From ff2bd2c02721a153ffab96c5156e714c5dff55cb Mon Sep 17 00:00:00 2001 From: yipeng xiang Date: Tue, 11 Mar 2025 16:32:31 +0800 Subject: [PATCH] ANDROID: dma-buf: Add vendor hook for dmabuf stats attribute_show When using android_rvh_dma_buf_stats_teardown to implement asynchronous release of dmabuf sysfs stats, the dmabuf stats attribute_show needs to first get dmabuf to prevent UAF issues caused by dmabuf release. Add two hook points to implement get dmabuf and put dmabuf respectively. Bug: 401424955 Change-Id: Ie522b0cede07445b4eb0cc8ec3e5c84113ce9813 Signed-off-by: yipeng xiang (cherry picked from commit d89f54da2ee21d282f1d4f970382a210f1b0cb4d) --- drivers/android/vendor_hooks.c | 2 ++ drivers/dma-buf/dma-buf-sysfs-stats.c | 7 ++++++- include/trace/hooks/dmabuf.h | 7 +++++++ 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index c280f0865180..63bc27a22586 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -350,6 +350,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_do_sp_pc_abort); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_psi_event); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_psi_group); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_dma_buf_stats_teardown); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dma_buf_attr_show_start); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dma_buf_attr_show_end); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dpm_wait_start); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dpm_wait_finish); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_uplink_send_msg); diff --git a/drivers/dma-buf/dma-buf-sysfs-stats.c b/drivers/dma-buf/dma-buf-sysfs-stats.c index 19f1248b4196..f02a15142c1c 100644 --- a/drivers/dma-buf/dma-buf-sysfs-stats.c +++ b/drivers/dma-buf/dma-buf-sysfs-stats.c @@ -66,6 +66,7 @@ static ssize_t dma_buf_stats_attribute_show(struct kobject *kobj, struct dma_buf_stats_attribute *attribute; struct dma_buf_sysfs_entry *sysfs_entry; struct dma_buf *dmabuf; + ssize_t ret; attribute = to_dma_buf_stats_attr(attr); sysfs_entry = to_dma_buf_entry_from_kobj(kobj); @@ -74,7 +75,11 @@ static ssize_t dma_buf_stats_attribute_show(struct kobject *kobj, if (!dmabuf || !attribute->show) return -EIO; - return attribute->show(dmabuf, attribute, buf); + trace_android_vh_dma_buf_attr_show_start(&dmabuf); + ret = attribute->show(dmabuf, attribute, buf); + trace_android_vh_dma_buf_attr_show_end(dmabuf); + + return ret; } static const struct sysfs_ops dma_buf_stats_sysfs_ops = { diff --git a/include/trace/hooks/dmabuf.h b/include/trace/hooks/dmabuf.h index 6b3233734ed4..3b637ef1c3ea 100644 --- a/include/trace/hooks/dmabuf.h +++ b/include/trace/hooks/dmabuf.h @@ -22,6 +22,13 @@ DECLARE_HOOK(android_vh_dma_heap_buffer_alloc_start, DECLARE_HOOK(android_vh_dma_heap_buffer_alloc_end, TP_PROTO(const char *name, size_t len), TP_ARGS(name, len)); +struct dma_buf; +DECLARE_HOOK(android_vh_dma_buf_attr_show_start, + TP_PROTO(struct dma_buf **dmabuf), + TP_ARGS(dmabuf)); +DECLARE_HOOK(android_vh_dma_buf_attr_show_end, + TP_PROTO(struct dma_buf *dmabuf), + TP_ARGS(dmabuf)); #endif /* _TRACE_HOOK_DMABUF_H */ /* This part must be outside protection */ #include