From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752148AbeCJL0i (ORCPT ); Sat, 10 Mar 2018 06:26:38 -0500 Received: from atrey.karlin.mff.cuni.cz ([195.113.26.193]:44875 "EHLO atrey.karlin.mff.cuni.cz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752067AbeCJL0g (ORCPT ); Sat, 10 Mar 2018 06:26:36 -0500 Date: Sat, 10 Mar 2018 12:26:34 +0100 From: Pavel Machek To: Suman Anna Cc: Robin Murphy , ivo.g.dimitrov.75@gmail.com, khilman@kernel.org, Tony Lindgren , aaro.koskinen@iki.fi, kernel list , sre@kernel.org, martijn@brixit.nl, Filip =?utf-8?Q?Matijevi=C4=87?= , abcloriens@gmail.com, sakari.ailus@linux.intel.com, pali.rohar@gmail.com, clayton@craftyguy.net, linux-omap@vger.kernel.org, patrikbachan@gmail.com, linux-arm-kernel , serge@hallyn.com, Laurent Pinchart Subject: Re: Nokia N900: refcount_t underflow, use after free Message-ID: <20180310112634.GA31614@amd> References: <20180308143053.GA17267@amd> <20180308165903.GM5799@atomide.com> <57c9f17b-fc9d-8506-4b5d-70ac216c9248@ti.com> <20180308185046.GA22796@amd> <1dfc05fe-1612-f5a5-b5f1-9038b3cecfe5@arm.com> <1643b74a-62ba-bea6-71c2-a2dd02430463@ti.com> <20180309221834.GA15476@amd> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="TB36FDmn/VVEgNH/" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --TB36FDmn/VVEgNH/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi! > >>> Well, there certainly seems to be an obvious bug wherein > >>> isp_detach_iommu() just releases the mapping directly without calling > >>> arm_iommu_detach_device() to balance the equivalent attach. That can't > >>> be helping. > >> > >> Indeed, I have been able to reproduce the same warning using a > >> standalone test module, and the missing arm_iommu_detach_device() is > >> causing the warning after probe (during failure path) or during > >> remove. > >=20 > > Ok do you have an idea how to fix the isp error paths? Untested patch > > would be fine... But it seems that you know what needs to be fixed and > > I don't. > >=20 >=20 > OK, see if the following fixes the issue for you, only build tested. Word-wrapped, so I applied by hand. And yes, the oops at boot is gone. Thanks! (Camera still does not work in -next... kills system. Oh well. Lets debug that some other day.) > 8< --------------------- > >From bac9a48fb646dc51f2030d676a0dbe3298c3b134 Mon Sep 17 00:00:00 2001 > From: Suman Anna > Date: Fri, 9 Mar 2018 16:39:59 -0600 > Subject: [PATCH] media: omap3isp: fix unbalanced dma_iommu_mapping >=20 > The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware > ARM DMA backend. The current code creates a dma_iommu_mapping and > attaches this to the ISP device, but never detaches the mapping in > either the probe failure paths or the driver remove path resulting > in an unbalanced mapping refcount and a memory leak. Fix this properly. >=20 > Reported-by: Pavel Machek > Signed-off-by: Suman Anna Tested-by: Pavel Machek Pavel --=20 (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blo= g.html --TB36FDmn/VVEgNH/ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlqjwOoACgkQMOfwapXb+vJJbgCfVSUWcrQSvbEH+6yJBquFBb8I 1cMAnA/8EDcPBiOy5Ljr1mXZR07zUmX9 =hZzt -----END PGP SIGNATURE----- --TB36FDmn/VVEgNH/--