MIME-Version: 1.0
References: <20230308034158.509458-1-chunyan.zhang@unisoc.com>
 <af90fea4-5fa1-de7b-b80e-02fa8753b0fb@arm.com> <05fb17c7-397b-5b33-fbfa-df3bf48b0de8@linux.intel.com>
 <9a88b12e-7169-7c7f-09a1-eef86f75891c@arm.com>
In-Reply-To: <9a88b12e-7169-7c7f-09a1-eef86f75891c@arm.com>
From:   Chunyan Zhang <zhang.lyra@gmail.com>
Date:   Fri, 10 Mar 2023 10:11:10 +0800
Message-ID: <CAAfSe-vS0RatEQmDXutYjOMC50j1jo3s5r8QyrFCQqc_Ok1M6Q@mail.gmail.com>
Subject: Re: [PATCH V2] iommu: sprd: release dma buffer to avoid memory leak
To:     Robin Murphy <robin.murphy@arm.com>
Cc:     Baolu Lu <baolu.lu@linux.intel.com>,
        Chunyan Zhang <chunyan.zhang@unisoc.com>,
        Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org>,
        iommu@lists.linux.dev, Baolin Wang <baolin.wang@linux.alibaba.com>,
        Orson Zhai <orsonzhai@gmail.com>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Thu, 9 Mar 2023 at 19:23, Robin Murphy <robin.murphy@arm.com> wrote:
>
> On 2023-03-09 02:50, Baolu Lu wrote:
> > On 3/8/23 8:37 PM, Robin Murphy wrote:
> >> On 2023-03-08 03:41, Chunyan Zhang wrote:
> >>> Release page table DMA buffer when the IOMMU domain is not used:
> >>>
> >>> - Domain freed.
> >>>
> >>> - IOMMU is attaching to a new domain.
> >>>    Since one sprd IOMMU servers only one client device, if the IOMMU has
> >>>    been attached to other domain, it has to be detached first, that's
> >>>    saying the DMA buffer should be released, otherwise that would
> >>>    cause memory leak issue.
> >>
> >> This is clearly wrong; domain resources should only be freed when the
> >> domain is freed.
> >
> > Agreed. Perhaps, in the attach path:
> >
> >      if (!dom->pgt_va)
> >          dom->pgt_va = dma_alloc_coherent(sdev->dev, pgt_size,
> >                  &dom->pgt_pa, GFP_KERNEL);
> > ?
>
> Why? dom->pgt_va will always be NULL if dom->sdev is NULL, and once

Yes, I also found this. I'm going to remove the check of dom->sdev
that will make reattching being allowed, like you mentioned below, in
the next version.

Thanks for your comments,
Chunyan

> dom->sdev is set then that allocation is not reachable (of course this
> means the driver also has a separate bug where reattaching to a
> previously-used domain will erroneously fail, but that's not a memory
> leak as such). The only thing to recognise here is that the allocation
> is logically not part of the .attach_dev operation, but really a one-off
> deferred part of .domain_alloc, and thus it should be balanced in .free,
> not anywhere else.
>
> Thanks,
> Robin.