public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] drivers core: Free dma_range_map when driver probe failed
@ 2021-01-05  5:41 Meng.Li
  2021-01-05  6:00 ` Greg KH
  0 siblings, 1 reply; 4+ messages in thread
From: Meng.Li @ 2021-01-05  5:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: gregkh, rafael, james.quinlan, Kexin.Hao, meng.li

From: Limeng <Meng.Li@windriver.com>

There will be memory leak if driver probe failed. Trace as below:
  backtrace:
    [<000000002415258f>] kmemleak_alloc+0x3c/0x50
    [<00000000f447ebe4>] __kmalloc+0x208/0x530
    [<0000000048bc7b3a>] of_dma_get_range+0xe4/0x1b0
    [<0000000041e39065>] of_dma_configure_id+0x58/0x27c
    [<000000006356866a>] platform_dma_configure+0x2c/0x40
    ......
    [<000000000afcf9b5>] ret_from_fork+0x10/0x3c

This issue is introduced by commit e0d072782c73("dma-mapping:
introduce DMA range map, supplanting dma_pfn_offset "). It doesn't
free dma_range_map when driver probe failed and cause above
memory leak. So, add code to free it in error path.

v2:
set dev->dma_range_map as NULL after memory free.

Fixes: e0d072782c73("dma-mapping: introduce DMA range map, supplanting dma_pfn_offset ")
Cc: stable@vger.kernel.org
Signed-off-by: Meng Li <Meng.Li@windriver.com>
---
 drivers/base/dd.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 148e81969e04..3c94ebc8d4bb 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -612,6 +612,8 @@ static int really_probe(struct device *dev, struct device_driver *drv)
 	else if (drv->remove)
 		drv->remove(dev);
 probe_failed:
+	kfree(dev->dma_range_map);
+	dev->dma_range_map = NULL;
 	if (dev->bus)
 		blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
 					     BUS_NOTIFY_DRIVER_NOT_BOUND, dev);
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [PATCH v2] drivers core: Free dma_range_map when driver probe failed
@ 2021-01-05  7:09 Meng.Li
  0 siblings, 0 replies; 4+ messages in thread
From: Meng.Li @ 2021-01-05  7:09 UTC (permalink / raw)
  To: linux-kernel; +Cc: gregkh, rafael, james.quinlan, Kexin.Hao, meng.li

From: Meng Li <Meng.Li@windriver.com>

There will be memory leak if driver probe failed. Trace as below:
  backtrace:
    [<000000002415258f>] kmemleak_alloc+0x3c/0x50
    [<00000000f447ebe4>] __kmalloc+0x208/0x530
    [<0000000048bc7b3a>] of_dma_get_range+0xe4/0x1b0
    [<0000000041e39065>] of_dma_configure_id+0x58/0x27c
    [<000000006356866a>] platform_dma_configure+0x2c/0x40
    ......
    [<000000000afcf9b5>] ret_from_fork+0x10/0x3c

This issue is introduced by commit e0d072782c73("dma-mapping:
introduce DMA range map, supplanting dma_pfn_offset "). It doesn't
free dma_range_map when driver probe failed and cause above
memory leak. So, add code to free it in error path.

v2:
set dev->dma_range_map as NULL after memory free.

Fixes: e0d072782c73("dma-mapping: introduce DMA range map, supplanting dma_pfn_offset ")
Cc: stable@vger.kernel.org
Signed-off-by: Meng Li <Meng.Li@windriver.com>
---
 drivers/base/dd.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 148e81969e04..3c94ebc8d4bb 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -612,6 +612,8 @@ static int really_probe(struct device *dev, struct device_driver *drv)
 	else if (drv->remove)
 		drv->remove(dev);
 probe_failed:
+	kfree(dev->dma_range_map);
+	dev->dma_range_map = NULL;
 	if (dev->bus)
 		blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
 					     BUS_NOTIFY_DRIVER_NOT_BOUND, dev);
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-01-05  7:10 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-01-05  5:41 [PATCH v2] drivers core: Free dma_range_map when driver probe failed Meng.Li
2021-01-05  6:00 ` Greg KH
2021-01-05  6:58   ` Li, Meng
  -- strict thread matches above, loose matches on Subject: below --
2021-01-05  7:09 Meng.Li

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox