superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/include/trace/events
History
Tvrtko Ursulin 506aa8b02a dma-fence: Add safe access helpers and document the rules 
Dma-fence objects currently suffer from a potential use after free problem
where fences exported to userspace and other drivers can outlive the
exporting driver, or the associated data structures.

The discussion on how to address this concluded that adding reference
counting to all the involved objects is not desirable, since it would need
to be very wide reaching and could cause unloadable drivers if another
entity would be holding onto a signaled fence reference potentially
indefinitely.

This patch enables the safe access by introducing and documenting a
contract between fence exporters and users. It documents a set of
contraints and adds helpers which a) drivers with potential to suffer from
the use after free must use and b) users of the dma-fence API must use as
well.

Premise of the design has multiple sides:

1. Drivers (fence exporters) MUST ensure a RCU grace period between
signalling a fence and freeing the driver private data associated with it.

The grace period does not have to follow the signalling immediately but
HAS to happen before data is freed.

2. Users of the dma-fence API marked with such requirement MUST contain
the complete access to the data within a single code block guarded by
rcu_read_lock() and rcu_read_unlock().

The combination of the two ensures that whoever sees the
DMA_FENCE_FLAG_SIGNALED_BIT not set is guaranteed to have access to a
valid fence->lock and valid data potentially accessed by the fence->ops
virtual functions, until the call to rcu_read_unlock().

3. Module unload (fence->ops) disappearing is for now explicitly not
handled. That would required a more complex protection, possibly needing
SRCU instead of RCU to handle callers such as dma_fence_release() and
dma_fence_wait_timeout(), where race between
dma_fence_enable_sw_signaling, signalling, and dereference of
fence->ops->wait() would need a sleeping SRCU context.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20250610164226.10817-4-tvrtko.ursulin@igalia.com
 		2025-06-13 08:26:49 +01:00
..
9p.h 9p: prevent read overrun in protocol dump tracepoint 2023-12-05 21:18:44 +09:00
afs.h rxrpc: Display security params in the afs_cb_call tracepoint 2025-04-14 17:36:42 -07:00
alarmtimer.h
…
amdxdna.h accel/amdxdna: Add command execution 2024-11-22 11:43:27 -07:00
asoc.h ALSA: trace: use snd_pcm_direction_name() 2024-08-01 12:50:03 +02:00
avc.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
bcache.h
…
block.h traceevent/block: Add REQ_ATOMIC flag to block trace events 2025-05-23 09:18:48 -06:00
bpf_test_run.h bpf: add bpf_modify_return_test_tp() kfunc triggering tracepoint 2024-03-28 18:31:40 -07:00
bridge.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
btrfs.h btrfs: tracepoints: remove no longer used tracepoints for eb locking 2025-05-15 14:30:45 +02:00
cachefiles.h cachefiles: Add auxiliary data trace 2024-12-20 22:34:05 +01:00
capability.h security: add trace event for cap_capable 2024-12-04 20:59:21 -06:00
cgroup.h cgroup: use subsystem-specific rstat locks to avoid contention 2025-05-19 10:29:42 -10:00
clk.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
cma.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
compaction.h mm: compaction: update the cc->nr_migratepages when allocating or freeing the freepages 2024-02-22 10:24:50 -08:00
context_tracking.h
…
cpuhp.h
…
csd.h smp: Change function signatures to use call_single_data_t 2023-09-13 14:59:24 +02:00
damon.h mm/damon: fix order of arguments in damos_before_apply tracepoint 2024-12-05 19:54:47 -08:00
devfreq.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
devlink.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
dlm.h dlm: remove lkb from callback tracepoints 2024-04-01 13:31:12 -05:00
dma.h dma-mapping: trace more error paths 2024-10-29 08:54:06 +01:00
dma_fence.h dma-fence: Add safe access helpers and document the rules 2025-06-13 08:26:49 +01:00
erofs.h erofs: refine readahead tracepoint 2025-05-16 05:56:38 +08:00
error_report.h
…
exceptions.h x86/tracing, x86/mm: Move page fault tracepoints to generic 2025-05-16 10:13:59 +02:00
ext4.h ext4: remove tracing for FALLOC_FL_NO_HIDE_STALE 2024-08-28 16:53:57 +02:00
f2fs.h f2fs: remove wbc->for_reclaim handling 2025-05-08 15:22:45 +00:00
fib.h
…
fib6.h tracing: ipv6: Add flow label to fib6_table_lookup tracepoint 2024-12-19 16:02:22 +01:00
filelock.h filelock: split leases out of struct file_lock 2024-02-05 13:11:44 +01:00
filemap.h filemap: add trace events for get_pages, map_pages, and fault 2024-09-01 20:26:10 -07:00
firewire.h firewire: core: rename cause flag of tracepoints event 2024-09-12 22:30:38 +09:00
firewire_ohci.h firewire: ohci: add tracepoints event for data of Self-ID DMA 2024-07-04 09:07:14 +09:00
fs_dax.h fsdax: Remove unused trace events for dax insert mapping 2025-06-03 15:18:45 -04:00
fscache.h cachefiles: fix slab-use-after-free in fscache_withdraw_volume() 2024-07-03 10:36:14 +02:00
fsi.h
…
fsi_master_aspeed.h
…
fsi_master_ast_cf.h
…
fsi_master_gpio.h
…
fsi_master_i2cr.h
…
gpio.h
…
gpu_mem.h
…
habanalabs.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
handshake.h
…
host1x.h
…
huge_memory.h khugepaged: pass folio instead of head page to trace events 2025-05-12 23:50:38 -07:00
hugetlbfs.h hugetlb: fix NULL pointer dereference in trace_hugetlbfs_alloc_inode 2025-01-12 19:03:36 -08:00
hw_pressure.h sched/cpufreq: Rename arch_update_thermal_pressure() => arch_update_hw_pressure() 2024-04-24 12:08:01 +02:00
hwmon.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
i2c.h
…
i2c_slave.h
…
ib_mad.h
…
ib_umad.h
…
icmp.h net/ipv4: add tracepoint for icmp_send 2024-05-08 10:39:26 +01:00
initcall.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
intel-sst.h
…
intel_ifs.h trace: platform/x86/intel/ifs: Add SBAF trace support 2024-08-12 16:36:11 +02:00
intel_ish.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
io_uring.h trace/io_uring: fix io_uring_local_work_run ctx documentation 2025-05-22 10:07:34 -06:00
iocost.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
iommu.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
ipi.h
…
irq.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
irq_matrix.h genirq/matrix: Remove unused irq_matrix_alloc_reserved tracepoint 2025-06-02 13:12:26 -04:00
iscsi.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
jbd2.h
…
kmem.h mm/page_alloc: add trace event for totalreserve_pages calculation 2025-03-17 22:07:03 -07:00
ksm.h mm/ksm: add tracepoint for ksm advisor 2023-12-29 11:58:27 -08:00
kvm.h LoongArch: KVM: Add iocsr and mmio bus simulation in kernel 2024-11-13 16:18:26 +08:00
kyber.h
…
libata.h
…
lock.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
maple_tree.h
…
mce.h x86/MCE/AMD: Add support for new MCA_SYND{1,2} registers 2024-10-31 10:36:07 +01:00
mctp.h
…
mdio.h trace: events: cleanup deprecated strncpy uses 2024-04-05 22:10:25 -07:00
memcg.h memcg: add flush tracepoint 2024-11-11 00:26:46 -08:00
migrate.h mm/migrate: add MR_DAMON to migrate_reason 2024-07-03 19:30:12 -07:00
mlxsw.h
…
mmap.h
…
mmap_lock.h mm: mmap_lock: optimize mmap_lock tracepoints 2025-01-13 22:40:34 -08:00
mmc.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
mmflags.h mm: remove VM_PAT 2025-05-22 14:55:37 -07:00
module.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
mptcp.h mptcp: sched: check both directions for backup 2024-07-30 10:27:29 +02:00
napi.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
nbd.h nbd: Use NULL to represent a pointer 2024-05-14 07:22:35 -06:00
neigh.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
net.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
net_probe_common.h trace: adjust TP_STORE_ADDR_PORTS_SKB() parameters 2024-04-03 19:26:14 -07:00
netfs.h netfs: Fix undifferentiation of DIO reads from unbuffered reads 2025-05-23 10:35:03 +02:00
netlink.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
nilfs2.h nilfs2: use __field_struct() for a bitwise field 2024-05-11 15:51:43 -07:00
nmi.h
…
notifier.h
…
objagg.h
…
oom.h mm: improve code consistency with zonelist_* helper functions 2024-09-01 20:25:55 -07:00
osnoise.h trace/osnoise: Add trace events for samples 2025-02-26 19:44:30 -05:00
page_isolation.h
…
page_pool.h page_pool: devmem support 2024-09-11 20:44:31 -07:00
page_ref.h trace/events/page_ref: trace the raw page mapcount value 2024-05-05 17:53:31 -07:00
pagemap.h
…
percpu.h
…
power.h tracing: PM: Remove unused clock events 2025-06-06 20:25:56 -04:00
power_cpu_migrate.h
…
preemptirq.h tracing: Remove definition of trace_*_rcuidle() 2024-10-08 21:17:39 -04:00
printk.h
…
pwc.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
pwm.h pwm: Add tracing for waveform callbacks 2024-09-28 15:13:56 +02:00
qdisc.h tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset() 2024-06-27 11:06:30 +02:00
qla.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
qrtr.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
rcu.h RCU pull request for v6.15 2025-03-24 19:41:37 -07:00
rdma_core.h
…
regulator.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
rpcgss.h sunrpc: implement rfc2203 rpcsec_gss seqnum cache 2025-05-19 10:14:29 -04:00
rpcrdma.h svcrdma: Handle device removal outside of the CM event handler 2024-09-20 19:31:03 -04:00
rpm.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
rseq.h
…
rtc.h
…
rust_sample.h rust: samples: add tracepoint to Rust sample 2024-11-04 16:21:44 -05:00
rwmmio.h
…
rxrpc.h rxrpc: Add more CHALLENGE/RESPONSE packet tracing 2025-04-14 17:36:42 -07:00
sched.h - The 11 patch series "Add folio_mk_pte()" from Matthew Wilcox 2025-05-31 15:44:16 -07:00
sched_ext.h sched_ext: Add trace point to track sched_ext core events 2025-03-04 08:06:17 -10:00
scmi.h include: trace: Widen the tag buffer in trace_scmi_dump_msg 2024-03-26 11:17:40 +00:00
scsi.h scsi: usb: Rename the RESERVE and RELEASE constants 2025-02-12 22:20:55 -05:00
sctp.h
…
signal.h
…
siox.h
…
skb.h net: add rx_sk to trace_kfree_skb 2024-06-19 12:44:22 +01:00
smbus.h
…
sock.h net: Retire DCCP socket. 2025-04-11 18:58:10 -07:00
sof.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
sof_intel.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
spi.h
…
spmi.h
…
sunrpc.h NFS Clent Updates for Linux 6.16 2025-06-03 16:13:32 -07:00
sunvnet.h
…
swiotlb.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
syscalls.h tracing: Declare system call tracepoints with TRACE_EVENT_SYSCALL 2024-10-09 17:05:54 -04:00
target.h scsi: usb: Rename the RESERVE and RELEASE constants 2025-02-12 22:20:55 -05:00
task.h tracing: Remove pid in task_rename tracing output 2024-12-22 20:28:11 -08:00
tcp.h tracing updates for v6.16: 2025-05-29 21:04:36 -07:00
tegra_apb_dma.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
thp.h
…
timer.h tracing/timers: Rename the hrtimer_init event to hrtimer_setup 2025-04-05 10:30:17 +02:00
timer_migration.h timers/migration: Rename childmask by groupmask to make naming more obvious 2024-07-22 18:03:34 +02:00
timestamp.h fs: tracepoints around multigrain timestamp events 2024-10-10 10:20:52 +02:00
tlb.h
…
tsm_mr.h tsm-mr: Add TVM Measurement Register support 2025-05-08 19:17:33 -07:00
udp.h trace: adjust TP_STORE_ADDR_PORTS_SKB() parameters 2024-04-03 19:26:14 -07:00
v4l2.h
…
vb2.h
…
vmalloc.h
…
vmscan.h vmscan: add a vmscan event for reclaim_pages 2024-11-06 20:11:13 -08:00
vsock_virtio_transport_common.h vsock/virtio: MSG_ZEROCOPY flag support 2023-09-21 12:34:00 +02:00
watchdog.h
…
wbt.h
…
workqueue.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
writeback.h writeback: fix calculations in trace_balance_dirty_pages() for cgwb 2025-03-17 00:05:37 -07:00
xdp.h xdp: Remove unused mem_return_failed event 2025-06-02 13:12:26 -04:00
xen.h x86/xen: move paravirt lazy code 2023-09-19 07:04:49 +02:00