost everyone uses dma_fence_default_wait.

v2: Also remove the BUG_ON(!ops->wait) (Chris).

Reviewed-by: Christian König <[email protected]> (v1)
S

dma-fence: Make ->wait callback optional

Almost everyone uses dma_fence_default_wait.

v2: Also remove the BUG_ON(!ops->wait) (Chris).

Reviewed-by: Christian König <[email protected]> (v1)
Signed-off-by: Daniel Vetter <[email protected]>
Cc: Chris Wilson <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Cc: [email protected]
Cc: [email protected]
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

Revert 190c462d5be19ba622a82f5fd0625087c870a1e6..bf3012ada1b2222e770de5c35c1bb16f73b3a01d"

I shouldn't have pushed this, CI was right - I failed to remove the
BUG_ON(!ops->wait);

Reported-by: Chris

Revert 190c462d5be19ba622a82f5fd0625087c870a1e6..bf3012ada1b2222e770de5c35c1bb16f73b3a01d"

I shouldn't have pushed this, CI was right - I failed to remove the
BUG_ON(!ops->wait);

Reported-by: Chris Wilson <[email protected]>
Acked-by: Chris Wilson <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>

show more ...

dma-fence: Make ->wait callback optional

Almost everyone uses dma_fence_default_wait.

Reviewed-by: Christian König <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
C

dma-fence: Make ->wait callback optional

Almost everyone uses dma_fence_default_wait.

Reviewed-by: Christian König <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Cc: [email protected]
Cc: [email protected]
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw_sync: Fix kerneldoc warnings

drivers/dma-buf/sw_sync.c:248: warning: No description found for parameter 'obj'
drivers/dma-buf/sw_sync.c:248: warning: No description found for parameter 'v

dma-buf/sw_sync: Fix kerneldoc warnings

drivers/dma-buf/sw_sync.c:248: warning: No description found for parameter 'obj'
drivers/dma-buf/sw_sync.c:248: warning: No description found for parameter 'value'
drivers/dma-buf/sw_sync.c:248: warning: Excess function parameter 'parent' description in 'sync_pt_create'
drivers/dma-buf/sw_sync.c:248: warning: Excess function parameter 'inc' description in 'sync_pt_create'

Signed-off-by: Chris Wilson <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw_sync: fix document of sw_sync_create_fence_data

The structure should really be sw_sync_create_fence_data rather than
sw_sync_ioctl_create_fence which is the function name.

Signed-off-by:

dma-buf/sw_sync: fix document of sw_sync_create_fence_data

The structure should really be sw_sync_create_fence_data rather than
sw_sync_ioctl_create_fence which is the function name.

Signed-off-by: Shawn Guo <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw_sync: force signal all unsignaled fences on dying timeline

To avoid hanging userspace components that might have been waiting on the
active fences of the destroyed timeline we need to sig

dma-buf/sw_sync: force signal all unsignaled fences on dying timeline

To avoid hanging userspace components that might have been waiting on the
active fences of the destroyed timeline we need to signal with error all
remaining fences on such timeline.

This restore the default behaviour of the Android sw_sync framework, which
Android still relies on. It was broken on the dma fence conversion a few
years ago and never fixed.

v2: Do not bother with cleanup do the list (Chris Wilson)

Reviewed-by: Chris Wilson <[email protected]>
Signed-off-by: Dominik Behr <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw_sync: clean up list before signaling the fence

If userspace already dropped its own reference by closing the sw_sync
fence fd we might end up in a deadlock where
dma_fence_is_signaled_loc

dma-buf/sw_sync: clean up list before signaling the fence

If userspace already dropped its own reference by closing the sw_sync
fence fd we might end up in a deadlock where
dma_fence_is_signaled_locked() will trigger the release of the fence and
thus try to hold the lock to remove the fence from the list.

dma_fence_is_signaled_locked() tries to release/free the fence and hold
the lock in the process.

We fix that by changing the order operation and clean up the list and
rb-tree first.

v2: Drop fence get/put dance and manipulate the list first (Chris Wilson)

Cc: Chris Wilson <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Reviewed-by: Chris Wilson <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw_sync: move timeline_fence_ops around

We are going to use timeline_fence_signaled() in a internal function in
the next commit.

Cc: Chris Wilson <[email protected]>
Signed-off-by: G

dma-buf/sw_sync: move timeline_fence_ops around

We are going to use timeline_fence_signaled() in a internal function in
the next commit.

Cc: Chris Wilson <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Reviewed-by: Chris Wilson <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw-sync: Use an rbtree to sort fences in the timeline

Reduce the list iteration when incrementing the timeline by storing the
fences in increasing order.

v2: Prevent spinlock recursion on f

dma-buf/sw-sync: Use an rbtree to sort fences in the timeline

Reduce the list iteration when incrementing the timeline by storing the
fences in increasing order.

v2: Prevent spinlock recursion on free during create
v3: Fixup rebase conflict inside comments that escaped the compiler.

Signed-off-by: Chris Wilson <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Sean Paul <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Reviewed-by: Sean Paul <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw-sync: Fix locking around sync_timeline lists

The sync_pt were not adding themselves atomically to the timeline lists,
corruption imminent. Only a single list is required to track the
uns

dma-buf/sw-sync: Fix locking around sync_timeline lists

The sync_pt were not adding themselves atomically to the timeline lists,
corruption imminent. Only a single list is required to track the
unsignaled sync_pt, so reduce it and rename the lock more appropriately
along with using idiomatic names to distinguish a list from links along
it.

v2: Prevent spinlock recursion on free during create (next patch) and
fixup crossref in kerneldoc

Signed-off-by: Chris Wilson <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Sean Paul <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Reviewed-by: Sean Paul <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw-sync: sync_pt is private and of fixed size

Since sync_pt is only allocated from a single location and is no longer
the base class for fences (that is struct dma_fence) it no longer needs

dma-buf/sw-sync: sync_pt is private and of fixed size

Since sync_pt is only allocated from a single location and is no longer
the base class for fences (that is struct dma_fence) it no longer needs
a generic unsized allocator.

Signed-off-by: Chris Wilson <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Sean Paul <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Reviewed-by: Sean Paul <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw-sync: Reduce irqsave/irqrestore from known context

If we know the context under which we are called, then we can use the
simpler form of spin_lock_irq (saving the save/restore).

Signed-o

dma-buf/sw-sync: Reduce irqsave/irqrestore from known context

If we know the context under which we are called, then we can use the
simpler form of spin_lock_irq (saving the save/restore).

Signed-off-by: Chris Wilson <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Sean Paul <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Reviewed-by: Sean Paul <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw-sync: Prevent user overflow on timeline advance

The timeline is u32, which limits any single advance to INT_MAX so that
we can detect all fences that need signaling.

Signed-off-by: Chris

dma-buf/sw-sync: Prevent user overflow on timeline advance

The timeline is u32, which limits any single advance to INT_MAX so that
we can detect all fences that need signaling.

Signed-off-by: Chris Wilson <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Sean Paul <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Reviewed-by: Sean Paul <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound

Use the canonical __dma_fence_is_later() to compare the fence seqno
against the timeline seqno to check if the fence is signaled.

dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound

Use the canonical __dma_fence_is_later() to compare the fence seqno
against the timeline seqno to check if the fence is signaled.

Signed-off-by: Chris Wilson <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Sean Paul <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Reviewed-by: Sean Paul <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...

dma-buf/sw_sync: put fence reference from the fence creation

Once sw_sync_ioctl_create_fence() returns we no longer have the
*pt pointer to the fence base object thus we need to put the reference
we

dma-buf/sw_sync: put fence reference from the fence creation

Once sw_sync_ioctl_create_fence() returns we no longer have the
*pt pointer to the fence base object thus we need to put the reference
we have from the fence creation to keep a correct reference accounting.

Signed-off-by: Gustavo Padovan <[email protected]>
Reviewed-by: Chris Wilson <[email protected]>
Signed-off-by: Sumit Semwal <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]

show more ...