Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Dawei Li <set_pte_at@outlook.com>
To:     sumit.semwal@linaro.org, christian.koenig@amd.com
Cc:     benjamin.gaignard@collabora.com, lmark@codeaurora.org,
        labbott@redhat.com, Brian.Starkey@arm.com, jstultz@google.com,
        afd@ti.com, sspatil@android.com, linux-media@vger.kernel.org,
        dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org,
        linux-kernel@vger.kernel.org, Dawei Li <set_pte_at@outlook.com>
Subject: [PATCH] dma-buf: fix racing conflict of dma_heap_add()
Date:   Sun, 30 Oct 2022 19:37:00 +0800
Message-ID: <TYCP286MB2323950197F60FC3473123B7CA349@TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: TYCP286MB2323:EE_|OS3P286MB2709:EE_
X-MS-Office365-Filtering-Correlation-Id: 4cdf1d64-4620-4054-bfbc-08daba6b15da
X-MS-Exchange-SLBlob-MailProps: 70qbaZjg4mv1OqsmyvwVkO5pclI01FVpovJWLvgsAQ8XASbU4UOFaqFZL/PS2XbnOslcIt6Wz0uOSrOC9MGcWkJXC3bdrn+h519oQNbJEaL8MJvXBIOdsh89jAQfeDMMTP5LypWXzKXsx8nlrc/aMGMQfzEhe+Ws6WwLSAnvj0I7dCqywraaYzSvSCw7SxCd733Zr9JOCQPxgKAUs/6Rksg2iItWHErYYFlyGYezzUOKi/inmm0bxARf2o2Rz1/E47PEK37FbCpY8CJBfgqDPLx4nEfEhT6s3t7MW5sfqrS9qJc3wlFMRsDElf355N0PuFG0d/lsg1dFBeTDwXYGm1BcjdCgdBdkmWpgtd0EMxd5T2EXL6/FRB6dfaubfQXoceHEbgRoklqTeOddYl/42zOjEyROZcfZZN254tsOJB7MTyH/XHU0eOTZ1I0d92ANjy92T/UapdclR/SN6T/PgYMRv0XFcB7YQg3Ss/PF6yWMioH/qaCcJrBHqa3nSovpVSlk7Frm8qyvrI7/A+Ip0rSY2JKSJEh4NvycrQVplHqVj8S+/JCMacYgvCJpZSWUp5S3N8UYQuLXjvau2u+gQ5oS1PwXUXEnjdTAjpAkpt/8yPjvh1dQFO+SkAgDDulz9f29ZCremVJX4ghP/k0aF41fQin0jP/tSku/H0mD4TnUKxi8RwwrmnZYdmmf65bPaAFRvfkba30wCx2OhTJvrMcQkN45LyatOaO55nrsaF7w8Xqmb7DOfg==
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: npwPx69ixe1sxoMNDYfYUA7fZtfrSfxK62GQHUd5RopMghybxACdtqy/AS5vsojqtR0RiXMKW4dSNVaRf+QcmHCM3b/acDmxYIdCb9bOhFSyRGRVMJRiCDTdPvBzONPFtKmjE72Q0+PvofWBbuq7+D7o4Fxu1TXsqsWU8ER158ucWBZqR8njxcJOssosbuX7eqZYGKaRXob+PjlSJSFVEvMimh4xh2tPuCblIE1JVqO2mWEg6wkJqH+iOJFJUKbe5/5UFVDFVYrntdhnS1Vj9AXcp2bLLmzjQDWs6jYtO/dTukU67NJkGKPKNZAs30FTW6DYpsn2/wAPuGMHYPWJ1tPOvJwBPq0ZCO5puoKtSzYuPm8EWzZJu/2/plLVh6kwZY5BvRYav9jAaP+8IPZ7cqdvNbm0W6WYCCePbND3wVb7NOCTfSfedOJumn619c8Q9A+0/PfUDY8iKEPTjXp6dc+5nvCkwg/pgEzDY/ZePJNoEPTiHkoJMbtZhwOVnhCl848M2HT6Iow+8C+dUFgB7MiYbeScJHPidJbG8vVZE1YLfcz8ZcNsfaTCiUJrOcfavi/UFVSp7ti4XhDdgzsaa3v1O/uEh3GBo3wr55cqThARCOXpSdAO3mlm5korTby3aHo1zzf/QZfHchiTM2O/N3019oO7Ql+FHV8US4L8xutCFi9hsintRYFe6LxYXSAk
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?uGvSjUt3TnD/upyIr0DnlNx3FB7ZyABhagnJeFMh71SgKZpSUggnwRJhkfPq?=
 =?us-ascii?Q?3Ax+VfCKY96Rr/rXjby1YpcrReqtb+VkQ/rQHoTSSrQKGdFfRSp9usQCI/1f?=
 =?us-ascii?Q?456r4J9uD1yrVWmVK7vlKjgp4XgeZ8PWDoTEVMMwZuo+xAC4uSS0LsW/ICke?=
 =?us-ascii?Q?XDDVgO9FROsVV+wXi2W8Narz2BkkA06QklqdO0GetlhQop3QYOOuOdqzsGqN?=
 =?us-ascii?Q?DySISNa+RGk5trBSOxxnpTiPRjAURoRYw/hs4ybOgygfj7FrR0bkxFeIUs5P?=
 =?us-ascii?Q?JfzE6k1r09xuNQp1XAK6gdRc/uVC0XdDmTqrPuc16k4/SKNzliJmxI/tDfUP?=
 =?us-ascii?Q?z2eVHc4NBufi2AsQfNpJ2slzf3ePbMnN/hCbvtpcYcDwap9X2mTvkx8icXog?=
 =?us-ascii?Q?pKMPtHt2Ib5kfQrFJtCgcINLpwHf+IHbE54TBfMl8twtxdSLfMguNfzAoOmg?=
 =?us-ascii?Q?HIkxfujkdhIqO5cf7xfuXwkisj4qVaJxIGP5UHwaimFYZ6zYBk9bvdEwTwEe?=
 =?us-ascii?Q?f15XX6Vy0Cbp7pX4io4iyc03gAKyUwzdzoCnurJZX46EZ7eemptmm7A7UnZX?=
 =?us-ascii?Q?d/n8J0I5xW6bE6ogYkOJxGQlt1+LHip7f5YkQ6QM9NXKjPzRILShuYArvwP8?=
 =?us-ascii?Q?k7HHXUwRHeMFjvRgLYpLYRABTIVUvf0LWPWNHvb7SuV23PXUQduoHkrbpefx?=
 =?us-ascii?Q?IC4OjrMEGdbYAjTHSGEe7kPT0HgJ1lv9Ay67mhUZPHU3oR6BPgyFoG6WJZEN?=
 =?us-ascii?Q?gqAEySlKIIBURtw4gtVMyOcbP3TF6R5Dm5EYWypwOdrK+N9Am0Kz/hXJepRV?=
 =?us-ascii?Q?bFFxBrU7cnWBkXZ2grgxo3kYngX6QpIIVfJ48xloeBE+JuLOPE3xwCaRtepn?=
 =?us-ascii?Q?yMIAhAXSgMjuZjUBnF4nYsOoahxl85YS2t5andR48zZrlRQRX9vSrF5K1RpQ?=
 =?us-ascii?Q?R8MPl6ivSS4DUg85IcG9RUiU77YvoxFKt1h0hyQG8fl6XfA5rWOtGNxSaynx?=
 =?us-ascii?Q?+rNwmrsJE6igCwpWQ1Z4RgLvoEoL0S+MIDVKVa2O10uUaGWq4Cm1LMALyeVc?=
 =?us-ascii?Q?J0Ex7n9S2XXXLdis0NI48In9Dhb+qC+gS0/JOoz7WeRq56KLw0uI/TsXEuPt?=
 =?us-ascii?Q?VtUlkT3ZFPYMIBqNwLA0q84nfjeME6v4d9DrfF8GTyWUuvQHtc/7G9Tk0iR0?=
 =?us-ascii?Q?gMFN/SivhOHCsTQlKLtqGpPl0anElXMf+ZurA70b3sqwhXjs0LVB+1EX3lRn?=
 =?us-ascii?Q?Tuktl+UcbfH6YqawdQnV61zricy62yny3tSL+39j8A=3D=3D?=
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4cdf1d64-4620-4054-bfbc-08daba6b15da
X-MS-Exchange-CrossTenant-AuthSource: TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Oct 2022 11:37:12.0082
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: OS3P286MB2709
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,
        RCVD_IN_DNSWL_NONE,SPF_HELO_PASS,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Racing conflict could be:
task A                 task B
list_for_each_entry
strcmp(h->name))
                       list_for_each_entry
                       strcmp(h->name)
kzalloc                kzalloc
......                 .....
device_create          device_create
list_add
                       list_add

The root cause is that task B has no idea about the fact someone
else(A) has inserted heap with same name when it calls list_add,
so a potential collision occurs.

Fixes: c02a81fba74f ("dma-buf: Add dma-buf heaps framework")

base-commit: 447fb14bf07905b880c9ed1ea92c53d6dd0649d7

Signed-off-by: Dawei Li <set_pte_at@outlook.com>
---
 drivers/dma-buf/dma-heap.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c
index 8f5848aa144f..ff44c2777b04 100644
--- a/drivers/dma-buf/dma-heap.c
+++ b/drivers/dma-buf/dma-heap.c
@@ -243,11 +243,12 @@ struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info)
 			return ERR_PTR(-EINVAL);
 		}
 	}
-	mutex_unlock(&heap_list_lock);
 
 	heap = kzalloc(sizeof(*heap), GFP_KERNEL);
-	if (!heap)
+	if (!heap) {
+		mutex_unlock(&heap_list_lock);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	heap->name = exp_info->name;
 	heap->ops = exp_info->ops;
@@ -284,7 +285,6 @@ struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info)
 		goto err2;
 	}
 	/* Add heap to the list */
-	mutex_lock(&heap_list_lock);
 	list_add(&heap->list, &heap_list);
 	mutex_unlock(&heap_list_lock);
 
@@ -296,6 +296,7 @@ struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info)
 	xa_erase(&dma_heap_minors, minor);
 err0:
 	kfree(heap);
+	mutex_unlock(&heap_list_lock);
 	return err_ret;
 }
 
-- 
2.25.1