sync_file: Protect access to driver and timeline name

Protect the access to driver and timeline name which otherwise could be
freed as dma-fence exported is signalling fences.

This prepares the code for incoming dma-fence API changes which will start
asserting these accesses are done from a RCU locked section.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20250610164226.10817-2-tvrtko.ursulin@igalia.com

diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index 212df4b849febdd969b5980c469afadb04a247d9..747e377fb95417ddd506b528618a4288bea9d459 100644 (file)
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -135,12 +135,18 @@ char *sync_file_get_name(struct sync_file *sync_file, char *buf, int len)
                strscpy(buf, sync_file->user_name, len);
        } else {
                struct dma_fence *fence = sync_file->fence;
+               const char __rcu *timeline;
+               const char __rcu *driver;
 
+               rcu_read_lock();
+               driver = dma_fence_driver_name(fence);
+               timeline = dma_fence_timeline_name(fence);
                snprintf(buf, len, "%s-%s%llu-%lld",
-                        dma_fence_driver_name(fence),
-                        dma_fence_timeline_name(fence),
+                        rcu_dereference(driver),
+                        rcu_dereference(timeline),
                         fence->context,
                         fence->seqno);
+               rcu_read_unlock();
        }
 
        return buf;
@@ -262,9 +268,17 @@ err_put_fd:
 static int sync_fill_fence_info(struct dma_fence *fence,
                                 struct sync_fence_info *info)
 {
-       strscpy(info->obj_name, dma_fence_timeline_name(fence),
+       const char __rcu *timeline;
+       const char __rcu *driver;
+
+       rcu_read_lock();
+
+       driver = dma_fence_driver_name(fence);
+       timeline = dma_fence_timeline_name(fence);
+
+       strscpy(info->obj_name, rcu_dereference(timeline),
                sizeof(info->obj_name));
-       strscpy(info->driver_name, dma_fence_driver_name(fence),
+       strscpy(info->driver_name, rcu_dereference(driver),
                sizeof(info->driver_name));
 
        info->status = dma_fence_get_status(fence);
@@ -273,6 +287,8 @@ static int sync_fill_fence_info(struct dma_fence *fence,
                        ktime_to_ns(dma_fence_timestamp(fence)) :
                        ktime_set(0, 0);
 
+       rcu_read_unlock();
+
        return info->status;
 }