Received: by 10.223.185.111 with SMTP id b44csp849743wrg; Fri, 9 Mar 2018 15:09:14 -0800 (PST) X-Google-Smtp-Source: AG47ELs7N/5R00/XWd5zZGZNmEc9JwWmk1FA/ZWVBDsnyt/bziNMc4QZvJaX3iuCqm1W0YXaZpyy X-Received: by 2002:a17:902:e83:: with SMTP id 3-v6mr168958plx.158.1520636954862; Fri, 09 Mar 2018 15:09:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1520636954; cv=none; d=google.com; s=arc-20160816; b=NWUtblT1ZCjBzI5dE88QZVVNM1KnRayxTiuYO82tKXT+m3BiMeVhiKmSDH2LAfKwMb IMxlEp1/vTQ1eFQhre9dfGbNy+rKMRuhJ4tCpDTz08vMnY4KTg0G3vN8dE6wxTRjhLEw HDWPC2lLCBaTiBO8onD82ESZbgGkQ4Q8n3AMfbauRR0sXpILekSS130plTkST2A1VIb9 mgNfmRQhOoA3MTFEBP7gUGj6hwLXU5aDdg4mKtC1L3XiW9+b/CWBwa30JOajyvpNORvI JGM4SCp/gEI6QkERi9wUfEiKffahn6pA2WqA9mnXsmHRHibUogTYhVzoLUBQ3gnMs4on rElQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:from:references:cc:to:subject:dkim-signature :arc-authentication-results; bh=I0m2qKQKA3htpnUZ6Wt2PNon39JjogL9EEX2t/JZDyQ=; b=t+jwzisJ+RlLsEqB78dJoEn5BPFEy9BjhBOd5GPfEnz4XcudaDxsBBUxrllKr4OjNg yw/yHgYX8ofIs7il0eJpyoVlD1qujiebVRufa6Gyf/LpVqBNjRUN2bRZHDYbwJQPQlDz mJUNsbAMvxwd0RBbceyJz0spvUXLhWC8Su+t06OBoG4BAMmSt9dNHKuLMqSK2vUQEhaO afvjCcmlkqw66/sAgWONgdaDWG5nXQpS0gv5QTAR0b9vGE0Nl06UGMFiqY8BSuSZxZUO vpMTgmCTQBtO1K5NtbhDlgW9MSPMXiS2dFUdw0+avUdRGyIlvr+CH/v7KfMxuyI7F2Fk UbKg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ti.com header.s=ti-com-17Q1 header.b=kZZIX8D8; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=ti.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id r12-v6si1638026plo.359.2018.03.09.15.09.00; Fri, 09 Mar 2018 15:09:14 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@ti.com header.s=ti-com-17Q1 header.b=kZZIX8D8; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=ti.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932714AbeCIXIG (ORCPT + 99 others); Fri, 9 Mar 2018 18:08:06 -0500 Received: from lelnx193.ext.ti.com ([198.47.27.77]:49822 "EHLO lelnx193.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932327AbeCIXIE (ORCPT ); Fri, 9 Mar 2018 18:08:04 -0500 Received: from dflxv15.itg.ti.com ([128.247.5.124]) by lelnx193.ext.ti.com (8.15.1/8.15.1) with ESMTP id w29N6oml026501; Fri, 9 Mar 2018 17:06:50 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ti.com; s=ti-com-17Q1; t=1520636810; bh=pcBuGMEAE4pVIHdbLD3FTjPVeuarkHwBFT5SYTNPDSA=; h=Subject:To:CC:References:From:Date:In-Reply-To; b=kZZIX8D8H6KhFjMZaSLKkdKQy7Y9cO+ntH4D0ZWtO9Op1IM2KvMfqDSgmnf/S2hVZ MuWtINi/7o5rHZgiXpNL/dh4Vykw/hV3bSJ96yG4IE+l2GY4apD1dHYmP3GS8lmuFa ycTMC37pFf/Kj2TYJls6IP43AUgKHy3g9tBDBmYI= Received: from DFLE101.ent.ti.com (dfle101.ent.ti.com [10.64.6.22]) by dflxv15.itg.ti.com (8.14.3/8.13.8) with ESMTP id w29N6oBj017839; Fri, 9 Mar 2018 17:06:50 -0600 Received: from DFLE109.ent.ti.com (10.64.6.30) by DFLE101.ent.ti.com (10.64.6.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1261.35; Fri, 9 Mar 2018 17:06:49 -0600 Received: from dflp32.itg.ti.com (10.64.6.15) by DFLE109.ent.ti.com (10.64.6.30) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_RSA_WITH_AES_256_CBC_SHA) id 15.1.1261.35 via Frontend Transport; Fri, 9 Mar 2018 17:06:49 -0600 Received: from [128.247.58.153] (ileax41-snat.itg.ti.com [10.172.224.153]) by dflp32.itg.ti.com (8.14.3/8.13.8) with ESMTP id w29N6noS008354; Fri, 9 Mar 2018 17:06:49 -0600 Subject: Re: Nokia N900: refcount_t underflow, use after free To: Pavel Machek CC: Robin Murphy , , , Tony Lindgren , , kernel list , , , =?UTF-8?Q?Filip_Matijevi=c4=87?= , , , , , , , linux-arm-kernel , , Laurent Pinchart References: <20180308143053.GA17267@amd> <20180308165903.GM5799@atomide.com> <57c9f17b-fc9d-8506-4b5d-70ac216c9248@ti.com> <20180308185046.GA22796@amd> <1dfc05fe-1612-f5a5-b5f1-9038b3cecfe5@arm.com> <1643b74a-62ba-bea6-71c2-a2dd02430463@ti.com> <20180309221834.GA15476@amd> From: Suman Anna Message-ID: Date: Fri, 9 Mar 2018 17:06:49 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: <20180309221834.GA15476@amd> Content-Type: text/plain; charset="windows-1252" Content-Language: en-US Content-Transfer-Encoding: 7bit X-EXCLAIMER-MD-CONFIG: e1e8a2fd-e40a-4ac6-ac9b-f7e9cc9ee180 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/09/2018 04:18 PM, Pavel Machek wrote: > On Fri 2018-03-09 16:13:36, Suman Anna wrote: >> On 03/09/2018 06:08 AM, Robin Murphy wrote: >>> On 08/03/18 18:50, Pavel Machek wrote: >>>> Hi! >>>> >>>>>> * Pavel Machek [180308 14:31]: >>>>>>> Hi! >>>>>>> >>>>>>> I'm getting this warning... Has anyone seen/debugged that before? >>>>>>> Unfortunately the backtrace does not seem to be too useful :-(. >>>>>> >>>>>> Adding Suman to Cc, as it points to arm_iommu_release_mapping(). >>>>> >>>>> Hmm, we need to find out if the failure paths in isp_probe() are >>>>> mismatched, or if this is coming from some mismatch between the OMAP >>>>> IOMMU driver and the DMA plumbing. AFAIK, the cleanup paths in this >>>> >>>> Well, camera only started to work on N900 pretty recently. Let me add >>>> some debug printks... >>>> >>>> Camera does not work in 4.16.0-rc4-next-20180308-dirty. >>>> >>>> I see this. It looks like problem in isp error paths, indeed: >>> >>> Well, there certainly seems to be an obvious bug wherein >>> isp_detach_iommu() just releases the mapping directly without calling >>> arm_iommu_detach_device() to balance the equivalent attach. That can't >>> be helping. >> >> Indeed, I have been able to reproduce the same warning using a >> standalone test module, and the missing arm_iommu_detach_device() is >> causing the warning after probe (during failure path) or during >> remove. > > Ok do you have an idea how to fix the isp error paths? Untested patch > would be fine... But it seems that you know what needs to be fixed and > I don't. > OK, see if the following fixes the issue for you, only build tested. 8< --------------------- From bac9a48fb646dc51f2030d676a0dbe3298c3b134 Mon Sep 17 00:00:00 2001 From: Suman Anna Date: Fri, 9 Mar 2018 16:39:59 -0600 Subject: [PATCH] media: omap3isp: fix unbalanced dma_iommu_mapping The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware ARM DMA backend. The current code creates a dma_iommu_mapping and attaches this to the ISP device, but never detaches the mapping in either the probe failure paths or the driver remove path resulting in an unbalanced mapping refcount and a memory leak. Fix this properly. Reported-by: Pavel Machek Signed-off-by: Suman Anna --- drivers/media/platform/omap3isp/isp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c index 8eb000e3d8fd..c7d667bfc2af 100644 --- a/drivers/media/platform/omap3isp/isp.c +++ b/drivers/media/platform/omap3isp/isp.c @@ -1945,6 +1945,7 @@ static int isp_initialize_modules(struct isp_device *isp) static void isp_detach_iommu(struct isp_device *isp) { + arm_iommu_detach_device(isp->dev); arm_iommu_release_mapping(isp->mapping); isp->mapping = NULL; } @@ -1971,13 +1972,15 @@ static int isp_attach_iommu(struct isp_device *isp) ret = arm_iommu_attach_device(isp->dev, mapping); if (ret < 0) { dev_err(isp->dev, "failed to attach device to VA mapping\n"); - goto error; + goto error_attach; } return 0; +error_attach: + arm_iommu_release_mapping(isp->mapping); + isp->mapping = NULL; error: - isp_detach_iommu(isp); return ret; } -- 2.16.2