Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v2] staging: bcm2835-audio: Disconnect and free
 vchi_instance on module_exit()
To:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc:     Eric Anholt <eric@anholt.net>,
        Stefan Wahren <stefan.wahren@i2se.com>,
        Florian Fainelli <f.fainelli@gmail.com>,
        Ray Jui <rjui@broadcom.com>,
        Scott Branden <sbranden@broadcom.com>,
        Andy Shevchenko <andy.shevchenko@gmail.com>,
        Dan Carpenter <dan.carpenter@oracle.com>,
        devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org,
        bcm-kernel-feedback-list@broadcom.com,
        linux-rpi-kernel@lists.infradead.org,
        linux-arm-kernel@lists.infradead.org
References: <9e4fc4a0-370b-9101-2809-4040de58553c@gmail.com>
 <20180424195729.8433-1-k.marinushkin@gmail.com>
 <20180425061638.GA1450@kroah.com>
From:   Kirill Marinushkin <k.marinushkin@gmail.com>
Message-ID: <d2690e90-f3ff-8a3a-38bc-edf0a0c7c754@gmail.com>
Date:   Wed, 25 Apr 2018 19:35:25 +0200
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:52.0) Gecko/20100101
 Thunderbird/52.4.0
MIME-Version: 1.0
In-Reply-To: <20180425061638.GA1450@kroah.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 04/25/18 08:16, Greg Kroah-Hartman wrote:
> On Tue, Apr 24, 2018 at 09:57:29PM +0200, Kirill Marinushkin wrote:
>> In the current implementation, vchi_instance is inited during the first
>> call of bcm2835_audio_open_connection(), and is never freed. It causes a
>> memory leak when the module `snd_bcm2835` is removed.
>>
>> Here is how this commit fixes it:
>>
>> * the VCHI context (including vchi_instance) is created once in the
>>   platform's devres
>> * the VCHI context is allocated and connected once during module_init()
>> * all created bcm2835_chips have a pointer to this VCHI context
>> * bcm2835_audio_open_connection() can access the VCHI context through the
>>   associated bcm2835_chip
>> * the VCHI context is disconnected and freed once during module_exit()
>>
>> After this commit is applied, I don't see other issues with the module's
>> init/exit, so I also remove the associated TODO task.
>>
>> Steps to reproduce the memory leak before this commit:
>>
>> ~~~~
>> root@raspberrypi:/home/pi# aplay test0.wav
>> Playing WAVE 'test0.wav' : Signed 16 bit Little Endian, Rate 44100 Hz, Ster
>> ^CAborted by signal Interrupt...
>> root@raspberrypi:/home/pi# rmmod snd_bcm2835
>> root@raspberrypi:/home/pi# modprobe snd_bcm2835
>> root@raspberrypi:/home/pi# aplay test0.wav
>> Playing WAVE 'test0.wav' : Signed 16 bit Little Endian, Rate 44100 Hz, Ster
>> ^CAborted by signal Interrupt...
>> root@raspberrypi:/home/pi# echo scan > /sys/kernel/debug/kmemleak
>> root@raspberrypi:/home/pi# cat /sys/kernel/debug/kmemleak
>> unreferenced object 0xb6794c00 (size 128):
>>   comm "aplay", pid 406, jiffies 36870 (age 116.650s)
>>   hex dump (first 32 bytes):
>>     08 a5 82 81 01 00 00 00 08 4c 79 b6 08 4c 79 b6  .........Ly..Ly.
>>     00 00 00 00 00 00 00 00 ad 4e ad de ff ff ff ff  .........N......
>>   backtrace:
>>     [<802af5e0>] kmem_cache_alloc_trace+0x294/0x3d0
>>     [<806ce620>] vchiq_initialise+0x98/0x1b0
>>     [<806d0b34>] vchi_initialise+0x24/0x34
>>     [<7f1311ec>] 0x7f1311ec
>>     [<7f1303bc>] 0x7f1303bc
>>     [<7f130590>] 0x7f130590
>>     [<7f111fd8>] snd_pcm_open_substream+0x68/0xc4 [snd_pcm]
>>     [<7f112108>] snd_pcm_open+0xd4/0x248 [snd_pcm]
>>     [<7f112334>] snd_pcm_playback_open+0x4c/0x6c [snd_pcm]
>>     [<7f0e250c>] snd_open+0xa8/0x14c [snd]
>>     [<802ce590>] chrdev_open+0xac/0x188
>>     [<802c57b4>] do_dentry_open+0x10c/0x314
>>     [<802c6ba8>] vfs_open+0x5c/0x88
>>     [<802d9a68>] path_openat+0x368/0x944
>>     [<802dacd4>] do_filp_open+0x70/0xc4
>>     [<802c6f70>] do_sys_open+0x110/0x1d4
>> ~~~~
>>
>> Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
>> Cc: Eric Anholt <eric@anholt.net>
>> Cc: Stefan Wahren <stefan.wahren@i2se.com>
>> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> Cc: Florian Fainelli <f.fainelli@gmail.com>
>> Cc: Ray Jui <rjui@broadcom.com>
>> Cc: Scott Branden <sbranden@broadcom.com>
>> Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
>> Cc: Dan Carpenter <dan.carpenter@oracle.com>
>> Cc: bcm-kernel-feedback-list@broadcom.com
>> Cc: linux-rpi-kernel@lists.infradead.org
>> Cc: linux-arm-kernel@lists.infradead.org
>> Cc: devel@driverdev.osuosl.org
>> Cc: linux-kernel@vger.kernel.org
>> ---
>>  .../vc04_services/bcm2835-audio/bcm2835-vchiq.c    | 64 +++++++++++++---------
>>  .../staging/vc04_services/bcm2835-audio/bcm2835.c  | 43 ++++++++++++++-
>>  .../staging/vc04_services/bcm2835-audio/bcm2835.h  | 12 ++++
>>  3 files changed, 91 insertions(+), 28 deletions(-)
> What changed from v1?  Always put that below the --- line as the
> documentation says to do so.
>
> v3?  :)
>
> thanks,
>
> greg k-h
:)

Below is the git diff v1..v2

~~~~
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 009c972d93d6..662e05bd8f05 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -165,7 +165,7 @@ static int snd_bcm2835_create(struct snd_card *card,
                                     bcm2835_devm_free_vchi_ctx, NULL, NULL);
        if (!chip->vchi_ctx) {
                kfree(chip);
-               return err;
+               return -ENODEV;
        }
 
        err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops);
~~~~

Best Regards,
Kirill