Messages in this thread | | | Subject | Re: Nokia N900: refcount_t underflow, use after free | From | Suman Anna <> | Date | Mon, 12 Mar 2018 11:10:58 -0500 |
| |
On 03/10/2018 05:26 AM, Pavel Machek wrote: > Hi! > >>>>> Well, there certainly seems to be an obvious bug wherein >>>>> isp_detach_iommu() just releases the mapping directly without calling >>>>> arm_iommu_detach_device() to balance the equivalent attach. That can't >>>>> be helping. >>>> >>>> Indeed, I have been able to reproduce the same warning using a >>>> standalone test module, and the missing arm_iommu_detach_device() is >>>> causing the warning after probe (during failure path) or during >>>> remove. >>> >>> Ok do you have an idea how to fix the isp error paths? Untested patch >>> would be fine... But it seems that you know what needs to be fixed and >>> I don't. >>> >> >> OK, see if the following fixes the issue for you, only build tested. > > Word-wrapped, so I applied by hand. And yes, the oops at boot is > gone. Thanks!
Sorry about that, have to check my mail settings. Anyway will post the patch again, glad that it fixed your issue.
regards Suman
> > (Camera still does not work in -next... kills system. Oh well. Lets > debug that some other day.) > >> 8< --------------------- >> >From bac9a48fb646dc51f2030d676a0dbe3298c3b134 Mon Sep 17 00:00:00 2001 >> From: Suman Anna <s-anna@ti.com> >> Date: Fri, 9 Mar 2018 16:39:59 -0600 >> Subject: [PATCH] media: omap3isp: fix unbalanced dma_iommu_mapping >> >> The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware >> ARM DMA backend. The current code creates a dma_iommu_mapping and >> attaches this to the ISP device, but never detaches the mapping in >> either the probe failure paths or the driver remove path resulting >> in an unbalanced mapping refcount and a memory leak. Fix this properly. >> >> Reported-by: Pavel Machek <pavel@ucw.cz> >> Signed-off-by: Suman Anna <s-anna@ti.com> > > Tested-by: Pavel Machek <pavel@ucw.cz> > Pavel >
| |