dma-buf: acquire name lock before read/write dma_buf.name

Because dma-buf.name can be freed in func: "dma_buf_set_name",
so, we need to acquire lock first before we read/write dma_buf.name
to prevent Use After Free(UAF) issue.

Signed-off-by: Guangming Cao <Guangming.Cao@mediatek.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211008075420.42874-1-guangming.cao@mediatek.com

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 63d32261b63ff4ccc34a082aa5fe7ac5bad27052..92492e314bd9fa8ea12c550db255026094f2fc30 100644 (file)
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -1389,6 +1389,8 @@ static int dma_buf_debug_show(struct seq_file *s, void *unused)
                if (ret)
                        goto error_unlock;
 
+
+               spin_lock(&buf_obj->name_lock);
                seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\t%08lu\t%s\n",
                                buf_obj->size,
                                buf_obj->file->f_flags, buf_obj->file->f_mode,
@@ -1396,6 +1398,7 @@ static int dma_buf_debug_show(struct seq_file *s, void *unused)
                                buf_obj->exp_name,
                                file_inode(buf_obj->file)->i_ino,
                                buf_obj->name ?: "");
+               spin_unlock(&buf_obj->name_lock);
 
                robj = buf_obj->resv;
                fence = dma_resv_excl_fence(robj);