| Message ID | 20210202100332.829047-1-geert+renesas@glider.be |
|---|---|
| State | New |
| Headers | show |
| Series | PCI: Fix memory leak in pci_register_io_range() | expand |
On Tue, Feb 02, 2021 at 11:03:32AM +0100, Geert Uytterhoeven wrote: > Kmemleak reports: > > unreferenced object 0xc328de40 (size 64): > comm "kworker/1:1", pid 21, jiffies 4294938212 (age 1484.670s) > hex dump (first 32 bytes): > 00 00 00 00 00 00 00 00 e0 d8 fc eb 00 00 00 00 ................ > 00 00 10 fe 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > backtrace: > [<ad758d10>] pci_register_io_range+0x3c/0x80 > [<2c7f139e>] of_pci_range_to_resource+0x48/0xc0 > [<f079ecc8>] devm_of_pci_get_host_bridge_resources.constprop.0+0x2ac/0x3ac > [<e999753b>] devm_of_pci_bridge_init+0x60/0x1b8 > [<a895b229>] devm_pci_alloc_host_bridge+0x54/0x64 > [<e451ddb0>] rcar_pcie_probe+0x2c/0x644 > > In case a PCI host driver's probe is deferred, the same I/O range may be > allocated again, and be ignored, causing a memory leak. > > Fix this by (a) letting logic_pio_register_range() return -EEXIST if the > passed range already exists, so pci_register_io_range() will free it, > and by (b) making pci_register_io_range() not consider -EEXIST an error > condition. > > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Applied to pci/enumeration for v5.12, thanks! > --- > drivers/pci/pci.c | 4 ++++ > lib/logic_pio.c | 3 +++ > 2 files changed, 7 insertions(+) > > diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c > index 09b03cfba8894955..c651003e304a2b71 100644 > --- a/drivers/pci/pci.c > +++ b/drivers/pci/pci.c > @@ -4037,6 +4037,10 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr, > ret = logic_pio_register_range(range); > if (ret) > kfree(range); > + > + /* Ignore duplicates due to deferred probing */ > + if (ret == -EEXIST) > + ret = 0; > #endif > > return ret; > diff --git a/lib/logic_pio.c b/lib/logic_pio.c > index f32fe481b4922bc1..07b4b9a1f54b6bf5 100644 > --- a/lib/logic_pio.c > +++ b/lib/logic_pio.c > @@ -28,6 +28,8 @@ static DEFINE_MUTEX(io_range_mutex); > * @new_range: pointer to the IO range to be registered. > * > * Returns 0 on success, the error code in case of failure. > + * If the range already exists, -EEXIST will be returned, which should be > + * considered a success. > * > * Register a new IO range node in the IO range list. > */ > @@ -51,6 +53,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range) > list_for_each_entry(range, &io_range_list, list) { > if (range->fwnode == new_range->fwnode) { > /* range already there */ > + ret = -EEXIST; > goto end_register; > } > if (range->flags == LOGIC_PIO_CPU_MMIO && > -- > 2.25.1 >
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 09b03cfba8894955..c651003e304a2b71 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -4037,6 +4037,10 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr, ret = logic_pio_register_range(range); if (ret) kfree(range); + + /* Ignore duplicates due to deferred probing */ + if (ret == -EEXIST) + ret = 0; #endif return ret; diff --git a/lib/logic_pio.c b/lib/logic_pio.c index f32fe481b4922bc1..07b4b9a1f54b6bf5 100644 --- a/lib/logic_pio.c +++ b/lib/logic_pio.c @@ -28,6 +28,8 @@ static DEFINE_MUTEX(io_range_mutex); * @new_range: pointer to the IO range to be registered. * * Returns 0 on success, the error code in case of failure. + * If the range already exists, -EEXIST will be returned, which should be + * considered a success. * * Register a new IO range node in the IO range list. */ @@ -51,6 +53,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range) list_for_each_entry(range, &io_range_list, list) { if (range->fwnode == new_range->fwnode) { /* range already there */ + ret = -EEXIST; goto end_register; } if (range->flags == LOGIC_PIO_CPU_MMIO &&
Kmemleak reports: unreferenced object 0xc328de40 (size 64): comm "kworker/1:1", pid 21, jiffies 4294938212 (age 1484.670s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 e0 d8 fc eb 00 00 00 00 ................ 00 00 10 fe 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ad758d10>] pci_register_io_range+0x3c/0x80 [<2c7f139e>] of_pci_range_to_resource+0x48/0xc0 [<f079ecc8>] devm_of_pci_get_host_bridge_resources.constprop.0+0x2ac/0x3ac [<e999753b>] devm_of_pci_bridge_init+0x60/0x1b8 [<a895b229>] devm_pci_alloc_host_bridge+0x54/0x64 [<e451ddb0>] rcar_pcie_probe+0x2c/0x644 In case a PCI host driver's probe is deferred, the same I/O range may be allocated again, and be ignored, causing a memory leak. Fix this by (a) letting logic_pio_register_range() return -EEXIST if the passed range already exists, so pci_register_io_range() will free it, and by (b) making pci_register_io_range() not consider -EEXIST an error condition. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> --- drivers/pci/pci.c | 4 ++++ lib/logic_pio.c | 3 +++ 2 files changed, 7 insertions(+)