| Message ID | 1612894264-15956-1-git-send-email-loic.poulain@linaro.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | db4e8de1935b0202960e9ebb88ab93e8bd1e66b1 |
| Headers | show |
| Series | [v2] mhi: Fix double dma free | expand |
On Tue, Feb 09, 2021 at 07:11:04PM +0100, Loic Poulain wrote: > mhi_deinit_chan_ctxt functionthat takes care of unitializing channel > resources, including unmapping coherent MHI areas, can be called > from different path in case of controller unregistering/removal: > - From a client driver remove callback, via mhi_unprepare_channel > - From mhi_driver_remove that unitialize all channels > > mhi_driver_remove() > |-> driver->remove() > | |-> mhi_unprepare_channel() > | |-> mhi_deinit_chan_ctxt() > |... > |-> mhi_deinit_chan_ctxt() > > This leads to double dma freeing... > > Fix that by preventing deinit for already uninitialized channel. > > Fixes: a7f422f2f89e ("bus: mhi: Fix channel close issue on driver remove") > Signed-off-by: Loic Poulain <loic.poulain@linaro.org> > Reported-by: Kalle Valo <kvalo@codeaurora.org> > Tested-by: Kalle Valo <kvalo@codeaurora.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Thanks, Mani > --- > v2: add Fixes tag > > drivers/bus/mhi/core/init.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/bus/mhi/core/init.c b/drivers/bus/mhi/core/init.c > index aa575d3..be4eebb 100644 > --- a/drivers/bus/mhi/core/init.c > +++ b/drivers/bus/mhi/core/init.c > @@ -557,6 +557,9 @@ void mhi_deinit_chan_ctxt(struct mhi_controller *mhi_cntrl, > tre_ring = &mhi_chan->tre_ring; > chan_ctxt = &mhi_cntrl->mhi_ctxt->chan_ctxt[mhi_chan->chan]; > > + if (!chan_ctxt->rbase) /* Already uninitialized */ > + return; > + > mhi_free_coherent(mhi_cntrl, tre_ring->alloc_size, > tre_ring->pre_aligned, tre_ring->dma_handle); > vfree(buf_ring->base); > -- > 2.7.4 >
Hello: This patch was applied to qcom/linux.git (refs/heads/for-next): On Tue, 9 Feb 2021 19:11:04 +0100 you wrote: > mhi_deinit_chan_ctxt functionthat takes care of unitializing channel > resources, including unmapping coherent MHI areas, can be called > from different path in case of controller unregistering/removal: > - From a client driver remove callback, via mhi_unprepare_channel > - From mhi_driver_remove that unitialize all channels > > mhi_driver_remove() > |-> driver->remove() > | |-> mhi_unprepare_channel() > | |-> mhi_deinit_chan_ctxt() > |... > |-> mhi_deinit_chan_ctxt() > > [...] Here is the summary with links: - [v2] mhi: Fix double dma free https://git.kernel.org/qcom/c/db4e8de1935b You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/drivers/bus/mhi/core/init.c b/drivers/bus/mhi/core/init.c index aa575d3..be4eebb 100644 --- a/drivers/bus/mhi/core/init.c +++ b/drivers/bus/mhi/core/init.c @@ -557,6 +557,9 @@ void mhi_deinit_chan_ctxt(struct mhi_controller *mhi_cntrl, tre_ring = &mhi_chan->tre_ring; chan_ctxt = &mhi_cntrl->mhi_ctxt->chan_ctxt[mhi_chan->chan]; + if (!chan_ctxt->rbase) /* Already uninitialized */ + return; + mhi_free_coherent(mhi_cntrl, tre_ring->alloc_size, tre_ring->pre_aligned, tre_ring->dma_handle); vfree(buf_ring->base);
mhi_deinit_chan_ctxt functionthat takes care of unitializing channel resources, including unmapping coherent MHI areas, can be called from different path in case of controller unregistering/removal: - From a client driver remove callback, via mhi_unprepare_channel - From mhi_driver_remove that unitialize all channels mhi_driver_remove() |-> driver->remove() | |-> mhi_unprepare_channel() | |-> mhi_deinit_chan_ctxt() |... |-> mhi_deinit_chan_ctxt() This leads to double dma freeing... Fix that by preventing deinit for already uninitialized channel. Fixes: a7f422f2f89e ("bus: mhi: Fix channel close issue on driver remove") Signed-off-by: Loic Poulain <loic.poulain@linaro.org> Reported-by: Kalle Valo <kvalo@codeaurora.org> Tested-by: Kalle Valo <kvalo@codeaurora.org> --- v2: add Fixes tag drivers/bus/mhi/core/init.c | 3 +++ 1 file changed, 3 insertions(+)