| Message ID | 20221026224640.7542-2-dmitry.osipenko@collabora.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fixes for dma-buf locking issues found by Smatch | expand |
Am 27.10.22 um 00:46 schrieb Dmitry Osipenko: > The dma_buf_detach() locks attach->dmabuf->resv and then unlocks > dmabuf->resv, which could be a two different locks from a static > code checker perspective. In particular this triggers Smatch to > report the "double unlock" error. Make the locking pointers consistent. > > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Link: https://lore.kernel.org/dri-devel/Y1fLfsccW3AS%2Fo+%2F@kili/ > Fixes: 809d9c72c2f8 ("dma-buf: Move dma_buf_attach() to dynamic locking specification") > Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> It would be even cleaner if we completely drop the dmabuf parameter for the function and just use the inside the attachment. Anyway patch is Reviewed-by: Christian König <christian.koenig@amd.com> for now, wider cleanups can come later on. Regards, Christian. > --- > drivers/dma-buf/dma-buf.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c > index c40d72d318fd..6e33ef4fde34 100644 > --- a/drivers/dma-buf/dma-buf.c > +++ b/drivers/dma-buf/dma-buf.c > @@ -998,9 +998,10 @@ void dma_buf_detach(struct dma_buf *dmabuf, struct dma_buf_attachment *attach) > if (WARN_ON(!dmabuf || !attach)) > return; > > - dma_resv_lock(attach->dmabuf->resv, NULL); > + dma_resv_lock(dmabuf->resv, NULL); > > if (attach->sgt) { > + WARN_ON(dmabuf != attach->dmabuf); > > __unmap_dma_buf(attach, attach->sgt, attach->dir); >
On 10/27/22 09:13, Christian König wrote: > Am 27.10.22 um 00:46 schrieb Dmitry Osipenko: >> The dma_buf_detach() locks attach->dmabuf->resv and then unlocks >> dmabuf->resv, which could be a two different locks from a static >> code checker perspective. In particular this triggers Smatch to >> report the "double unlock" error. Make the locking pointers consistent. >> >> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> >> Link: https://lore.kernel.org/dri-devel/Y1fLfsccW3AS%2Fo+%2F@kili/ >> Fixes: 809d9c72c2f8 ("dma-buf: Move dma_buf_attach() to dynamic >> locking specification") >> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> > > It would be even cleaner if we completely drop the dmabuf parameter for > the function and just use the inside the attachment. > > Anyway patch is Reviewed-by: Christian König <christian.koenig@amd.com> > for now, wider cleanups can come later on. I had the same thought about dropping the dmabuf parameter. Looking at this patch again, perhaps a better dmabuf sanity-check will be: - if (WARN_ON(!dmabuf || !attach)) + if (WARN_ON(!dmabuf || !attach || dmabuf != attach->dmabuf)) I'll switch to this version in v2, if there are no objections. > >> --- >> drivers/dma-buf/dma-buf.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c >> index c40d72d318fd..6e33ef4fde34 100644 >> --- a/drivers/dma-buf/dma-buf.c >> +++ b/drivers/dma-buf/dma-buf.c >> @@ -998,9 +998,10 @@ void dma_buf_detach(struct dma_buf *dmabuf, >> struct dma_buf_attachment *attach) >> if (WARN_ON(!dmabuf || !attach)) >> return; >> - dma_resv_lock(attach->dmabuf->resv, NULL); >> + dma_resv_lock(dmabuf->resv, NULL); >> if (attach->sgt) { >> + WARN_ON(dmabuf != attach->dmabuf); >> __unmap_dma_buf(attach, attach->sgt, attach->dir); >> >
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index c40d72d318fd..6e33ef4fde34 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -998,9 +998,10 @@ void dma_buf_detach(struct dma_buf *dmabuf, struct dma_buf_attachment *attach) if (WARN_ON(!dmabuf || !attach)) return; - dma_resv_lock(attach->dmabuf->resv, NULL); + dma_resv_lock(dmabuf->resv, NULL); if (attach->sgt) { + WARN_ON(dmabuf != attach->dmabuf); __unmap_dma_buf(attach, attach->sgt, attach->dir);
The dma_buf_detach() locks attach->dmabuf->resv and then unlocks dmabuf->resv, which could be a two different locks from a static code checker perspective. In particular this triggers Smatch to report the "double unlock" error. Make the locking pointers consistent. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/dri-devel/Y1fLfsccW3AS%2Fo+%2F@kili/ Fixes: 809d9c72c2f8 ("dma-buf: Move dma_buf_attach() to dynamic locking specification") Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> --- drivers/dma-buf/dma-buf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)