lkml.org 
[lkml]   [2010]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[171/205] firmware_class: fix memory leak - free allocated pages
    2.6.34-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: David Woodhouse <David.Woodhouse@intel.com>

    commit dd336c554d8926c3348a2d5f2a5ef5597f6d1a06 upstream.

    fix memory leak introduced by the patch 6e03a201bbe:
    firmware: speed up request_firmware()

    1. vfree won't release pages there were allocated explicitly and mapped
    using vmap. The memory has to be vunmap-ed and the pages needs
    to be freed explicitly

    2. page array is moved into the 'struct
    firmware' so that we can free it from release_firmware()
    and not only in fw_dev_release()

    The fix doesn't break the firmware load speed.

    Cc: Johannes Berg <johannes@sipsolutions.net>
    Cc: Ming Lei <tom.leiming@gmail.com>
    Cc: Catalin Marinas <catalin.marinas@arm.com>
    Singed-off-by: Kay Sievers <kay.sievers@vrfy.org>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/base/firmware_class.c | 26 ++++++++++++++++++++------
    include/linux/firmware.h | 1 +
    2 files changed, 21 insertions(+), 6 deletions(-)

    --- a/drivers/base/firmware_class.c
    +++ b/drivers/base/firmware_class.c
    @@ -130,6 +130,17 @@ static ssize_t firmware_loading_show(str
    return sprintf(buf, "%d\n", loading);
    }

    +static void firmware_free_data(const struct firmware *fw)
    +{
    + int i;
    + vunmap(fw->data);
    + if (fw->pages) {
    + for (i = 0; i < PFN_UP(fw->size); i++)
    + __free_page(fw->pages[i]);
    + kfree(fw->pages);
    + }
    +}
    +
    /* Some architectures don't have PAGE_KERNEL_RO */
    #ifndef PAGE_KERNEL_RO
    #define PAGE_KERNEL_RO PAGE_KERNEL
    @@ -162,21 +173,21 @@ static ssize_t firmware_loading_store(st
    mutex_unlock(&fw_lock);
    break;
    }
    - vfree(fw_priv->fw->data);
    - fw_priv->fw->data = NULL;
    + firmware_free_data(fw_priv->fw);
    + memset(fw_priv->fw, 0, sizeof(struct firmware));
    + /* If the pages are not owned by 'struct firmware' */
    for (i = 0; i < fw_priv->nr_pages; i++)
    __free_page(fw_priv->pages[i]);
    kfree(fw_priv->pages);
    fw_priv->pages = NULL;
    fw_priv->page_array_size = 0;
    fw_priv->nr_pages = 0;
    - fw_priv->fw->size = 0;
    set_bit(FW_STATUS_LOADING, &fw_priv->status);
    mutex_unlock(&fw_lock);
    break;
    case 0:
    if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
    - vfree(fw_priv->fw->data);
    + vunmap(fw_priv->fw->data);
    fw_priv->fw->data = vmap(fw_priv->pages,
    fw_priv->nr_pages,
    0, PAGE_KERNEL_RO);
    @@ -184,7 +195,10 @@ static ssize_t firmware_loading_store(st
    dev_err(dev, "%s: vmap() failed\n", __func__);
    goto err;
    }
    - /* Pages will be freed by vfree() */
    + /* Pages are now owned by 'struct firmware' */
    + fw_priv->fw->pages = fw_priv->pages;
    + fw_priv->pages = NULL;
    +
    fw_priv->page_array_size = 0;
    fw_priv->nr_pages = 0;
    complete(&fw_priv->completion);
    @@ -578,7 +592,7 @@ release_firmware(const struct firmware *
    if (fw->data == builtin->data)
    goto free_fw;
    }
    - vfree(fw->data);
    + firmware_free_data(fw);
    free_fw:
    kfree(fw);
    }
    --- a/include/linux/firmware.h
    +++ b/include/linux/firmware.h
    @@ -12,6 +12,7 @@
    struct firmware {
    size_t size;
    const u8 *data;
    + struct page **pages;
    };

    struct device;



    \
     
     \ /
      Last update: 2010-07-30 20:03    [W:4.182 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site