From: Pavel Machek <pavel@ucw.cz> To: Suman Anna <s-anna@ti.com> Cc: "Robin Murphy" <robin.murphy@arm.com>, ivo.g.dimitrov.75@gmail.com, khilman@kernel.org, "Tony Lindgren" <tony@atomide.com>, aaro.koskinen@iki.fi, "kernel list" <linux-kernel@vger.kernel.org>, sre@kernel.org, martijn@brixit.nl, "Filip Matijević" <filip.matijevic.pz@gmail.com>, abcloriens@gmail.com, sakari.ailus@linux.intel.com, pali.rohar@gmail.com, clayton@craftyguy.net, linux-omap@vger.kernel.org, patrikbachan@gmail.com, linux-arm-kernel <linux-arm-kernel@lists.infradead.org>, serge@hallyn.com, "Laurent Pinchart" <laurent.pinchart@ideasonboard.com> Subject: Re: Nokia N900: refcount_t underflow, use after free Date: Sat, 10 Mar 2018 12:26:34 +0100 [thread overview] Message-ID: <20180310112634.GA31614@amd> (raw) In-Reply-To: <c8ee5692-bf71-a9d7-8607-50adc9f0e9f1@ti.com> [-- Attachment #1: Type: text/plain, Size: 1819 bytes --] Hi! > >>> Well, there certainly seems to be an obvious bug wherein > >>> isp_detach_iommu() just releases the mapping directly without calling > >>> arm_iommu_detach_device() to balance the equivalent attach. That can't > >>> be helping. > >> > >> Indeed, I have been able to reproduce the same warning using a > >> standalone test module, and the missing arm_iommu_detach_device() is > >> causing the warning after probe (during failure path) or during > >> remove. > > > > Ok do you have an idea how to fix the isp error paths? Untested patch > > would be fine... But it seems that you know what needs to be fixed and > > I don't. > > > > OK, see if the following fixes the issue for you, only build tested. Word-wrapped, so I applied by hand. And yes, the oops at boot is gone. Thanks! (Camera still does not work in -next... kills system. Oh well. Lets debug that some other day.) > 8< --------------------- > >From bac9a48fb646dc51f2030d676a0dbe3298c3b134 Mon Sep 17 00:00:00 2001 > From: Suman Anna <s-anna@ti.com> > Date: Fri, 9 Mar 2018 16:39:59 -0600 > Subject: [PATCH] media: omap3isp: fix unbalanced dma_iommu_mapping > > The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware > ARM DMA backend. The current code creates a dma_iommu_mapping and > attaches this to the ISP device, but never detaches the mapping in > either the probe failure paths or the driver remove path resulting > in an unbalanced mapping refcount and a memory leak. Fix this properly. > > Reported-by: Pavel Machek <pavel@ucw.cz> > Signed-off-by: Suman Anna <s-anna@ti.com> Tested-by: Pavel Machek <pavel@ucw.cz> Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html [-- Attachment #2: Digital signature --] [-- Type: application/pgp-signature, Size: 181 bytes --]
WARNING: multiple messages have this Message-ID (diff)
From: pavel@ucw.cz (Pavel Machek) To: linux-arm-kernel@lists.infradead.org Subject: Nokia N900: refcount_t underflow, use after free Date: Sat, 10 Mar 2018 12:26:34 +0100 [thread overview] Message-ID: <20180310112634.GA31614@amd> (raw) In-Reply-To: <c8ee5692-bf71-a9d7-8607-50adc9f0e9f1@ti.com> Hi! > >>> Well, there certainly seems to be an obvious bug wherein > >>> isp_detach_iommu() just releases the mapping directly without calling > >>> arm_iommu_detach_device() to balance the equivalent attach. That can't > >>> be helping. > >> > >> Indeed, I have been able to reproduce the same warning using a > >> standalone test module, and the missing arm_iommu_detach_device() is > >> causing the warning after probe (during failure path) or during > >> remove. > > > > Ok do you have an idea how to fix the isp error paths? Untested patch > > would be fine... But it seems that you know what needs to be fixed and > > I don't. > > > > OK, see if the following fixes the issue for you, only build tested. Word-wrapped, so I applied by hand. And yes, the oops at boot is gone. Thanks! (Camera still does not work in -next... kills system. Oh well. Lets debug that some other day.) > 8< --------------------- > >From bac9a48fb646dc51f2030d676a0dbe3298c3b134 Mon Sep 17 00:00:00 2001 > From: Suman Anna <s-anna@ti.com> > Date: Fri, 9 Mar 2018 16:39:59 -0600 > Subject: [PATCH] media: omap3isp: fix unbalanced dma_iommu_mapping > > The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware > ARM DMA backend. The current code creates a dma_iommu_mapping and > attaches this to the ISP device, but never detaches the mapping in > either the probe failure paths or the driver remove path resulting > in an unbalanced mapping refcount and a memory leak. Fix this properly. > > Reported-by: Pavel Machek <pavel@ucw.cz> > Signed-off-by: Suman Anna <s-anna@ti.com> Tested-by: Pavel Machek <pavel@ucw.cz> Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 181 bytes Desc: Digital signature URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20180310/85acc094/attachment.sig>
next prev parent reply other threads:[~2018-03-10 11:26 UTC|newest] Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-03-08 14:30 Nokia N900: refcount_t underflow, use after free Pavel Machek 2018-03-08 14:30 ` Pavel Machek 2018-03-08 16:59 ` Tony Lindgren 2018-03-08 16:59 ` Tony Lindgren 2018-03-08 18:21 ` Suman Anna 2018-03-08 18:21 ` Suman Anna 2018-03-08 18:50 ` Pavel Machek 2018-03-08 18:50 ` Pavel Machek 2018-03-09 12:08 ` Robin Murphy 2018-03-09 12:08 ` Robin Murphy 2018-03-09 22:13 ` Suman Anna 2018-03-09 22:13 ` Suman Anna 2018-03-09 22:13 ` Suman Anna 2018-03-09 22:18 ` Pavel Machek 2018-03-09 22:18 ` Pavel Machek 2018-03-09 23:06 ` Suman Anna 2018-03-09 23:06 ` Suman Anna 2018-03-10 11:26 ` Pavel Machek [this message] 2018-03-10 11:26 ` Pavel Machek 2018-03-12 16:10 ` Suman Anna 2018-03-12 16:10 ` Suman Anna 2018-03-12 16:10 ` Suman Anna 2018-05-24 11:05 ` Pavel Machek 2018-05-24 11:05 ` Pavel Machek 2018-05-25 2:37 ` Suman Anna 2018-05-25 2:37 ` Suman Anna
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180310112634.GA31614@amd \ --to=pavel@ucw.cz \ --cc=aaro.koskinen@iki.fi \ --cc=abcloriens@gmail.com \ --cc=clayton@craftyguy.net \ --cc=filip.matijevic.pz@gmail.com \ --cc=ivo.g.dimitrov.75@gmail.com \ --cc=khilman@kernel.org \ --cc=laurent.pinchart@ideasonboard.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-omap@vger.kernel.org \ --cc=martijn@brixit.nl \ --cc=pali.rohar@gmail.com \ --cc=patrikbachan@gmail.com \ --cc=robin.murphy@arm.com \ --cc=s-anna@ti.com \ --cc=sakari.ailus@linux.intel.com \ --cc=serge@hallyn.com \ --cc=sre@kernel.org \ --cc=tony@atomide.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.