From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A02EC48BDF for ; Thu, 10 Jun 2021 22:28:22 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 0153E613DE for ; Thu, 10 Jun 2021 22:28:21 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0153E613DE Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:To:Subject:Message-ID:Date:From: In-Reply-To:References:MIME-Version:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=SIWnb3+UthLKR2156zRCun2xSaC8ZBpgYmTvnz2HNYE=; b=kI2fb35C8DTkI8 u8vImLT0MXfNVYwP3tTbuh+rWpLKKT1o+jpEVorCPmp0J+NHomBuYCjWwzQWj3pA+zeu0p2QnKFWZ Cvib6xJIMqQX4x9nUyu6FK4gwhIUILQ4fLaybQL2Owtsuv+DQhuK9hFuUD/hnjaroScAukE9jqoUL L4bKVN2Qy+grtROmRJYrDu4DfnUzMBMVJYp6MwkB6HLMOyxyv+5ot5g2P3VksuUZV8Lvzsx20V9rI A/F6TakfekSMNhdKFYbSFciJbNo2GrHRhmixbG9K3iZ589MYGoZo4ebEVYHIh5DlvsjidyDK88R0a S2/oszztUBpWZJxpqpmA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1lrT69-002lIG-Ab; Thu, 10 Jun 2021 22:24:25 +0000 Received: from mail-io1-xd2c.google.com ([2607:f8b0:4864:20::d2c]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1lrT66-002lHd-J7 for linux-arm-kernel@lists.infradead.org; Thu, 10 Jun 2021 22:24:23 +0000 Received: by mail-io1-xd2c.google.com with SMTP id 5so28791376ioe.1 for ; Thu, 10 Jun 2021 15:24:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=w7TVjLZ+YHlKeGJ8qAU9Un06YFm9yXurMjRE2VQEqoY=; b=lcnU0h1GZrdQJLHy8y+QLyi53BxH+7M3T72jS6rR9R+chmR1B7uM/QQBUr0wb9Na5Y ztJ6PqO0L1apCQeAEkrh7TvbJK5Uw0hLjM37NV2AFe/Kgnno9gNP2tycgvMLwh4zbi58 Q26dJPAFABhMVEZeABUu2C+MTVBBYla4XZvvU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=w7TVjLZ+YHlKeGJ8qAU9Un06YFm9yXurMjRE2VQEqoY=; b=cH7lAP0ZOe3ozvOmFOMyGWG2OTPtC5yecKTdzF+YIuQePHAjPHKGpYqSNfdbMhBisa IPlBcAGQDpwFGneYVcRS6SbVPcN7QuhCD2PXHDeLvlI3iFVC4Rb4MVypUstEuhiBfOO2 Gk41Ad968NUfMBKmd8WU5s5f4yH4+XXzgEN2EHa5jXNANuQeYxyZ5pVql+e+FrCsbBHv N8iSdZY+v+p54ZrfOclA8rhgpd8gW5jn1AM/uOmlK1DBT1E65bCIauYP4AopQa7WJ9Sy JCpcNFP9HHYn9X3uanDyRJkIGYctKZwlXc4Yxxt8dhrpsgWGSApc5pcO1dj4GmiW5MOY wLJg== X-Gm-Message-State: AOAM530liGgOe/fH7UZ0vghPEb//4tq1Ft1IvCtZToKEChNCPvyE6C3Z qAmHnVr8npBpxofbyqGfhf4WRbWjy7twe1o1cELn3A== X-Google-Smtp-Source: ABdhPJxXRsWHoRSS+DqKbfDPMQ4aRNvfX6WB5CCyhEHmFMsKbxf9xeh5w6evmQo2ATTX7WJCxTs0JimQzDD9PcEr90Q= X-Received: by 2002:a6b:cf13:: with SMTP id o19mr599046ioa.206.1623363860099; Thu, 10 Jun 2021 15:24:20 -0700 (PDT) MIME-Version: 1.0 References: <1623293391-17261-1-git-send-email-xiyuyang19@fudan.edu.cn> In-Reply-To: <1623293391-17261-1-git-send-email-xiyuyang19@fudan.edu.cn> From: Rob Clark Date: Thu, 10 Jun 2021 15:28:15 -0700 Message-ID: Subject: Re: [PATCH v2] iommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation To: Xiyu Yang X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210610_152422_673433_F6C85E0D X-CRM114-Status: GOOD ( 20.36 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sai Prakash Ranjan , LKML , Will Deacon , Joerg Roedel , yuanxzhang@fudan.edu.cn, iommu@lists.linux-foundation.org, Jordan Crouse , Xin Tan , Jon Hunter , Robin Murphy , "moderated list:ARM64 PORT \(AARCH64 ARCHITECTURE\)" Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Wed, Jun 9, 2021 at 7:50 PM Xiyu Yang wrote: > > The reference counting issue happens in several exception handling paths > of arm_smmu_iova_to_phys_hard(). When those error scenarios occur, the > function forgets to decrease the refcount of "smmu" increased by > arm_smmu_rpm_get(), causing a refcount leak. > > Fix this issue by jumping to "out" label when those error scenarios > occur. > > Signed-off-by: Xiyu Yang > Signed-off-by: Xin Tan > --- > drivers/iommu/arm/arm-smmu/arm-smmu.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.c b/drivers/iommu/arm/arm-smmu/arm-smmu.c > index 6f72c4d208ca..3a3847277320 100644 > --- a/drivers/iommu/arm/arm-smmu/arm-smmu.c > +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c > @@ -1271,6 +1271,7 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain, > u64 phys; > unsigned long va, flags; > int ret, idx = cfg->cbndx; > + phys_addr_t addr = 0; > > ret = arm_smmu_rpm_get(smmu); > if (ret < 0) > @@ -1290,6 +1291,7 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain, > dev_err(dev, > "iova to phys timed out on %pad. Falling back to software table walk.\n", > &iova); > + arm_smmu_rpm_put(smmu); > return ops->iova_to_phys(ops, iova); I suppose you could also: addr = ops->iov_to_phys(...); goto out; but either way, Reviewed-by: Rob Clark > } > > @@ -1298,12 +1300,14 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain, > if (phys & ARM_SMMU_CB_PAR_F) { > dev_err(dev, "translation fault!\n"); > dev_err(dev, "PAR = 0x%llx\n", phys); > - return 0; > + goto out; > } > > + addr = (phys & GENMASK_ULL(39, 12)) | (iova & 0xfff); > +out: > arm_smmu_rpm_put(smmu); > > - return (phys & GENMASK_ULL(39, 12)) | (iova & 0xfff); > + return addr; > } > > static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain, > -- > 2.7.4 > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel