lkml.org 
[lkml]   [2021]   [Mar]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.11 153/306] PCI: Fix pci_register_io_range() memory leak
    Date
    From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    From: Geert Uytterhoeven <geert+renesas@glider.be>

    [ Upstream commit f6bda644fa3a7070621c3bf12cd657f69a42f170 ]

    Kmemleak reports:

    unreferenced object 0xc328de40 (size 64):
    comm "kworker/1:1", pid 21, jiffies 4294938212 (age 1484.670s)
    hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 e0 d8 fc eb 00 00 00 00 ................
    00 00 10 fe 00 00 00 00 00 00 00 00 00 00 00 00 ................

    backtrace:
    [<ad758d10>] pci_register_io_range+0x3c/0x80
    [<2c7f139e>] of_pci_range_to_resource+0x48/0xc0
    [<f079ecc8>] devm_of_pci_get_host_bridge_resources.constprop.0+0x2ac/0x3ac
    [<e999753b>] devm_of_pci_bridge_init+0x60/0x1b8
    [<a895b229>] devm_pci_alloc_host_bridge+0x54/0x64
    [<e451ddb0>] rcar_pcie_probe+0x2c/0x644

    In case a PCI host driver's probe is deferred, the same I/O range may be
    allocated again, and be ignored, causing a memory leak.

    Fix this by (a) letting logic_pio_register_range() return -EEXIST if the
    passed range already exists, so pci_register_io_range() will free it, and
    by (b) making pci_register_io_range() not consider -EEXIST an error
    condition.

    Link: https://lore.kernel.org/r/20210202100332.829047-1-geert+renesas@glider.be
    Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/pci/pci.c | 4 ++++
    lib/logic_pio.c | 3 +++
    2 files changed, 7 insertions(+)

    diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
    index ba791165ed19..9449dfde2841 100644
    --- a/drivers/pci/pci.c
    +++ b/drivers/pci/pci.c
    @@ -4029,6 +4029,10 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr,
    ret = logic_pio_register_range(range);
    if (ret)
    kfree(range);
    +
    + /* Ignore duplicates due to deferred probing */
    + if (ret == -EEXIST)
    + ret = 0;
    #endif

    return ret;
    diff --git a/lib/logic_pio.c b/lib/logic_pio.c
    index f32fe481b492..07b4b9a1f54b 100644
    --- a/lib/logic_pio.c
    +++ b/lib/logic_pio.c
    @@ -28,6 +28,8 @@ static DEFINE_MUTEX(io_range_mutex);
    * @new_range: pointer to the IO range to be registered.
    *
    * Returns 0 on success, the error code in case of failure.
    + * If the range already exists, -EEXIST will be returned, which should be
    + * considered a success.
    *
    * Register a new IO range node in the IO range list.
    */
    @@ -51,6 +53,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
    list_for_each_entry(range, &io_range_list, list) {
    if (range->fwnode == new_range->fwnode) {
    /* range already there */
    + ret = -EEXIST;
    goto end_register;
    }
    if (range->flags == LOGIC_PIO_CPU_MMIO &&
    --
    2.30.1


    \
     
     \ /
      Last update: 2021-03-15 15:32    [W:3.187 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site