This is a note to let you know that I've just added the patch titled
dma-buf/sw_sync: force signal all unsignaled fences on dying timeline
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
dma-buf-sw_sync-force-signal-all-unsignaled-fences-on-dying-timeline.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From ea4d5a270b57fa8d4871f372ca9b97b7697fdfda Mon Sep 17 00:00:00 2001
From: Dominik Behr <dbehr(a)chromium.org>
Date: Thu, 7 Sep 2017 16:02:46 -0300
Subject: dma-buf/sw_sync: force signal all unsignaled fences on dying timeline
From: Dominik Behr <dbehr(a)chromium.org>
commit ea4d5a270b57fa8d4871f372ca9b97b7697fdfda upstream.
To avoid hanging userspace components that might have been waiting on the
active fences of the destroyed timeline we need to signal with error all
remaining fences on such timeline.
This restore the default behaviour of the Android sw_sync framework, which
Android still relies on. It was broken on the dma fence conversion a few
years ago and never fixed.
v2: Do not bother with cleanup do the list (Chris Wilson)
Reviewed-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Signed-off-by: Dominik Behr <dbehr(a)chromium.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan(a)collabora.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20170907190246.16425-2-gustav…
[s/dma_fence/fence/g - gregkh]
Cc: Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/dma-buf/sw_sync.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -321,8 +321,16 @@ static int sw_sync_debugfs_open(struct i
static int sw_sync_debugfs_release(struct inode *inode, struct file *file)
{
struct sync_timeline *obj = file->private_data;
+ struct sync_pt *pt, *next;
- smp_wmb();
+ spin_lock_irq(&obj->lock);
+
+ list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
+ fence_set_error(&pt->base, -ENOENT);
+ fence_signal_locked(&pt->base);
+ }
+
+ spin_unlock_irq(&obj->lock);
sync_timeline_put(obj);
return 0;
Patches currently in stable-queue which might be from dbehr(a)chromium.org are
queue-4.9/dma-buf-sw_sync-force-signal-all-unsignaled-fences-on-dying-timeline.patch
This is a note to let you know that I've just added the patch titled
dma-buf/sw_sync: clean up list before signaling the fence
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
dma-buf-sw_sync-clean-up-list-before-signaling-the-fence.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 3792b7c1a70815fe4e954221c096f9278638fd21 Mon Sep 17 00:00:00 2001
From: Gustavo Padovan <gustavo.padovan(a)collabora.com>
Date: Sat, 29 Jul 2017 12:22:16 -0300
Subject: dma-buf/sw_sync: clean up list before signaling the fence
From: Gustavo Padovan <gustavo.padovan(a)collabora.com>
commit 3792b7c1a70815fe4e954221c096f9278638fd21 upstream.
If userspace already dropped its own reference by closing the sw_sync
fence fd we might end up in a deadlock where
dma_fence_is_signaled_locked() will trigger the release of the fence and
thus try to hold the lock to remove the fence from the list.
dma_fence_is_signaled_locked() tries to release/free the fence and hold
the lock in the process.
We fix that by changing the order operation and clean up the list and
rb-tree first.
v2: Drop fence get/put dance and manipulate the list first (Chris Wilson)
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Signed-off-by: Gustavo Padovan <gustavo.padovan(a)collabora.com>
Reviewed-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20170729152217.8362-2-gustavo…
[s/dma_fence/fence/g - gregkh]
Cc: Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/dma-buf/sw_sync.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -213,11 +213,21 @@ static void sync_timeline_signal(struct
obj->value += inc;
list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
- if (!fence_is_signaled_locked(&pt->base))
+ if (!timeline_fence_signaled(&pt->base))
break;
list_del_init(&pt->link);
rb_erase(&pt->node, &obj->pt_tree);
+
+ /*
+ * A signal callback may release the last reference to this
+ * fence, causing it to be freed. That operation has to be
+ * last to avoid a use after free inside this loop, and must
+ * be after we remove the fence from the timeline in order to
+ * prevent deadlocking on timeline->lock inside
+ * timeline_fence_release().
+ */
+ fence_signal_locked(&pt->base);
}
spin_unlock_irq(&obj->lock);
Patches currently in stable-queue which might be from gustavo.padovan(a)collabora.com are
queue-4.9/dma-buf-sw-sync-fix-the-is-signaled-test-to-handle-u32-wraparound.patch
queue-4.9/dma-buf-sw-sync-fix-locking-around-sync_timeline-lists.patch
queue-4.9/dma-buf-sw_sync-clean-up-list-before-signaling-the-fence.patch
queue-4.9/dma-buf-sw-sync-reduce-irqsave-irqrestore-from-known-context.patch
queue-4.9/dma-buf-sw_sync-move-timeline_fence_ops-around.patch
queue-4.9/dma-buf-sw-sync-prevent-user-overflow-on-timeline-advance.patch
queue-4.9/dma-buf-sw_sync-force-signal-all-unsignaled-fences-on-dying-timeline.patch
queue-4.9/dma-buf-sw-sync-use-an-rbtree-to-sort-fences-in-the-timeline.patch
queue-4.9/dma-buf-sw-sync-sync_pt-is-private-and-of-fixed-size.patch
queue-4.9/dma-buf-dma-fence-extract-__dma_fence_is_later.patch
This is a note to let you know that I've just added the patch titled
dma-buf/sw-sync: sync_pt is private and of fixed size
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
dma-buf-sw-sync-sync_pt-is-private-and-of-fixed-size.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 3b52ce44e720c240afc4c4b03140d7b7811b23bd Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris(a)chris-wilson.co.uk>
Date: Thu, 29 Jun 2017 13:59:28 +0100
Subject: dma-buf/sw-sync: sync_pt is private and of fixed size
From: Chris Wilson <chris(a)chris-wilson.co.uk>
commit 3b52ce44e720c240afc4c4b03140d7b7811b23bd upstream.
Since sync_pt is only allocated from a single location and is no longer
the base class for fences (that is struct dma_fence) it no longer needs
a generic unsized allocator.
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Sumit Semwal <sumit.semwal(a)linaro.org>
Cc: Sean Paul <seanpaul(a)chromium.org>
Cc: Gustavo Padovan <gustavo(a)padovan.org>
Reviewed-by: Sean Paul <seanpaul(a)chromium.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan(a)collabora.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-5-chris@chr…
[s/dma_fence/fence/g - gregkh]
Cc: Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/dma-buf/sw_sync.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -155,7 +155,6 @@ static void sync_timeline_signal(struct
/**
* sync_pt_create() - creates a sync pt
* @parent: fence's parent sync_timeline
- * @size: size to allocate for this pt
* @inc: value of the fence
*
* Creates a new sync_pt as a child of @parent. @size bytes will be
@@ -163,15 +162,12 @@ static void sync_timeline_signal(struct
* the generic sync_timeline struct. Returns the sync_pt object or
* NULL in case of error.
*/
-static struct sync_pt *sync_pt_create(struct sync_timeline *obj, int size,
- unsigned int value)
+static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
+ unsigned int value)
{
struct sync_pt *pt;
- if (size < sizeof(*pt))
- return NULL;
-
- pt = kzalloc(size, GFP_KERNEL);
+ pt = kzalloc(sizeof(*pt), GFP_KERNEL);
if (!pt)
return NULL;
@@ -312,7 +308,7 @@ static long sw_sync_ioctl_create_fence(s
goto err;
}
- pt = sync_pt_create(obj, sizeof(*pt), data.value);
+ pt = sync_pt_create(obj, data.value);
if (!pt) {
err = -ENOMEM;
goto err;
Patches currently in stable-queue which might be from chris(a)chris-wilson.co.uk are
queue-4.9/dma-buf-sw-sync-fix-the-is-signaled-test-to-handle-u32-wraparound.patch
queue-4.9/dma-fence-clear-fence-status-during-dma_fence_init.patch
queue-4.9/dma-buf-sw-sync-fix-locking-around-sync_timeline-lists.patch
queue-4.9/dma-fence-wrap-querying-the-fence-status.patch
queue-4.9/dma-buf-sw_sync-clean-up-list-before-signaling-the-fence.patch
queue-4.9/dma-buf-sw-sync-reduce-irqsave-irqrestore-from-known-context.patch
queue-4.9/dma-buf-sw_sync-move-timeline_fence_ops-around.patch
queue-4.9/dma-buf-sw-sync-prevent-user-overflow-on-timeline-advance.patch
queue-4.9/dma-fence-introduce-drm_fence_set_error-helper.patch
queue-4.9/dma-buf-sw_sync-force-signal-all-unsignaled-fences-on-dying-timeline.patch
queue-4.9/dma-buf-sw-sync-use-an-rbtree-to-sort-fences-in-the-timeline.patch
queue-4.9/dma-buf-sw-sync-sync_pt-is-private-and-of-fixed-size.patch
queue-4.9/dma-buf-dma-fence-extract-__dma_fence_is_later.patch
This is a note to let you know that I've just added the patch titled
dma-buf/sw-sync: Prevent user overflow on timeline advance
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
dma-buf-sw-sync-prevent-user-overflow-on-timeline-advance.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 8f66d3aa1735bc95ae58d846a157357e8d41abb8 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris(a)chris-wilson.co.uk>
Date: Thu, 29 Jun 2017 13:59:26 +0100
Subject: dma-buf/sw-sync: Prevent user overflow on timeline advance
From: Chris Wilson <chris(a)chris-wilson.co.uk>
commit 8f66d3aa1735bc95ae58d846a157357e8d41abb8 upstream.
The timeline is u32, which limits any single advance to INT_MAX so that
we can detect all fences that need signaling.
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Sumit Semwal <sumit.semwal(a)linaro.org>
Cc: Sean Paul <seanpaul(a)chromium.org>
Cc: Gustavo Padovan <gustavo(a)padovan.org>
Reviewed-by: Sean Paul <seanpaul(a)chromium.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan(a)collabora.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-3-chris@chr…
[s/dma_fence/fence/g - gregkh]
Cc: Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/dma-buf/sw_sync.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -345,6 +345,11 @@ static long sw_sync_ioctl_inc(struct syn
if (copy_from_user(&value, (void __user *)arg, sizeof(value)))
return -EFAULT;
+ while (value > INT_MAX) {
+ sync_timeline_signal(obj, INT_MAX);
+ value -= INT_MAX;
+ }
+
sync_timeline_signal(obj, value);
return 0;
Patches currently in stable-queue which might be from chris(a)chris-wilson.co.uk are
queue-4.9/dma-buf-sw-sync-fix-the-is-signaled-test-to-handle-u32-wraparound.patch
queue-4.9/dma-fence-clear-fence-status-during-dma_fence_init.patch
queue-4.9/dma-buf-sw-sync-fix-locking-around-sync_timeline-lists.patch
queue-4.9/dma-fence-wrap-querying-the-fence-status.patch
queue-4.9/dma-buf-sw_sync-clean-up-list-before-signaling-the-fence.patch
queue-4.9/dma-buf-sw-sync-reduce-irqsave-irqrestore-from-known-context.patch
queue-4.9/dma-buf-sw_sync-move-timeline_fence_ops-around.patch
queue-4.9/dma-buf-sw-sync-prevent-user-overflow-on-timeline-advance.patch
queue-4.9/dma-fence-introduce-drm_fence_set_error-helper.patch
queue-4.9/dma-buf-sw_sync-force-signal-all-unsignaled-fences-on-dying-timeline.patch
queue-4.9/dma-buf-sw-sync-use-an-rbtree-to-sort-fences-in-the-timeline.patch
queue-4.9/dma-buf-sw-sync-sync_pt-is-private-and-of-fixed-size.patch
queue-4.9/dma-buf-dma-fence-extract-__dma_fence_is_later.patch
This is a note to let you know that I've just added the patch titled
dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
dma-buf-sw-sync-fix-the-is-signaled-test-to-handle-u32-wraparound.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 61894b02716f122dd7662d5d89f5b2245ca551e2 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris(a)chris-wilson.co.uk>
Date: Thu, 29 Jun 2017 13:59:25 +0100
Subject: dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound
From: Chris Wilson <chris(a)chris-wilson.co.uk>
commit 61894b02716f122dd7662d5d89f5b2245ca551e2 upstream.
Use the canonical __dma_fence_is_later() to compare the fence seqno
against the timeline seqno to check if the fence is signaled.
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Sumit Semwal <sumit.semwal(a)linaro.org>
Cc: Sean Paul <seanpaul(a)chromium.org>
Cc: Gustavo Padovan <gustavo(a)padovan.org>
Reviewed-by: Sean Paul <seanpaul(a)chromium.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan(a)collabora.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-2-chris@chr…
[s/dma_fence/fence/g - gregkh]
Cc: Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/dma-buf/sw_sync.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -219,7 +219,7 @@ static bool timeline_fence_signaled(stru
{
struct sync_timeline *parent = fence_parent(fence);
- return (fence->seqno > parent->value) ? false : true;
+ return !__fence_is_later(fence->seqno, parent->value);
}
static bool timeline_fence_enable_signaling(struct fence *fence)
Patches currently in stable-queue which might be from chris(a)chris-wilson.co.uk are
queue-4.9/dma-buf-sw-sync-fix-the-is-signaled-test-to-handle-u32-wraparound.patch
queue-4.9/dma-fence-clear-fence-status-during-dma_fence_init.patch
queue-4.9/dma-buf-sw-sync-fix-locking-around-sync_timeline-lists.patch
queue-4.9/dma-fence-wrap-querying-the-fence-status.patch
queue-4.9/dma-buf-sw_sync-clean-up-list-before-signaling-the-fence.patch
queue-4.9/dma-buf-sw-sync-reduce-irqsave-irqrestore-from-known-context.patch
queue-4.9/dma-buf-sw_sync-move-timeline_fence_ops-around.patch
queue-4.9/dma-buf-sw-sync-prevent-user-overflow-on-timeline-advance.patch
queue-4.9/dma-fence-introduce-drm_fence_set_error-helper.patch
queue-4.9/dma-buf-sw_sync-force-signal-all-unsignaled-fences-on-dying-timeline.patch
queue-4.9/dma-buf-sw-sync-use-an-rbtree-to-sort-fences-in-the-timeline.patch
queue-4.9/dma-buf-sw-sync-sync_pt-is-private-and-of-fixed-size.patch
queue-4.9/dma-buf-dma-fence-extract-__dma_fence_is_later.patch
This is a note to let you know that I've just added the patch titled
dma-buf/dma-fence: Extract __dma_fence_is_later()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
dma-buf-dma-fence-extract-__dma_fence_is_later.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 8111477663813caa1a4469cfe6afaae36cd04513 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris(a)chris-wilson.co.uk>
Date: Thu, 29 Jun 2017 13:59:24 +0100
Subject: dma-buf/dma-fence: Extract __dma_fence_is_later()
From: Chris Wilson <chris(a)chris-wilson.co.uk>
commit 8111477663813caa1a4469cfe6afaae36cd04513 upstream.
Often we have the task of comparing two seqno known to be on the same
context, so provide a common __dma_fence_is_later().
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Sumit Semwal <sumit.semwal(a)linaro.org>
Cc: Sean Paul <seanpaul(a)chromium.org>
Cc: Gustavo Padovan <gustavo(a)padovan.org>
Reviewed-by: Sean Paul <seanpaul(a)chromium.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan(a)collabora.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-1-chris@chr…
[renamed to __fence_is_later() - gregkh]
Cc: Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
include/linux/fence.h | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/include/linux/fence.h
+++ b/include/linux/fence.h
@@ -281,6 +281,19 @@ fence_is_signaled(struct fence *fence)
}
/**
+ * __fence_is_later - return if f1 is chronologically later than f2
+ * @f1: [in] the first fence's seqno
+ * @f2: [in] the second fence's seqno from the same context
+ *
+ * Returns true if f1 is chronologically later than f2. Both fences must be
+ * from the same context, since a seqno is not common across contexts.
+ */
+static inline bool __fence_is_later(u32 f1, u32 f2)
+{
+ return (int)(f1 - f2) > 0;
+}
+
+/**
* fence_is_later - return if f1 is chronologically later than f2
* @f1: [in] the first fence from the same context
* @f2: [in] the second fence from the same context
@@ -293,7 +306,7 @@ static inline bool fence_is_later(struct
if (WARN_ON(f1->context != f2->context))
return false;
- return (int)(f1->seqno - f2->seqno) > 0;
+ return __fence_is_later(f1->seqno, f2->seqno);
}
/**
Patches currently in stable-queue which might be from chris(a)chris-wilson.co.uk are
queue-4.9/dma-buf-sw-sync-fix-the-is-signaled-test-to-handle-u32-wraparound.patch
queue-4.9/dma-fence-clear-fence-status-during-dma_fence_init.patch
queue-4.9/dma-buf-sw-sync-fix-locking-around-sync_timeline-lists.patch
queue-4.9/dma-fence-wrap-querying-the-fence-status.patch
queue-4.9/dma-buf-sw_sync-clean-up-list-before-signaling-the-fence.patch
queue-4.9/dma-buf-sw-sync-reduce-irqsave-irqrestore-from-known-context.patch
queue-4.9/dma-buf-sw_sync-move-timeline_fence_ops-around.patch
queue-4.9/dma-buf-sw-sync-prevent-user-overflow-on-timeline-advance.patch
queue-4.9/dma-fence-introduce-drm_fence_set_error-helper.patch
queue-4.9/dma-buf-sw_sync-force-signal-all-unsignaled-fences-on-dying-timeline.patch
queue-4.9/dma-buf-sw-sync-use-an-rbtree-to-sort-fences-in-the-timeline.patch
queue-4.9/dma-buf-sw-sync-sync_pt-is-private-and-of-fixed-size.patch
queue-4.9/dma-buf-dma-fence-extract-__dma_fence_is_later.patch