dma-buf: fix sleep-while-atomic in dmabuffs_dname
There is a sleep-while-atomic reported when the selinux tries to dump the file path name of a dmabuf file using d_path(). Fix it. Flow will be like below: flush_unauthorized_files --> iterate_fd --> spin_lock --> Start of the atomic section match_file --> file_has_perm --> avc_has_perm --> avc_audit --> slow_avc_audit --> common_lsm_audit --> dump_common_audit_data --> audit_log_d_path --> d_path --> dmabuffs_dname --> mutex_lock--> Sleep while atomic. Change-Id: Ieed88a9093355d160e1c194d31fe33f1c7dadf60 Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
This commit is contained in:
parent
49f043455b
commit
15ff230bc5
2 changed files with 8 additions and 4 deletions
|
@ -92,10 +92,10 @@ static char *dmabuffs_dname(struct dentry *dentry, char *buffer, int buflen)
|
|||
goto out;
|
||||
}
|
||||
spin_unlock(&dentry->d_lock);
|
||||
mutex_lock(&dmabuf->lock);
|
||||
spin_lock(&dmabuf->name_lock);
|
||||
if (dmabuf->name)
|
||||
ret = strlcpy(name, dmabuf->name, DMA_BUF_NAME_LEN);
|
||||
mutex_unlock(&dmabuf->lock);
|
||||
spin_unlock(&dmabuf->name_lock);
|
||||
dmabuf_dent_put(dmabuf);
|
||||
out:
|
||||
return dynamic_dname(dentry, buffer, buflen, "/%s:%s",
|
||||
|
@ -401,8 +401,10 @@ static long dma_buf_set_name(struct dma_buf *dmabuf, const char __user *buf)
|
|||
kfree(name);
|
||||
goto out_unlock;
|
||||
}
|
||||
spin_lock(&dmabuf->name_lock);
|
||||
kfree(dmabuf->name);
|
||||
dmabuf->name = name;
|
||||
spin_unlock(&dmabuf->name_lock);
|
||||
|
||||
out_unlock:
|
||||
mutex_unlock(&dmabuf->lock);
|
||||
|
@ -472,10 +474,10 @@ static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file)
|
|||
/* Don't count the temporary reference taken inside procfs seq_show */
|
||||
seq_printf(m, "count:\t%ld\n", file_count(dmabuf->file) - 1);
|
||||
seq_printf(m, "exp_name:\t%s\n", dmabuf->exp_name);
|
||||
mutex_lock(&dmabuf->lock);
|
||||
spin_lock(&dmabuf->name_lock);
|
||||
if (dmabuf->name)
|
||||
seq_printf(m, "name:\t%s\n", dmabuf->name);
|
||||
mutex_unlock(&dmabuf->lock);
|
||||
spin_unlock(&dmabuf->name_lock);
|
||||
}
|
||||
|
||||
static const struct file_operations dma_buf_fops = {
|
||||
|
@ -619,6 +621,7 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
|
|||
dmabuf->size = exp_info->size;
|
||||
dmabuf->exp_name = exp_info->exp_name;
|
||||
dmabuf->owner = exp_info->owner;
|
||||
spin_lock_init(&dmabuf->name_lock);
|
||||
init_waitqueue_head(&dmabuf->poll);
|
||||
dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll;
|
||||
dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0;
|
||||
|
|
|
@ -427,6 +427,7 @@ struct dma_buf {
|
|||
char *buf_name;
|
||||
ktime_t ktime;
|
||||
const char *name;
|
||||
spinlock_t name_lock;
|
||||
struct module *owner;
|
||||
struct list_head list_node;
|
||||
void *priv;
|
||||
|
|
Loading…
Reference in a new issue