Re: [PATCH 5.10 074/243] iommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails

Pavel Machek
2021-07-20T22:05:30Z

[-- Attachment #1: Type: text/plain, Size: 1177 bytes --]

Hi!

> From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
>
> [ Upstream commit 1adf30f198c26539a62d761e45af72cde570413d ]
>
> arm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the
> refcount of the "smmu" even though the return value is less than 0.

Yes.

> The reference counting issue happens in some error handling paths of
> arm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get()
> fails, the caller functions forget to decrease the refcount of "smmu"
> increased by arm_smmu_rpm_get(), causing a refcount leak.

Yes, some error paths do that. But some callers (arm_smmu_map,
arm_smmu_unmap, arm_smmu_flush_iotlb_all, ...) ignore return value of
arm_smmu_rpm_get().

> Fix this issue by calling pm_runtime_resume_and_get() instead of
> pm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount
> balanced in case of failure.

So no, this is not fixed; it is just unbalanced in the other (more
dangerous) direction now.

Best regards,
Pavel

--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]