RE: [PATCH] dmabuf: use spinlock to access dmabuf->name

[David Laight]

From: Charan Teja Kalla
> Sent: 17 June 2020 07:29
...
> >> If name is freed you will copy garbage, but the only way
> >> for that to happen is that _set_name or _release have to be called
> >> at just the right time.
> >>
> >> And the above would probably only be an issue if the set_name
> >> was called, so you will get NULL or a real name.
> 
> And there exists a use-after-free to avoid which requires the lock. Say
> that memcpy() in dmabuffs_dname is in progress and in parallel _set_name
> will free the same buffer that memcpy is operating on.

If the name is being looked at while the item is being freed
you almost certainly have much bigger problems that just
the name being a 'junk' pointer.

	David.

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)