linux/drivers/dma-buf
Charan Teja Kalla 6348dd291e dmabuf: use spinlock to access dmabuf->name
There exists a sleep-while-atomic bug while accessing the dmabuf->name
under mutex in the dmabuffs_dname(). This is caused from the SELinux
permissions checks on a process where it tries to validate the inherited
files from fork() by traversing them through iterate_fd() (which
traverse files under spin_lock) and call
match_file(security/selinux/hooks.c) where the permission checks happen.
This audit information is logged using dump_common_audit_data() where it
calls d_path() to get the file path name. If the file check happen on
the dmabuf's fd, then it ends up in ->dmabuffs_dname() and use mutex to
access dmabuf->name. The flow will be like below:
flush_unauthorized_files()
  iterate_fd()
    spin_lock() --> Start of the atomic section.
      match_file()
        file_has_perm()
          avc_has_perm()
            avc_audit()
              slow_avc_audit()
	        common_lsm_audit()
		  dump_common_audit_data()
		    audit_log_d_path()
		      d_path()
                        dmabuffs_dname()
                          mutex_lock()--> Sleep while atomic.

Call trace captured (on 4.19 kernels) is below:
___might_sleep+0x204/0x208
__might_sleep+0x50/0x88
__mutex_lock_common+0x5c/0x1068
__mutex_lock_common+0x5c/0x1068
mutex_lock_nested+0x40/0x50
dmabuffs_dname+0xa0/0x170
d_path+0x84/0x290
audit_log_d_path+0x74/0x130
common_lsm_audit+0x334/0x6e8
slow_avc_audit+0xb8/0xf8
avc_has_perm+0x154/0x218
file_has_perm+0x70/0x180
match_file+0x60/0x78
iterate_fd+0x128/0x168
selinux_bprm_committing_creds+0x178/0x248
security_bprm_committing_creds+0x30/0x48
install_exec_creds+0x1c/0x68
load_elf_binary+0x3a4/0x14e0
search_binary_handler+0xb0/0x1e0

So, use spinlock to access dmabuf->name to avoid sleep-while-atomic.

Cc: <stable@vger.kernel.org> [5.3+]
Signed-off-by: Charan Teja Kalla <charante@codeaurora.org>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Acked-by: Christian König <christian.koenig@amd.com>
 [sumits: added comment to spinlock_t definition to avoid warning]
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/a83e7f0d-4e54-9848-4b58-e1acdbe06735@codeaurora.org
2020-07-10 15:39:29 +05:30
..
heaps dma-buf: heaps: Remove redundant heap identifier from system heap name 2019-12-17 21:37:40 +05:30
dma-buf.c dmabuf: use spinlock to access dmabuf->name 2020-07-10 15:39:29 +05:30
dma-fence-array.c dma-fence: Propagate errors to dma-fence-array container 2019-08-12 08:25:52 +01:00
dma-fence-chain.c dma-buf: Report signaled links inside dma-fence-chain 2020-04-09 19:52:03 +01:00
dma-fence.c dma-buf: Use atomic_fetch_add() for the context id 2020-05-13 13:38:59 +01:00
dma-heap.c dma-heap: Make the symbol 'dma_heap_ioctl_cmds' static 2019-12-18 00:41:29 +05:30
dma-resv.c DMA reservations: use the new mmap locking API 2020-06-09 09:39:14 -07:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile dma-buf: Exercise dma-fence-chain under selftests 2020-04-09 19:58:55 +01:00
selftest.c dma-buf: Introduce selftesting framework 2019-08-19 18:01:34 +01:00
selftest.h dma-buf: Introduce selftesting framework 2019-08-19 18:01:34 +01:00
selftests.h dma-buf: Exercise dma-fence-chain under selftests 2020-04-09 19:58:55 +01:00
seqno-fence.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
st-dma-fence-chain.c dma-buf: Exercise dma-fence-chain under selftests 2020-04-09 19:58:55 +01:00
st-dma-fence.c dmabuf: Mark up onstack timer for selftests 2019-08-20 13:49:15 +01:00
sw_sync.c compat_ioctl: move more drivers to compat_ptr_ioctl 2019-10-23 17:23:44 +02:00
sync_debug.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
sync_debug.h dma-buf: Remove unused sync_dump() 2019-04-23 09:30:07 +01:00
sync_file.c - A fix for a memory leak in the dma-buf support 2019-12-09 17:13:19 +10:00
sync_trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
udmabuf.c udmabuf: fix dma-buf cpu access 2019-12-18 09:11:38 +01:00