lkml.org 
[lkml]   [2021]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 5.10 074/243] iommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails
    Hi!

    > From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
    >
    > [ Upstream commit 1adf30f198c26539a62d761e45af72cde570413d ]
    >
    > arm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the
    > refcount of the "smmu" even though the return value is less than 0.

    Yes.

    > The reference counting issue happens in some error handling paths of
    > arm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get()
    > fails, the caller functions forget to decrease the refcount of "smmu"
    > increased by arm_smmu_rpm_get(), causing a refcount leak.

    Yes, some error paths do that. But some callers (arm_smmu_map,
    arm_smmu_unmap, arm_smmu_flush_iotlb_all, ...) ignore return value of
    arm_smmu_rpm_get().

    > Fix this issue by calling pm_runtime_resume_and_get() instead of
    > pm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount
    > balanced in case of failure.

    So no, this is not fixed; it is just unbalanced in the other (more
    dangerous) direction now.

    Best regards,
    Pavel

    --
    DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
    HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2021-07-21 00:07    [W:4.126 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site