Patch "dma-buf: WARN on dmabuf release with pending attachments" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    dma-buf: WARN on dmabuf release with pending attachments

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     dma-buf-warn-on-dmabuf-release-with-pending-attachme.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 36226f6738ce3313a9956b16db332be106a28017
Author: Charan Teja Reddy <charante@xxxxxxxxxxxxxx>
Date:   Fri Jul 23 18:01:08 2021 +0530

    dma-buf: WARN on dmabuf release with pending attachments
    
    [ Upstream commit f492283b157053e9555787262f058ae33096f568 ]
    
    It is expected from the clients to follow the below steps on an imported
    dmabuf fd:
    a) dmabuf = dma_buf_get(fd) // Get the dmabuf from fd
    b) dma_buf_attach(dmabuf); // Clients attach to the dmabuf
       o Here the kernel does some slab allocations, say for
    dma_buf_attachment and may be some other slab allocation in the
    dmabuf->ops->attach().
    c) Client may need to do dma_buf_map_attachment().
    d) Accordingly dma_buf_unmap_attachment() should be called.
    e) dma_buf_detach () // Clients detach to the dmabuf.
       o Here the slab allocations made in b) are freed.
    f) dma_buf_put(dmabuf) // Can free the dmabuf if it is the last
    reference.
    
    Now say an erroneous client failed at step c) above thus it directly
    called dma_buf_put(), step f) above. Considering that it may be the last
    reference to the dmabuf, buffer will be freed with pending attachments
    left to the dmabuf which can show up as the 'memory leak'. This should
    at least be reported as the WARN().
    
    Signed-off-by: Charan Teja Reddy <charante@xxxxxxxxxxxxxx>
    Reviewed-by: Christian König <christian.koenig@xxxxxxx>
    Link: https://patchwork.freedesktop.org/patch/msgid/1627043468-16381-1-git-send-email-charante@xxxxxxxxxxxxxx
    Signed-off-by: Christian König <christian.koenig@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 758de0e9b2ddc..16bbc9bc9e6d1 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -79,6 +79,7 @@ static void dma_buf_release(struct dentry *dentry)
 	if (dmabuf->resv == (struct dma_resv *)&dmabuf[1])
 		dma_resv_fini(dmabuf->resv);
 
+	WARN_ON(!list_empty(&dmabuf->attachments));
 	module_put(dmabuf->owner);
 	kfree(dmabuf->name);
 	kfree(dmabuf);