tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ANDROID: dma-buf: Add vendor hook for dmabuf stats attribute_show

Browse Source 
When using android_rvh_dma_buf_stats_teardown to implement asynchronous
release of dmabuf sysfs stats, the dmabuf stats attribute_show needs to
first get dmabuf to prevent UAF issues caused by dmabuf release.
Add two hook points to implement get dmabuf and put dmabuf respectively.

Bug: 401424955
Change-Id: Ie522b0cede07445b4eb0cc8ec3e5c84113ce9813
Signed-off-by: yipeng xiang <yipengxiang@honor.corp-partner.google.com>
(cherry picked from commit d89f54da2ee21d282f1d4f970382a210f1b0cb4d)
This commit is contained in:
yipeng xiang
2025-03-11 16:32:31 +08:00
committed by Treehugger Robot
parent 00b48816c3
commit ff2bd2c027
3 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/android/vendor_hooks.c
+2
View File
@@ -350,6 +350,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_do_sp_pc_abort);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_psi_event);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_psi_group);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_dma_buf_stats_teardown);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dma_buf_attr_show_start);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dma_buf_attr_show_end);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dpm_wait_start);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dpm_wait_finish);
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_uplink_send_msg);
drivers/dma-buf/dma-buf-sysfs-stats.c
+6 -1
View File
@@ -66,6 +66,7 @@ static ssize_t dma_buf_stats_attribute_show(struct kobject *kobj,
struct dma_buf_stats_attribute *attribute;
struct dma_buf_sysfs_entry *sysfs_entry;
struct dma_buf *dmabuf;
ssize_t ret;
attribute = to_dma_buf_stats_attr(attr);
sysfs_entry = to_dma_buf_entry_from_kobj(kobj);
@@ -74,7 +75,11 @@ static ssize_t dma_buf_stats_attribute_show(struct kobject *kobj,
if (!dmabuf || !attribute->show)
return -EIO;
return attribute->show(dmabuf, attribute, buf);
trace_android_vh_dma_buf_attr_show_start(&dmabuf);
ret = attribute->show(dmabuf, attribute, buf);
trace_android_vh_dma_buf_attr_show_end(dmabuf);
return ret;
}
static const struct sysfs_ops dma_buf_stats_sysfs_ops = {
include/trace/hooks/dmabuf.h
+7
View File
@@ -22,6 +22,13 @@ DECLARE_HOOK(android_vh_dma_heap_buffer_alloc_start,
DECLARE_HOOK(android_vh_dma_heap_buffer_alloc_end,
TP_PROTO(const char *name, size_t len),
TP_ARGS(name, len));
struct dma_buf;
DECLARE_HOOK(android_vh_dma_buf_attr_show_start,
TP_PROTO(struct dma_buf **dmabuf),
TP_ARGS(dmabuf));
DECLARE_HOOK(android_vh_dma_buf_attr_show_end,
TP_PROTO(struct dma_buf *dmabuf),
TP_ARGS(dmabuf));
#endif /* _TRACE_HOOK_DMABUF_H */
/* This part must be outside protection */
#include <trace/define_trace.h>