From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: "Sasha Levin" <sashal@kernel.org>, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, "Charan Teja Reddy" <charante@codeaurora.org>, "Christian König" <christian.koenig@amd.com>, linux-media@vger.kernel.org Subject: [PATCH AUTOSEL 5.4 01/74] dma-buf: WARN on dmabuf release with pending attachments Date: Mon, 8 Nov 2021 12:48:28 -0500 [thread overview] Message-ID: <20211108174942.1189927-1-sashal@kernel.org> (raw) From: Charan Teja Reddy <charante@codeaurora.org> [ Upstream commit f492283b157053e9555787262f058ae33096f568 ] It is expected from the clients to follow the below steps on an imported dmabuf fd: a) dmabuf = dma_buf_get(fd) // Get the dmabuf from fd b) dma_buf_attach(dmabuf); // Clients attach to the dmabuf o Here the kernel does some slab allocations, say for dma_buf_attachment and may be some other slab allocation in the dmabuf->ops->attach(). c) Client may need to do dma_buf_map_attachment(). d) Accordingly dma_buf_unmap_attachment() should be called. e) dma_buf_detach () // Clients detach to the dmabuf. o Here the slab allocations made in b) are freed. f) dma_buf_put(dmabuf) // Can free the dmabuf if it is the last reference. Now say an erroneous client failed at step c) above thus it directly called dma_buf_put(), step f) above. Considering that it may be the last reference to the dmabuf, buffer will be freed with pending attachments left to the dmabuf which can show up as the 'memory leak'. This should at least be reported as the WARN(). Signed-off-by: Charan Teja Reddy <charante@codeaurora.org> Reviewed-by: Christian König <christian.koenig@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/1627043468-16381-1-git-send-email-charante@codeaurora.org Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/dma-buf/dma-buf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 758de0e9b2ddc..16bbc9bc9e6d1 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -79,6 +79,7 @@ static void dma_buf_release(struct dentry *dentry) if (dmabuf->resv == (struct dma_resv *)&dmabuf[1]) dma_resv_fini(dmabuf->resv); + WARN_ON(!list_empty(&dmabuf->attachments)); module_put(dmabuf->owner); kfree(dmabuf->name); kfree(dmabuf); -- 2.33.0
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: "Charan Teja Reddy" <charante@codeaurora.org>, "Christian König" <christian.koenig@amd.com>, "Sasha Levin" <sashal@kernel.org>, sumit.semwal@linaro.org, linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org Subject: [PATCH AUTOSEL 5.4 01/74] dma-buf: WARN on dmabuf release with pending attachments Date: Mon, 8 Nov 2021 12:48:28 -0500 [thread overview] Message-ID: <20211108174942.1189927-1-sashal@kernel.org> (raw) From: Charan Teja Reddy <charante@codeaurora.org> [ Upstream commit f492283b157053e9555787262f058ae33096f568 ] It is expected from the clients to follow the below steps on an imported dmabuf fd: a) dmabuf = dma_buf_get(fd) // Get the dmabuf from fd b) dma_buf_attach(dmabuf); // Clients attach to the dmabuf o Here the kernel does some slab allocations, say for dma_buf_attachment and may be some other slab allocation in the dmabuf->ops->attach(). c) Client may need to do dma_buf_map_attachment(). d) Accordingly dma_buf_unmap_attachment() should be called. e) dma_buf_detach () // Clients detach to the dmabuf. o Here the slab allocations made in b) are freed. f) dma_buf_put(dmabuf) // Can free the dmabuf if it is the last reference. Now say an erroneous client failed at step c) above thus it directly called dma_buf_put(), step f) above. Considering that it may be the last reference to the dmabuf, buffer will be freed with pending attachments left to the dmabuf which can show up as the 'memory leak'. This should at least be reported as the WARN(). Signed-off-by: Charan Teja Reddy <charante@codeaurora.org> Reviewed-by: Christian König <christian.koenig@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/1627043468-16381-1-git-send-email-charante@codeaurora.org Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/dma-buf/dma-buf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 758de0e9b2ddc..16bbc9bc9e6d1 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -79,6 +79,7 @@ static void dma_buf_release(struct dentry *dentry) if (dmabuf->resv == (struct dma_resv *)&dmabuf[1]) dma_resv_fini(dmabuf->resv); + WARN_ON(!list_empty(&dmabuf->attachments)); module_put(dmabuf->owner); kfree(dmabuf->name); kfree(dmabuf); -- 2.33.0
next reply other threads:[~2021-11-09 1:04 UTC|newest] Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-11-08 17:48 Sasha Levin [this message] 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 01/74] dma-buf: WARN on dmabuf release with pending attachments Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 02/74] drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2) Sasha Levin 2021-11-08 17:48 ` Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 03/74] drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 Sasha Levin 2021-11-08 17:48 ` Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 04/74] drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6 Sasha Levin 2021-11-08 17:48 ` Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 05/74] Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 06/74] Bluetooth: fix use-after-free error in lock_sock_nested() Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 07/74] drm/panel-orientation-quirks: add Valve Steam Deck Sasha Levin 2021-11-08 17:48 ` Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 08/74] platform/x86: wmi: do not fail if disabling fails Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 09/74] MIPS: lantiq: dma: add small delay after reset Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 10/74] MIPS: lantiq: dma: reset correct number of channel Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 11/74] locking/lockdep: Avoid RCU-induced noinstr fail Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 12/74] net: sched: update default qdisc visibility after Tx queue cnt changes Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 13/74] smackfs: Fix use-after-free in netlbl_catmap_walk() Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 14/74] NET: IPV4: fix error "do not initialise globals to 0" Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 15/74] x86: Increase exception stack sizes Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 16/74] mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 17/74] mwifiex: Properly initialize private structure on interface type changes Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 18/74] ath10k: high latency fixes for beacon buffer Sasha Levin 2021-11-08 17:48 ` Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 19/74] media: mt9p031: Fix corrupted frame after restarting stream Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 20/74] media: netup_unidvb: handle interrupt properly according to the firmware Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 21/74] media: stm32: Potential NULL pointer dereference in dcmi_irq_thread() Sasha Levin 2021-11-08 17:48 ` Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 22/74] media: uvcvideo: Set capability in s_param Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 23/74] media: uvcvideo: Return -EIO for control errors Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 24/74] media: uvcvideo: Set unique vdev name based in type Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 25/74] media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() Sasha Levin 2021-11-08 17:48 ` Sasha Levin 2021-11-08 17:48 ` [PATCH AUTOSEL 5.4 26/74] media: s5p-mfc: Add checking to s5p_mfc_probe() Sasha Levin 2021-11-08 17:48 ` Sasha Levin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20211108174942.1189927-1-sashal@kernel.org \ --to=sashal@kernel.org \ --cc=charante@codeaurora.org \ --cc=christian.koenig@amd.com \ --cc=dri-devel@lists.freedesktop.org \ --cc=linaro-mm-sig@lists.linaro.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-media@vger.kernel.org \ --cc=stable@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.