2023-12-12 05:22:15

by Joakim Zhang

Subject: [PATCH V1] dma-mapping: Set dma_mem pointer as NULL after it's freed

From: Joakim Zhang <[email protected]>

Reproduced with below sequence:
dma_declare_coherent_memory()->dma_release_coherent_memory()
->dma_declare_coherent_memory()->"return -EBUSY" error

It will return -EBUSY from the dma_assign_coherent_memory()
in dma_declare_coherent_memory(), the reason is that dev->dma_mem
pointer has not been set to NULL after it's freed.

Go through the driver, found there is a issue in
rmem_dma_device_release(), the reserved memory has not been
freed before "dev->dma_mem = NULL;". So if user call
of_reserved_mem_device_release(), will not free reserved mem
in fact.

Fixes: cf65a0f6f6ff ("dma-mapping: move all DMA mapping code to kernel/dma")
Signed-off-by: Joakim Zhang <[email protected]>
---
kernel/dma/coherent.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c
index c21abc77c53e..602e055fc1bf 100644
--- a/kernel/dma/coherent.c
+++ b/kernel/dma/coherent.c
@@ -132,8 +132,10 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr,

void dma_release_coherent_memory(struct device *dev)
{
- if (dev)
+ if (dev) {
_dma_release_coherent_memory(dev->dma_mem);
+ dev->dma_mem = NULL;
+ }
}

static void *__dma_alloc_from_coherent(struct device *dev,
@@ -349,8 +351,10 @@ static int rmem_dma_device_init(struct reserved_mem *rmem, struct device *dev)
static void rmem_dma_device_release(struct reserved_mem *rmem,
struct device *dev)
{
- if (dev)
+ if (dev) {
+ _dma_release_coherent_memory(rmem->priv);
dev->dma_mem = NULL;
+ }
}

static const struct reserved_mem_ops rmem_dma_ops = {
--
2.25.1

2023-12-12 14:30:36

by Joakim Zhang

Subject: 回复: [PATCH V1] dma-mapping: Set dma_mem poi nter as NULL after it's freed

Hi maintainers,

> -----?ʼ?ԭ??-----
> ??????: Joakim Zhang <[email protected]>
> ????ʱ??: 2023??12??12?? 13:22
> ?ռ???: [email protected]; [email protected]; [email protected]
> ????: [email protected]; [email protected];
> cix-kernel-upstream <[email protected]>; Joakim Zhang
> <[email protected]>
> ????: [PATCH V1] dma-mapping: Set dma_mem pointer as NULL after it's freed
>
> From: Joakim Zhang <[email protected]>
>
> Reproduced with below sequence:
> dma_declare_coherent_memory()->dma_release_coherent_memory()
> ->dma_declare_coherent_memory()->"return -EBUSY" error
>
> It will return -EBUSY from the dma_assign_coherent_memory() in
> dma_declare_coherent_memory(), the reason is that dev->dma_mem pointer
> has not been set to NULL after it's freed.
>
> Go through the driver, found there is a issue in rmem_dma_device_release(),
> the reserved memory has not been freed before "dev->dma_mem = NULL;". So
> if user call of_reserved_mem_device_release(), will not free reserved mem in
> fact.
>
> Fixes: cf65a0f6f6ff ("dma-mapping: move all DMA mapping code to
> kernel/dma")
> Signed-off-by: Joakim Zhang <[email protected]>
> ---
> kernel/dma/coherent.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c index
> c21abc77c53e..602e055fc1bf 100644
> --- a/kernel/dma/coherent.c
> +++ b/kernel/dma/coherent.c
> @@ -132,8 +132,10 @@ int dma_declare_coherent_memory(struct device
> *dev, phys_addr_t phys_addr,
>
> void dma_release_coherent_memory(struct device *dev) {
> - if (dev)
> + if (dev) {
> _dma_release_coherent_memory(dev->dma_mem);
> + dev->dma_mem = NULL;
> + }
> }
>
> static void *__dma_alloc_from_coherent(struct device *dev, @@ -349,8
> +351,10 @@ static int rmem_dma_device_init(struct reserved_mem *rmem,
> struct device *dev) static void rmem_dma_device_release(struct
> reserved_mem *rmem,
> struct device *dev)
> {
> - if (dev)
> + if (dev) {
> + _dma_release_coherent_memory(rmem->priv);

Per my understanding, this change may not need, since this is reserved memory from device tree, once calling of_reserved_mem_device_init_by_idx() to initialize, it will be added to "of_rmem_assigned_device_list" list. Even calling of_reserved_mem_device_release() to release it, it's unnecessary to unremap and free it, since it's "reserved memory", only need to unbind from the device. When we call of_reserved_mem_device_init_by_idx() again, just need to find it from the list then bind it.

Right?

Joakim

> dev->dma_mem = NULL;
> + }
> }
>
> static const struct reserved_mem_ops rmem_dma_ops = {
> --
> 2.25.1